diff -urN source.orig/param/loadparm.c source/param/loadparm.c
--- source.orig/param/loadparm.c	Fri Feb  5 20:17:50 1999
+++ source/param/loadparm.c	Mon Feb 15 13:02:31 1999
@@ -228,6 +228,7 @@
   BOOL bTimeServer;
   BOOL bBindInterfacesOnly;
   BOOL bUnixPasswdSync;
+  BOOL bRestrictAnonymous;
   BOOL bPasswdChatDebug;
   BOOL bOleLockingCompat;
   BOOL bTimestampLogs;
@@ -759,6 +760,7 @@
   {"time offset",      P_INTEGER, P_GLOBAL, &extra_time_offset,         NULL,   NULL,  0},
   {"unix realname",    P_BOOL,    P_GLOBAL, &Globals.bUnixRealname,     NULL,   NULL,  0},
   {"NIS homedir",      P_BOOL,    P_GLOBAL, &Globals.bNISHomeMap,       NULL,   NULL,  0},
+  {"restrict anonymous", P_BOOL,  P_GLOBAL, &Globals.bRestrictAnonymous,NULL,   NULL,  0},
   {"-valid",           P_BOOL,    P_LOCAL,  &sDefault.valid,            NULL,   NULL,  FLAG_HIDE},
   {"copy",             P_STRING,  P_LOCAL,  &sDefault.szCopy,           handle_copy, NULL,  FLAG_HIDE},
   {"include",          P_STRING,  P_LOCAL,  &sDefault.szInclude,        handle_include, NULL,  FLAG_HIDE},
@@ -891,6 +893,7 @@
   string_set(&Globals.szNISHomeMapName, "auto.home");
 #endif
 #endif
+  Globals.bRestrictAnonymous = False;
   Globals.client_code_page = DEFAULT_CLIENT_CODE_PAGE;
   Globals.bTimeServer = False;
   Globals.bBindInterfacesOnly = False;
@@ -1196,6 +1199,7 @@
 FN_GLOBAL_BOOL(lp_nt_smb_support,&Globals.bNTSmbSupport)
 FN_GLOBAL_BOOL(lp_nt_pipe_support,&Globals.bNTPipeSupport)
 FN_GLOBAL_BOOL(lp_stat_cache,&Globals.bStatCache)
+FN_GLOBAL_BOOL(lp_restrict_anonymous,&Globals.bRestrictAnonymous)
 
 FN_GLOBAL_INTEGER(lp_os_level,&Globals.os_level)
 FN_GLOBAL_INTEGER(lp_max_ttl,&Globals.max_ttl)
diff -urN source.orig/smbd/reply.c source/smbd/reply.c
--- source.orig/smbd/reply.c	Fri Feb  5 20:17:54 1999
+++ source/smbd/reply.c	Mon Feb 15 13:02:31 1999
@@ -666,6 +666,26 @@
 	*smb_apasswd = 0;
       }
     }
+
+    if (lp_restrict_anonymous()) {
+      /* there seems to be no rational behind the differences in MS clients formatting
+       * various info like the domain, NativeOS, and NativeLanMan fields.  Win95
+       * in particular seems to have an extra null byte between the username and the 
+       * domain, or the password length calculation is wrong, which throws off the 
+       * string extraction routines below.  This makes the value of domain be the 
+       * empty string, which fails the restrict anonymous check further down.  
+       * This compensates for that, and allows browsing to work in mixed NT and 
+       * win95 environments even when restrict anonymous is true. AAB
+       */
+      dump_data(9, p, 0x70);
+      DEBUG(9, ("passlen1=%d, passlen2=%d\n", passlen1, passlen2));
+      if (ra_type == RA_WIN95 && !passlen1 && !passlen2 && p[0] == 0 && p[1] == 0) {
+        DEBUG(0, ("restrict anonymous parameter used in a win95 environment!\n"));
+        DEBUG(0, ("client is win95 and broken passlen1 offset -- attempting fix\n"));
+        DEBUG(0, ("if win95 cilents are having difficulty browsing, you will be unable to use restrict anonymous\n"));
+        passlen1 = 1;
+      }
+    }
     
     p += passlen1 + passlen2;
     fstrcpy(user,p); p = skip_string(p,1);
@@ -686,6 +706,20 @@
     return session_trust_account(conn, inbuf, outbuf, user, 
                                  smb_apasswd, smb_apasslen,
                                  smb_ntpasswd, smb_ntpasslen);
+  }
+
+  if (done_sesssetup && lp_restrict_anonymous()) {
+    /* tests show that even if browsing is done over already validated connections
+     * without a username and password the domain is still provided, which it 
+     * wouldn't be if it was a purely anonymous connection.  So, in order to 
+     * restrict anonymous, we only deny connections that have no session 
+     * information.  If a domain has been provided, then it's not a purely 
+     * anonymous connection. AAB
+     */
+    if (!*user && !*smb_apasswd && !*domain) {
+      DEBUG(0, ("restrict anonymous is True and anonymous connection attempted\n"));
+      return(ERROR(ERRDOS,ERRnoaccess));
+    }
   }
 
   /* If no username is sent use the guest account */
