It would be good to have a ucr-variable for setting "browseable no" to sysvol, printer share and netlogon. It doesn't increase safety, but it reduces the need for "oh let's see what's in there".