search cancel

CCS Audit checks do not work for Data Collection or Query jobs when default Administrative shares are missing

book

Article ID: 162432

calendar_today

Updated On:

Products

Control Compliance Suite Windows

Issue/Introduction

When performing a data collection job, or a query on Windows assets, an error may be seen for "Audit Subcategory" checks.

"The network name cannot be found. Error Code = 0x00000043 (67)"

Cause

Some Windows checks require the presence of default administrative shares Admin$ and C$ in order to succeed to collect the requested data.

Resolution

Check that Admin$ and C$ are present for the target asset, by running the command "net share".

If these are missing, you can enable proper creation of these share, by editing (or adding, if missing) these registry keys and restarting the server service:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks

The registry subkeys AutoShareServer and AutoShareWks must be set as type REG_DWORD with a value of 1.

Run the command "net server stop", then "net server start" to restart the server service.