Access Denied Trying To Connect To Administrative Shares C$, D$ Etc.

by: Helge, published: Aug 17, 2011, updated: May 30, 2022, in

• Windows General

Access Denied Trying to Connect to Administrative Shares C$, D$ etc.

Contents

• Problem
• Solution
  • LocalAccountTokenFilterPolicy
  • Setting LocalAccountTokenFilterPolicy From the Command Line

Under certain circumstances, you cannot connect to administrative shares (e.g. C$) on remote computers, even though you use the right credentials. Accessing a normal (i.e. non-administrative) share works flawlessly, though.

Problem

In this situation you get the following error when trying to connect to the admin share in Explorer:

This is the message text:

\\192.168.175.129\c$ is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

Multiple connections to a server or shared resource by the same user, using more than one username, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

The message hints at multiple connections, but that is misleading.

When you try to connect to the admin share on the command line, you get a different error message:

C:\>net use \\192.168.175.129\c$ /user:win7-2\admin * Type the password for \\192.168.175.129\c$: System error 5 has occurred. Access is denied.

Solution

As described in MS KB article 951916, Microsoft introduced as part of UAC a little known feature called “UAC remote restrictions”. It filters the access token for connections made with local user accounts or Microsoft accounts (the latter typically have the format MicrosoftAccount\EMailAddress). In other words, it removes the SID for “Administrators”. Connections made with domain accounts remain unchanged.

From KB951016:

If the user wants to administer the workstation with a Security Account Manager (SAM) account, the user must interactively log on to the computer that is to be administered with Remote Assistance or Remote Desktop, if these services are available.

LocalAccountTokenFilterPolicy

One may like this or not, the solution is luckily pretty simple. UAC remote restrictions can be disabled by setting the registry value LocalAccountTokenFilterPolicy to 1:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value: LocalAccountTokenFilterPolicy Data: 1 (to disable, 0 enables filtering) Type: REG_DWORD (32-bit)

Setting LocalAccountTokenFilterPolicy From the Command Line

The above value can be set with the following command:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

After a reboot access tokens from remote connections are not filtered any more. On Windows 8 and Windows 10, the reboot is not even required any more.

• Administrative Shares
• Network
• UAC

About the Author

Helge Klein (ex CTP, MVP, and vExpert) worked as a consultant and developer before founding vast limits, the uberAgent company, which was acquired by the Citrix business unit of Cloud Software Group in late 2023. Previously, Helge applied his extensive knowledge in IT infrastructure projects and architected a user profile management product, the successor of which is now available as Citrix Profile Management. Helge is the author of the popular tools Delprof2 and SetACL. He has presented at Citrix Synergy, BriForum, E2EVC, Splunk .conf, and many other events.

Read more

Previous Article Missing Sharing Tab in Folder Properties on Windows 7 Next Article Quickest Way to Create Text File of Specific Length

37 Comments

• George February 10, 2013 at 14:16

  I am assuming the UAC reg key is not the case if one admin account (set on both machines) will access the C$ with ease but a newly created admin account on both local and server will toss the access denied prompt. Starting to bug me now and I will probably figure it out come the time anyone responds, but have narrowed it down to a server side error as the local account on the client machine will utilize network level auth to pull remote system info on another machine, but will get the access denied when trying to save that file on the server.

  Reply
• David May 22, 2013 at 15:58

  I use a mechanism that runs net use command to verify the local admin account password has not changed on my windows 2003 servers. When we upgraded to 2008 it broke with the system error 5 message. Found your post and this worked for me. Thanks

  Reply
• Carl February 4, 2014 at 18:20

  Big thanks on this article, I found it very useful. I was about to make some backups from my laptop to my desktop, and have just been struggling for more than half an hour with connecting. I was just about to give up when realized that I (for some strange reason) have left the wicked UAC feature enabled on the laptop, so that this could have something to do with it. A Google search “uac admin shares” took me here, and a couple of minutes later I was fixed. In my case, the Windoze registry didn’t even have a DWORD there, so at first I thought I was in the wrong key folder. Anyways, I created the DWORD and rebooted the system. Everything worked. Big thanks!

  Reply
• Kapil September 26, 2014 at 11:15

  Thanks for the workout … it really work as champ. I was havning problem while access c$ of window 2012 using local admin accout. This regitry twik works and aslo as mention reboot not required.

  Reply
• Terry December 26, 2014 at 20:21

  Great find. Thanks much for the tip!

