OK but the question said that all the ports are opened, and the output of a null scan targeting a windows box is all closed, is this correct?

Tom

I am studying for the CEH and I ran accross this problem on a forum.  Here is the questoin

You are having problems while retrieving results after performing port scanning during internal testing. You verify that there are no security devices between you and the target system.  When both stealth and connect scanning do not work you decieded to perform a NULL scan with NMAP.  The first few systems scanned show all opened ports.  Which of the following statements is probley true?

A. The systems have all opened ports
B. The systems are running a hosed based IDS
c. The systems are web servers.
D. The systems are runing windows

The forum says that the answer is D but when I do a null scan of a windows computer, I get all ports are closed.  Am I wrong with saying that all ports are closed when I scan a Windows computer with the null swich?

Thanks
Tim