s3: Lock down some srvsvc calls according to what w2k3 seems to do