Network Shares

The Network Shares check lists every SMB share on a Windows device together with its share permissions and the NTFS permissions of the shared folder, and alerts when a share is open to Everyone, Authenticated Users, Anonymous Logon or Guests. Open write access always raises a critical alert; open read-only access raises a warning you can switch off. The check runs on the device through the octoja agent and reads everything locally with the SMB tooling built into Windows — nothing is installed and no credentials are needed. It runs every 12 hours by default.

Prerequisites

• The check runs on Windows only — client editions from Windows 8, server editions from Windows Server 2012. Those releases ship the SMB tooling the check reads shares and permissions with; on an older Windows the check reports the Get-SmbShare message below instead of a status.

Steps

1. Go to Devices and open the Windows device.
2. Click the Checks tab → Add Check → Network Shares.
3. Adjust the settings if needed.
4. Click Add Check.

Settings

All fields are optional — the check runs with its defaults out of the box.

• The printer-driver share PRINT$ also counts as an admin share. Turning off Include admin shares removes these shares from both the list and evaluation. A custom hidden share such as Data$ remains monitored: a trailing $ alone does not make it an admin share. To keep PRINT$ visible without raising alerts, leave admin shares enabled and add PRINT$ to Shares excluded from alerting.
• Wildcards work in Shares excluded from alerting — Backup* matches every share whose name starts with Backup, and ? stands for a single character. Names are matched without regard to upper or lower case. Excluded shares stay in the list with the Excluded from alerting chip; they never change the check result.
• Query timeout (seconds) has a floor of 30 seconds: values from 1 to 29 are raised to 30 when the check runs, and 0 falls back to the default of 120.

Results

Share permissions and NTFS permissions are evaluated separately. The check does not calculate their combined effective access. Restrictive NTFS permissions therefore do not cancel an alert for Change access granted to Authenticated Users on the share. Do not change a share to read-only just to clear the check if users need write access.

For intentional exceptions, use Shares excluded from alerting. A single * matches all shares and keeps their permissions visible, but suppresses all per-share findings: share permissions, NTFS permissions, and failures to read those permissions. This is not a switch for share-permission alerts alone. Monitor the excluded permissions another way; failures of the overall query can still produce an error.

The check result is the worst result across all shares. Open means access for Everyone, Authenticated Users, Anonymous Logon or Guests.

Deny entries never raise an alert: an entry that denies one of the four principals access restricts the share rather than opening it. It stays visible in the permission list, marked Deny.

What the check reports

Every run produces one card per share, with any findings collected above the list.

• A summary line showing how many shares were checked and how many of them have open permissions. On a device with no shares to list, it reads No shares found. instead.
• A list of findings, one line per open permission in the form Share “…”: share permission “…” for … — or NTFS permission for rights set on the shared folder.
• One card per share with its name, file path and an OK, Warning or Critical badge; admin shares carry an Admin share chip, excluded shares an Excluded from alerting chip. Cards fold open and shut; those with a warning or critical result start open.
• Inside each card the Share permissions and NTFS permissions, each with account and rights; deny entries are marked Deny, and the four open principals are highlighted.

When the check can't run

If the query itself fails, the check reports an error instead of a status — none of these messages say anything about the shares.

Related articles

• Assign checks with config packages