administrator must have a mapping to root somehow if windows is accessing the unix style vfiler root (the default is admin on windows maps to root so you could change that)... or you could remove the cifs share for admin.. the "\" share default via C$ to a vFiler directs to a special mount point that sees all volumes.. you can remove it with vfiler run vfilername cifs shares delete c$ to remove windows access.. this is different than vfiler0 where c$ points to the root volume of the system...but the vfiler default is all volumes root but can be changed to the path of root volume if you want to match vfiler0 or just delete it for no windows access.
you can also use the diag account to mount back to the vfiler from the bsd prompt from the system shell outside of ontap but via the same login, but I wouldn't do that if you have host access to do it...