Try adding something similar in tomcat\webapps\share\WEB-INF\classes\alfresco\share-form-config.xml
<config replace="true">
<flags>
<!–
Developer debugging setting to turn on DEBUG mode for client scripts in the browser
–>
<client-debug>true</client-debug>
<!–
LOGGING can always be toggled at runtime when in DEBUG mode (Ctrl, Ctrl, Shift, Shift).
This flag automatically activates logging on page load.
–>
<client-debug-autologging>false</client-debug-autologging>
</flags>
<header>
<app-items>
<!– defaults: icon="{id}.png" label="header.{id}.label" description="header.{id}.description" –>
<item type="link" id="my-dashboard">{userdashboardpage}</item>
<item type="js" id="sites">Alfresco.module.Sites</item>
<item type="link" id="people">/people-finder</item>
<item type="link" id="repository" permission="admin" condition="conditionRepositoryRootNode">/repository</item>
<item type="container" id="more">
<container-group id="my">
<item type="link" id="my-sites">/user/user-sites</item>
<item type="link" id="my-profile">{userprofilepage}</item>
</container-group>
<container-group id="tools" permission="admin">
<item type="link" id="application">/console/admin-console/application</item>
<item type="link" id="groups">/console/admin-console/groups</item>
<item type="link" id="replication-jobs" condition="!conditionEditionTeam">/console/admin-console/replication-jobs</item>
</container-group>
</item>
</app-items>
<user-items>
<item type="container" id="user" icon="" description="">
<container-group id="usermenu" label="">
<item type="user" id="status">{userprofilepage}</item>
<item type="link" id="my-profile">{userprofilepage}</item>
<item type="external-link" id="help">{share-help}</item>
<item type="link" id="logout" condition="!context.externalAuthentication">/dologout</item>
</container-group>
</item>
</user-items>
<dependencies>
<css src="/modules/create-site.css" />
<css src="/modules/header/sites.css" />
<js src="/modules/create-site.js" />
<js src="/modules/header/sites.js" />
</dependencies>
</header>
</config>
<container-group id="tools" permission="admin"> This will allow only the users with admin permission to access the links.