  Reply
• pilat32 March 10, 2015 at 18:38

  Very usefull!!! Thanks much

  Reply
• dom March 13, 2015 at 00:28

  great tip. worked for me on srv 08. did not even have the Dword, had to add it. srv is a workgroup in dmz

  Reply
  • Michael March 19, 2015 at 09:24

    super! was struggling with this for backing up my servers with veeam in dmz… added the key in 2012R2 and it work perfect now!!

    Reply
• dharanesh May 21, 2015 at 06:57

  guys, This did not work for me in windows server 2008 r2. Please help

  Reply
• raymov May 18, 2016 at 01:59

  To avoid a reboot, simply restart the “Server” Service (along with Computer Browser) in services.msc The correct KB article is: 951016

  Reply
• Julian May 25, 2016 at 09:18

  Thank you, you saved me hours of hair pulling.

  Reply
• lorisco May 27, 2016 at 08:27

  great!!!! I had the problem for two years. Thanks

  Reply
• Suki August 15, 2016 at 16:45

  I’m having the same issue – ran the regedit and rebooted but this hasn’t worked for me either – anyone got any other suggestions?

  Reply
• Schnurpf April 26, 2017 at 21:13

  Struggled with this issue since Windows 7. Is still the same in latest Windows 10 release (Creators Update, Version 1703, Build 15063). Used the fix as described, – works perfectly. Super ! Thank you.

  Reply
• Osvaldo June 19, 2017 at 23:31

  Worked like a charm. I do nothave a domain but a standalone Windows 2012 server, and with this solution I was able to map administrative shares with a user account with administrative rights.

  Reply
• Flesz June 21, 2017 at 11:37

  Thanks, that worked on Win 2008 R2 which was not on a domain

  Reply
• Season0091 September 18, 2017 at 10:02

  It is strange. when I add the key and set to 1. It could work right after the server reboot, but about half an hour passed, the error will appear gain. Could any one help? thanks a lot!

  Reply
• Barak October 3, 2017 at 16:12

  Right click Computer and hit Manage Under System Tools, double click Local Users and Groups then click Groups Right click Administrators Click Add to group then click Add then Advanced Click Find Now Double click on Local Service then click OK NT Authority\Local Service should show up in the list, click OK then Reboot

  Reply
• Tonelock November 15, 2017 at 02:03

  I wanted access to backup files remotely on a Windows 10 pro home group.. This worked fine. I created a .reg file that saved me time and will also create the registry entry as well, if it is missing as it appears to be on Windows 10 Pro.

  A .reg file is is just a text file with a .reg extension. create a text file and save it as EnableRemoteHiddenShares.REG then you can just right click on it and use the merge option. or just double click on it.

  —- Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem] “LocalAccountTokenFilterPolicy”=dword:1 —-

  Reply
• vitinrj December 17, 2017 at 16:11

  Thank you so much. It worked great in W7 Pro. Actually it solved a lot of issues which needs admin privileges for local users. The key was not there, so I just created and it worked.

  Reply
• Simon December 22, 2017 at 07:25

  Wow… six years later and this is *still* so relevant. Excellent work Helge. There is an awful lot of mis-information on the ‘net about this issue and how to fix it. Well done.

  Reply
• Leo January 19, 2018 at 16:05

  This did not work for me on Windows 7 32 bit machine.

  Reply
• Alex February 17, 2018 at 13:02

  I used this solution everytime… but for some pc, with windows 10 pro, i don’t know why (I think after some windows update) this solution is not enough. Pc (server side) asks me username and password, but does not recognize them. I tried disabling antivirus and firewall, but nothing to do.

  Reply
  • Llewellyn October 22, 2018 at 20:07

    Try this work around; share the network folder (i.e. \\server\C) and grant the user (i.e. user1) read access+. Now test and see if it works. This should also bypass UAC Remote Restrictions as you explicitly shared the network share. If it still fails, setup the same user on your local computer and try again.

    Reply
• Jibin John Philip March 6, 2018 at 13:41

  Access Denied Trying to Connect to Administrative Shares C$, D$ etc.

  Open Registry -regedit run as administrator Then copy paste below link to the registry

  Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

  create new – Dword (32bit value) LocalAccountTokenFilterPolicy Value data change-1

  Reply
• Gauss August 7, 2018 at 05:16

  Thank you!!!

