These are just a few tips on hacking win 2000, i know win is lame, but lets face the facts, something like 90% of comps on the net are running some flavor or windoze

these examples only work if the NBNS (udp 137) service is open:
(type these are command prompt of win2k box, i dont know what other win flavs will work on)

netview /domaintarget domain here)

this will show a list of subdomains in a given given domain
another way to do pretty much the same thing is

nbtstat -a (target ip here)

a useful to find info on a target win2k comp is

nslookup
> ls -d (target ip here)

ok, just one more for now, to establish an anonymous connection to a target machine (if possible)

net use \\(target ip here)\ipc$ "" /u:''

the two "" are usually a place for a username and a password.
hope this little tidbit helps