samba - Mar 2010 - Null sid enumeration

I'm needing to prevent null sid enumeration for pci reasons. It's a
samba pdc that authenticates against an openldap backend. I restrict anonymous
set to 1 but I'm still able to pull sid's using cain. I've set it to
2, but as you might expect, no one could login via windows. On the ldap end, I
restricted sambaSID attributes from being shown when searching anonymously, but
that didn't help. What else can I do to prevent null sid enumeration?

Anyone have any tips or advice? I'd hate for this to be the backbreaker on
pci compliance.