domain administrator account can be locked out? AFAIK, W2K should reject network based authentication attempts for administrator BUT allow administrator to logon at the domain controller's physical console to prevent the administrator account from being locked out of the network by account lockout rules. so try logging in as domain admin at the server physical console.

I think you mean local administrator account on the local computer right?

make sure you're Log on to: domian and not servername(this computer).

sorry. don't understand what you're trying to say.

you can logon with domain account because you've changed your local policy/group policy to disable local logon. group policy will be enforced on all workstation connected to domain. therefore users can only logon with their domain account on the domain.

if you want to reverse this, just set back the local/group policy back to default values.