First question: is the clustered File&Print Server a W2K server in the AD architecture? If it is, the DC selected to service the secure channel connection will be the DC in the same SITE (assuming you have configured W2K sites).
Have you ever use NLTEST.exe? It will show you which DC it is using for authenticating accounts.
Are your DCs in separate sites?
