Access Denied Trying To Connect To Administrative Shares C$, D$ Etc.

Search

Start typing to search...

↑↓ navigate ↵ select esc closeAccess Denied Trying to Connect to Administrative Shares C$, D$ etc.

• Windows General
• Published Aug 17, 2011 Updated May 30, 2022

Under certain circumstances, you cannot connect to administrative shares (e.g. C$) on remote computers, even though you use the right credentials. Accessing a normal (i.e. non-administrative) share works flawlessly, though.

Problem

In this situation you get the following error when trying to connect to the admin share in Explorer:

This is the message text:

\192.168.175.129\c$ is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

Multiple connections to a server or shared resource by the same user, using more than one username, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

The message hints at multiple connections, but that is misleading.

When you try to connect to the admin share on the command line, you get a different error message:

C:\>net use \\192.168.175.129\c$ /user:win7-2\admin * Type the password for \\192.168.175.129\c$: System error 5 has occurred. Access is denied.

Solution

As described in MS KB article 951916, Microsoft introduced as part of UAC a little known feature called “UAC remote restrictions”. It filters the access token for connections made with local user accounts or Microsoft accounts (the latter typically have the format MicrosoftAccount\EMailAddress). In other words, it removes the SID for “Administrators”. Connections made with domain accounts remain unchanged.

From KB951016:

If the user wants to administer the workstation with a Security Account Manager (SAM) account, the user must interactively log on to the computer that is to be administered with Remote Assistance or Remote Desktop, if these services are available.

LocalAccountTokenFilterPolicy

One may like this or not, the solution is luckily pretty simple. UAC remote restrictions can be disabled by setting the registry value LocalAccountTokenFilterPolicy to 1:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value: LocalAccountTokenFilterPolicy Data: 1 (to disable, 0 enables filtering) Type: REG_DWORD (32-bit)

Setting LocalAccountTokenFilterPolicy From the Command Line

The above value can be set with the following command:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

After a reboot access tokens from remote connections are not filtered any more. On Windows 8 and Windows 10, the reboot is not even required any more.

On this page

• Problem
• Solution
  • LocalAccountTokenFilterPolicy
  • Setting LocalAccountTokenFilterPolicy From the Command Line

Administrative SharesNetworkUAC

Comments

Related Posts

The Unmanageable File Server

I had an interesting little case to solve at home recently when my headless file server suddenly would not accept RDP connections any more. It still worked flawlessly as a file server, so I ignored the problem for a while.Windows GeneralMay 5, 2011

How to Check Which Bluetooth A2DP Audio Codec Is Used on Windows

This is a follow-up to my earlier article Bluetooth Audio Quality & aptX on Windows 10, based on a comment by reader eluxe. Windows makes it unnecessarily hard to identify the audio codec used by the Bluetooth A2DP profile, but there is a way. This post shows how to check if your connection makes use of aptX, LDAC, or some other more advanced codec, or if it falls back to SBC.Windows GeneralSep 9, 2020

Adobe Acrobat & Photoshop: Network Connection Target Hosts

This post lists the internet communication targets of Adobe Acrobat Reader, Photoshop, and Creative Cloud. This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.NetworkingMar 22, 2021

Fixing IPv6 Intermittent Packet Loss Caused by Windows Firewall

This article shows a simple solution to a weird networking problem that plagued me for hours: IPv6 packets were sometimes lost; IPv4 was not affected. Problem: IPv6 Ping Timeouts and Packet Losses Symptom: Teams Issues I noticed the problem first when there were intermittent connectivity issues in Teams during a meeting.NetworkingOct 16, 2025

Latest Posts

Fast & Silent 5 Watt PC: Minimizing Idle Power Usage

This micro-series explains how to turn the Lenovo ThinkCentre M90t Gen 6 into a smart workstation that consumes only 5 Watts when idle but reaches top Cinebench scores while staying almost imperceptibly silent. In the first post, I showed how to silence the machine by replacing and adding to Lenovo’s CPU cooler. In this second post, I’m listing the exact configuration that achieves the lofty goal of combining minimal idle power consumption with top Cinebench scores.HardwareFeb 7, 2026

Fast & Silent 5 Watt PC: Lenovo ThinkCentre M90t Modding

This micro-series explains how to turn the Lenovo ThinkCentre M90t Gen 6 into a smart workstation that consumes only 5 Watts when idle but reaches top Cinebench scores while staying almost imperceptibly silent. In this first post, I’m showing how to silence the machine by replacing and adding to Lenovo’s CPU cooler. In a second post, I’m listing the exact configuration that achieves the lofty goal of combining minimal idle power consumption with top Cinebench scores.HardwareJan 31, 2026

Scripted WordPress to Hugo Migration

After having published in WordPress for almost 20 years, it was time for a change. This site is now rendered by Hugo, a static website generator built for Markdown content hosted in a Git repository. The migration from WordPress (HTML) to Hugo (Markdown) was far from trivial. Since I couldn’t find any tool for the job, I developed my own set of migration scripts that fully automate the migration process. You can find them on GitHub along with extensive documentation.WebsiteJan 25, 2026

Mitsubishi Heat Pump Data in Home Assistant via Modbus

This article shows how to get detailed information about your Mitsubishi heat pump’s status and operations into Home Assistant. Prerequisites You’ll need a Mitsubishi Modbus interface, either the older A1M (serial Modbus/RTU via RS-485 only) or the newer A1M+ (Modbus/TCP via Ethernet in addition to Modbux/RTU). I’m using the Ethernet variant.Home Automation, Networking & Self-HostingDec 27, 2025