This is typically caused by windows brain dead behaviour. Once access is granted, no attempts to use updated credentials will be made, despite windows asking for new credentials.
So, you MUST access the most restrictive share first, if windows opens a public share first it's game over.
Try setting ALL your shares to private, to force windows to use the correct credentials initially.