samba - Jan 2007 - Am I going about this all the wrong way?

Sorry for the title, but couldnt think how to word it.
 
Basically we have a piece of software that all departments in our company uses,
placed on the samba server but runs from windows. Because different departments
use other items on the server which will differ depending on who needs them this
is what i have done:
 
       [AccountsFolder] |---------------[SymbolicLink1] - Linked to
folder1/softwarefolder
 
[folder1] - Contains the software for all
    |-------[Softwarefolder]
 
       [SalesFolder] |---------------[SymbolicLink2] - Linked to
folder1/softwarefolder
 
The Folder1 is owned by domain admins
AccountsFolder owned by Accounts
and Salesfolder owned by Sales.
 
[smb.conf]
 
[Accounts]
 browseable = no
 inherit permissions = Yes
 delete readonly = Yes
 writeable = yes
 valid users = @Accounts
 path = /var/samba/Accounts
 force group = Accounts
 
[Sales]
 browseable = no
 inherit permissions = Yes
 delete readonly = Yes
 writeable = yes
 valid users = @Sales
 path = /var/samba/Sales
 force group = Sales
 
However, when i check the connections using webmin, there are users in accounts
who have connections open from sales and visa versa. This I was hoping someone
could enlighten me on. I cannot figure out how they can gain access to a share
that they have no permissions to open. When I browse from their machines to try
and open the other shares its as you would expect [Access Denied]
 
So basically im wondering if i am going about this all the wrong way, and maybe
someone could hint at a better way.
 
Thanks
Dave
 
___________________
Systems Administrator
Praybourne Limited
 
Tel: +44 (0) 870 2420004
Fax: +44 (0) 1527 68780

> I cannot figure out how they can gain access to a share that they
> have no permissions to open.
I don't know whether this answers your question, but AFAIK connecting
to a share doesn't require any credentials - you only need to log in
before accessing the *data* in that share.

I say this because under Windows if you connect to a machine and/or
share that you don't have access to, running "net view" will
sometimes
show that the connection is still there (which is a pain if you used
the wrong username, because you have to remove that dud connection
before Windows will let you try again with a different username.)

If nobody can access the files in the share then I wouldn't worry about
it.

Cheers,
Adam.