Entire C drive suddenly gets shared Win 10 pro

Question

I noticed that my entire C drive became shared (actual normal share not the default C$) Is there anywhere a log that can be checked for what caused the creation of a share? My current 1st suspect is probably filezilla doing some wonky stuff, since it's the only new addition to the system since I noticed C drive being shared.

Answer 1

Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142

HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.

That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.