First off a computer can only be a member of one domain at a time as shown in the
computer name properties. You don't mention what kind of domain computers are in the
W2K domain - if they are W2K/XP Pro or NT/W9X. In a W2K domain, W2K/XP Pro computers
need dns [AD domain controller only]to find a domain controller in their domain while
NT/W9X computers still rely on wins to find a domain controller, so possibly the
server you are shutting down provides some networking service to computers in the W2K
domain that is disrupted when it is shut down not allowing them to authenticate to
the domain for access to network resources causing them to be prompted for
credentials to try and authenticate to the servers local user sam instead. For a W2K
domain keep in mind that the domain controllers must point only to themselves or
another AD domain controller as their preferred dns server in tcp/ip configuration
and W2K/XP Pro domain members must point only to a AD domain controller for their
domain. If wins is used, the W2K domain controllers must also be wins clients and a
wins computer must point only to itself as wins client. Also look in Event Viewer on
domain computers and domain controllers for any pertinent error messages in the W2K
domain and enable auditing of account logon events in Domain Controller Security
Policy and logon events in the Local Security Policy of servers providing shares. You
can then view the security log in Event Viewer for logon events that may be helpful
as to what is going on.-- Steve
