I've removed all Windows 2000 domain controllers from my domain. Now, why won't Windows NT 4.0 domain controllers authenticate Win2K Professional clients?

A. By default, when you install a Win2K client into a domain with Win2K DCs, the secure channel that the system uses for communication with the DCs is configured to use Kerberos. NT 4.0 doesn't support Kerberos; it supports only NT LAN Manager (NTLM). Thus, when a Win2K client tries to authenticate through an NT 4.0 DC, the client receives the following error message:

The system cannot log you on to this domain because the system's machine account in its primary domain is missing or the password on that account is incorrect.

To solve this problem, remove the client from the domain and then add the client back to the domain, which forces the client to use NTLM when its attempts to use Kerberos fail. You should remove the computer account using the Server Manager NT 4.0 tool and then recreate a new computer account. To use the client GUI, perform the following steps:

You can also remove the client computer and add it back using the NETDOM tool:

NETDOM REMOVE /Domain:[domain name] [workstation name] /UserD:[domain name]\[administrator account] /PassworD:[password]
NETDOM ADD/Domain:[domain name] [workstation name] /UserD:[domain name]\[administrator account] /PassworD:[password]