Microsoft announced that they have received C2 certification for 6 different configurations of NT 4.0 SP6a + "C2 Update" hotfix:

• Primary domain controller
• Backup domain controller
• Member server
• Workgroup server
• Workstation as a domain member
• Workstation as a non-domain member

For more information on this development, see Microsoft's C2 site: microsoft.com/security/issues/C2Evaluation.asp

Good place to start.

Covers NT4 & NT2000. 3Ps covered well: policies, permissions, profiles.