Thanks TD,
I already wrote a WinBatch program that scans for all EXISTING shares that have Everyone and change that Everyone to the Domain Users. That program has been working for years really great, but it did not prevent people from creating new shares with Everyone again. We have to deploy it regularly to fix those things (at one time we planned to add it to the RUN registry to scan the system when the user log in but this will hurt the user login time and we don't want to do that.)
Our goal now is somehow whenever the user creates a share, he/she will see that the default user is Domain Users instead of Everyone.
Thanks again TD for your advices.
hien