rpcclient will return a user list for me. It certainly wont work for usermgr on the NT wiorkstation. I dont have netmon, but hopefully I can get a snoop/tcpdump trace of an attempted transaction a little later today.