I read another thread in here and they mentioned that I might try tweaking the register. Here's what I did:
1. Start Registry Editor.
2. Locate, and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
3. On the Edit menu, click Add Value, and then add the following registry value:
Value Name: RestrictAnonymous
Data Type: REG_DWORD
Value: 2
Default: 0
A value of 2 restricts null session connections.
I had to reboot but it seems to be working. However, when I run net statistics server, it shows only one session now. That might be due to the reboot. I'll wait and see if it keeps working or not.