Quote Originally Posted by Frazer
On the domain controller set "Microsoft network server: Digitally sign communications (always)" to Disabled.
Start > Administrative Tools > Domain Security Policy > Security Settings > Local Policies > Security Options > in here!

Alternatively a member server (not a DC) _should_ work without disabling this setting (move the image there)
Thats the one! It took us days to work it out when we first had 2003 - I'd forgotten that.