How to Read this Output from 'Net Share' (Win Command Line)

[WWGD]

Hi,
I was experimenting , after doing some reading, with 'Net Share' in my Windows 10 Command Line, on my PC, which I'm not using as a server, i.e., I'm not running ( nor do I have installed) Windows Server nor other server software.
The output was:

Share name Resource Remark

-------------------------------------------------------------------------------
C$ C:\ Default share
D$ D:\ Default share
IPC$ Remote IPC
ADMIN$ C:\WINDOWS Remote Admin
SQLServer2017Media
C:\SQLServer2017Media
The command completed successfully.

My limited research tells me the $ sign means the resourcees are being shared. Now, AFAIK, C,D drivs are shared by default ( Though not too clear on what that means/implies ). But IPC, ADMIN are not shared by default. But Remote IPC, Remote Admin are not.

Just how do I read this output?

 

[pbuk]

It's always a good idea to post command line output in code tags thusly (this is my output which as you can see is similar to yours):

C:\Users\pbuk>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
C$           C:\                             Default share
E$           E:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\WINDOWS                      Remote Admin
The command completed successfully.

I'm not running ( nor do I have installed) Windows Server nor other server software.

Well you do seem to be running MS SQL Server.

My limited research tells me the $ sign means the resources are being shared.

Well the fact that they are listed under "Share Name" tells you that, but yes, Windows system shares are by convention terminated with a $.

Just how do I read this output?

Don't worry about it. As long as you have not messed about with your firewall settings or permissions you'll be OK.

 

[WWGD]

It's always a good idea to post command line output in code tags thusly (this is my output which as you can see is similar to yours):

C:\Users\pbuk>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
C$           C:\                             Default share
E$           E:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\WINDOWS                      Remote Admin
The command completed successfully.

Well you do seem to be running MS SQL Server.Well the fact that they are listed under "Share Name" tells you that, but yes, Windows system shares are by convention terminated with a $.Don't worry about it. As long as you have not messed about with your firewall settings or permissions you'll be OK.

Thanks for the editing and the reminder. I had enabled TCP/IP for an instance. I just disabled it. Is there a way of seeing if it has been accessed remotely?
EDIT: I have an absurdly-high number of logins today: some 2500. I'm sure this is done by other processes/programs, but it seems too much in my admittedly limited understanding of this topic.

 

[pbuk]

Thanks for the editing and the reminder. I had enabled TCP/IP for an instance. I just disabled it. Is there a way of seeing if it has been accessed remotely?

Probably not at the OS level unless you set up some specific logging. Are you running a firewall with logging? What port(s) did you open and what was listening on them? Was your router forwarding any WAN traffic to these ports?

 

[WWGD]

Probably not at the OS level unless you set up some specific logging. Are you running a firewall with logging? What port(s) did you open and what was listening on them? Was your router forwarding any WAN traffic to these ports?

I've only enabled apps in my 'allowed' list through the firewall. Other than that, some internal ports and none suspicious; all from sites I've logged on to. Thanks.

 

[WWGD]

Thanks for your help, pbuk.

 

[MikeeMiracle]

Well the fact that they are listed under "Share Name" tells you that, but yes, Windows system shares are by convention terminated with a $.

Share names do not need to have a $ sign on them. The $ at the end of the share indicates a hidden share so if you browse the machine remotely you will not see it come up but can still access it if you know it exists. You can create shares using the $ at the end if you want them to be hidden also.