  Reply
• Mike November 8, 2018 at 01:22

  We have 3 Win 2008 R2 servers (plus some 2012s). I can access admin shares (C$, D$) at will out of the box with all of them except one 2008 R2 box. I get the same message as posted above. I’ve tried both the domain administrator account and the local administrator account.

  I compared the registry on all 3 2008 boxes and they are all exactly the same – none of them have that key. Two of them I can access fine, the other one I can’t. Firewalls are off on all of them.

  I also checked the local administrators group for the LOCAL SYSTEM account and it is not there in all 3 boxes.

  I know this is an old post but maybe somebody has new info.

  Thanks.

  Reply
• Baldo November 8, 2018 at 10:19

  Had an issue with Veeam B&R using a local account for connecting and activating VSS, applied this solution and worked for me. Great! Thanks

  Reply
• Vitek June 12, 2019 at 04:51

  Thank you so much!!! Making this change allowed me to access the admin shares.

  Reply
• T. Howard December 9, 2019 at 17:41

  This Worked for me as well, Thanks!

  Reply
• some guy February 14, 2020 at 16:02

  8 1/2 years later and this helped me out on Windows Server 2016, thank you!

  Reply
• norb April 29, 2020 at 18:07

  I thought this was a local security policy to adjust but I could not find it. This fix resolved it and yes with no reboot required. By the way, it seem to also have unlocked ability to shutdown remotely (shutdown -m \\computername) this was also not possible until applying this fix (no reboot neither) Thanks for the solution.

  Reply
• Junaid Abrar July 7, 2020 at 06:42

  Awesome Blog… it worked for me on Windows 2016 Std Server. I was trying to manage the server on WMI and failing to even get the admin share remotely of the servers running in workgorup… implement the reg key and restarted, all good.

  Thank you.

  Reply
• Vinodh August 30, 2020 at 17:03

  LocalAccountTokenFilterPolicy – wasn’t there.. Added this key with value 1.. It works in Windows 10 Pro 64 Bit..

  Thanks for the tip.

  Reply
• Mike Cooper October 19, 2021 at 11:34

  Great find! Thanks so much.

  Reply
• Steve July 20, 2022 at 12:03

  Such frustration. One of my home servers stopped accepting access to admin shares via UNC from any other machine on the network. Same credentials for admin accounts but this thing wouldn’t go.

  Reg added and immediately works.

  Thanks heaps!

  Reply
• Mike November 18, 2022 at 21:53

  Spent 5 hours working on this. Your link saved me no telling how many more. Thanks!

  Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Save my name, email, and website in this browser for the next time I comment.

Related Posts

Missing Sharing Tab in Folder Properties on Windows 7

Sometimes the “Sharing” tab in the folder properties goes missing. If that is the case and you right-click a folder and select “Properties”, it looks like this:

Read more

by Helge on

• Windows General

The Unmanageable File Server

I had an interesting little case to solve at home recently when my headless file server suddenly would not accept RDP connections any more. It still worked flawlessly as a […]

Read more

by Helge on

• Windows General

Fixing IPv6 Intermittent Packet Loss Caused by Windows Firewall

This article shows a simple solution to a weird networking problem that plagued me for hours: IPv6 packets were sometimes lost; IPv4 was not affected.

Read more

by Helge on

• Networking

Split-Tunnel VPN & WiFi: No Internet via IPv4 Due to Interface Priority

I had a weird issue on my laptop: whenever I connected to our company’s VPN, I lost local internet connectivity. As it turned out, this was caused by incorrect network […]

Read more

by Helge on

• Networking

Latest Posts

Mitsubishi Heat Pump Data in Home Assistant via Modbus

This article shows how to get detailed information about your Mitsubishi heat pump's status and operations into Home Assistant.

Read more

by Helge on Dec 27, 2025

• Home Automation, Networking & Self-Hosting

GitHub: Authenticated Access via SSH

This article describes how to set up authenticated access to a (private or public) GitHub repository from Linux.

Read more

by Helge on Dec 6, 2025

• Software development

Fixing IPv6 Intermittent Packet Loss Caused by Windows Firewall

This article shows a simple solution to a weird networking problem that plagued me for hours: IPv6 packets were sometimes lost; IPv4 was not affected.

Read more

by Helge on Oct 17, 2025

• Networking

Fixing VS Code UI Unresponsiveness Caused by GitHub Copilot Extension

This article shows a simple solution to a problem that doesn't seem to be adequately documented: VS Code UI lags, freezes, and delays caused by the GitHub Copilot extension.

Read more

by Helge on Oct 3, 2025

• Applications