File Share Name Scans without FileShare Path

Apr 7, 2016 at 11:01 PM
I am using WinAudit v3.0.29, and for some reason on most our Windows Server 2008 or 2012 scans will not show the Connections or Share_Path. Is there a setting that would help force these two fields to be shown on the File Share View "v_Network_Shares" (Category_ID = 2500)?

FYI I am using the full set of scan flags:
r=gsoPxuTUeERNtzDaIbMpmidcSArCO

Thanks
Coordinator
Apr 18, 2016 at 3:32 PM
Hi jperrygodfrey,

Apologies for the delay, there are no additional settings to get the connections and/or share_path. Missing data is usually a permission issue. To identify shares, no special permissions are required but to see connections and paths elevated permissions are needed (https://msdn.microsoft.com/en-us/library/windows/desktop/bb525388(v=vs.85).aspx, NetShareGetInfo at level=2). As this is supplemental data about an already found share, WinAudit soldiers on without stopping. As such there is no fix but try version 3.0.30. You can download it from the documentation page https://winaudit.codeplex.com/documentation, the link is just above "1) Introduction". When you run the command append:
/l=log.txt
That will get WinAudit to write out a log file. Near the begining is an entry indicating if the process is running as Administrator or not. Search for "NetShareEnum result:" without the quotes. There may be more messages below that. Error #5 is ERROR_ACCESS_DENIED. You shouldn't see that when running as admin. If something looks wrong, send the log to me at winauditATparmavexDOTcoDOTuk, it does not have any personal info.

oldbury
Marked as answer by jperrygodfrey on 4/19/2016 at 8:03 AM
Apr 19, 2016 at 3:09 PM
I just tried it on version 3.0.29 and checked the Scheduled Task check "Run with highest privileges" and the data returned the share location and the number of shares. I tested with both Windows 2012 R2 and 2008 R2 and it returned the same results.

Also I ran the test on the 3.0.30 version and it works perfect also.

Thank you,