Samba + Win2k domain server = authenticated access to shares - ??

Hey all,

I am wondering if anyone has experience in setting up samba to do the 
following:

My company uses a Windows 2000 Active Directory/Domain server for intranet 
authentication.  I manage a few Linux/Solaris for development purposes.  
Basically, I want to be able to provide authenticated access to shares on 
these machines to certain users of our network.  I want to accomplish this 
without adding individual accounts on the development machines.

Any ideas?  I have been at this for most of the day.  What i have done so 
far is compile Samba 3.0.2a with pam and winbind support.  Having a 
smb.conf configuration similar to the following:

winbind separator = +
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/winnt/%D/%U
template shell = /bin/bash
workgroup = WORKGROUP
#security = domain
#password server = *
encrypt passwords = yes

(I have also tried it with uncommenting out the security option, with the 
same results)

I run samba using the following commands:

smbd -D
nmbd -D
winbindd -B
net rpc join -U Administrator
<input password here>

It returns that I have successfully joined our domain, with the proper 
domain name.

I can then run the commands wbinfo -u and wbinfo -g to get the long list 
of users and groups, and the getent passwd and getend group commands seem 
to be producing output that makes sense.

The problem right now is, from a windows machine, I can see the machine in 
our workgroup from network neighborhood, but when I try to access it, a 
dialog box comes up and asks for a username and passowrd.  I try all kinds 
of combinations, but nothing seems to work.

I have decided the documnentation on samba.org sucks, as does much of the 
documentation elsewhere on the net.

Thanks in advance...

-- 
Chris Drumgoole
Secretary,
Beijing Linux User Group