That's not a bad idea at all.

Hm. I don't want to install Ethereal directly on the domain controller, though. It puts a driver in place and I would really like to not add extra drivers to this mission-critical server that happens to be stable at the moment.

I suppose I could temporarily move the server off of the switch and onto a hub so that I can do the sniffing from an adjacent PC.

So I wonder where, in NT4, I turn off the NTLM encryption? I'll have to hunt for that...