walkman externally with a null ipc share did it. It also explains why the first three accounts always keep showing up (They are the first three RID's). At least now I have proof to tell management it really is this easy to get all of our groups and users and such.

Only option is to turn off port 139. However i would like to get 135 - 139 off as well. At least we are getting somewhere.

Thanks for all of your help. You guys rock.