DFS Namespace Root (physical location, and permissions)

all servers are 2008 R2

I've established my namespace root, set up my folders and my test account only sees the folders I wish it to see.

However, my test user, even when not in any authorized group, not only can see the namespace root, but it can create/edit/delete folders and files within the root itself.

I am trying to find the physical location of the namespace root. I tried creating a file with a unique string so I can search the file system for that file. The search came up empty.

So, first, how do I prevent users from saving to the namespace root?

Second, where is local system's file location for the namespace root?

Thank you,

Jon