the box is facing the external world. and besides rpc (with dcom off) there is nothing else. now i just wanted to ask this C$ question for the sake of asking it. i have turned netbios off on external interfaces. i just asked this because i was wondering why it does it. seeing as there is no remote login to my box through netbios or active directory i dont see this as a security risk.

slart: technically C$ as default share IS a security risk. its a risk that can be secured. Microsoft has a huge problem in the way they do things. they turn too much stuff off by default. if you want this on you should turn it on yourself later. its like leaving finger open. its not needed and can be a security risk (because the daemons have a list of problems with them). your logic is like saying that its okay to have a vulnerable ssh daemon running as long as you firewall it to certain ranges or something of similiar tongue.

IPC$ is the communication share for windows. as slarty stated it will be needed for other shares and a lot of stuff to work.