walkman externally with a null ipc share did it. It also explains why the first three accounts always keep showing up (They are the first three RID's). At least now I have proof to tell management it really is this easy to get all of our groups and users and such.
Told ya!

Seriously though, glad to help. Also, you *MUST* cut off the RPC port too. Get ALL of those ports closed. Only bad things can come of leaving them open.

Tiger, null pipes werk on all Win32 hosts including Win2k3 and early builds of vista seem to have this annoyance too.

jbclarkman, let us know what management's response is when you present the evidence.

--TH13