Here is something quick to try,
 
Make a new account. Do not give it a password. Explicitly give all the required access to the shares/printers. Now have the win9x machine log in under this login. See if it works. If it does check the password and permission settings for the real account.
 
If not, make sure they use the same workgroup. This is easiest to set on the win9x machine. Set the Client for microsoft networking to log into the <workgroup name> domain. With the same workgroup settings you should have no problems.
 
It sounds like you have synchronized passwords for him which is good.(wouldn't work if you didn't)
 
Create a share on your win2k machine and give "everyone" change permission. See if the other computer can access that. I find getting file shares working easier than printers. I also found that one time the user password on an nt workstation expired, and hence the people connecting would get a similar problem. Check that that has not occurred.
 
-RY

Here's what worked for me....
 
I reactivated the Guest account and set it's password to blank, and set it to never expire. I then logged on my bro's pc with a username, but no pass. Suddenly, I have access again. I don't get it. Why did MS make it so hard for their own platforms to communicate?

It's actually not that hard. Normally, you would have both machines setup to use "Client for Microsoft Networks" (which is default in Win2K). When you do this, you then got logon ability, which is the ability for a machine to ask for, and transmit security credentials across a network. It makes it easier if you setup a "workgroup" to handle this, and the machine would be a member of it, and then pass on the credentials as a subset of that workgroup or domain. In an NT domain, you don't see user names as just "jwilliams" or "RobertC", you would see them as "\\NTDOMAIN\jwilliams", as "jwilliams" is an object of that domain, and can be managed. When you enabled that guest account, you essentially enabled anonymous logon to your machine and it's available shares (which is why it's disabled by default, as this is "poor form" in the security world). This is also a problem if one of your machines has internet access with no port restrictions and/or firewall. What you would normally do is this:
 
A: Define a workgroup/domain, and define its users and groups on paper.
 
B: Make sure that you have "Client for Microsoft Networks" installed on both of your machines under network properties.
 
C: Starting with the Win2K box, go to your network ID dialog (right click on the "My Computer" icon on your desktop), and establish that your Win2K machine will now join the "MYWORKGROUP" (or whatever name you like) workgroup.
 
D: Reboot the Win2K box, and login with your admin account under this new workgroup (the options button on the logon screen will let you see what group/domain you are logging into, and let you select from that).
 
E: Go to your Win98 machine, and get in to your network properties dialog and then to "Client for Microsoft Networks".
 
F: Setup the 98 machine to join your new workgroup in a similar fashion as the Win2K box.
 
G: Reboot the 98 box, and then you should be able to see the login screen on the 98 box, and you can then enter your admin account credentials from the Win2K box and get in. Once you do this, you should be able to go to Windows Explorer, and type \\WIN2K_COMPUTER_NAME\C$ (any share with a dollar sign is "hidden" so you wont see it in network neighborhood, and this particular share is an admin share installed by default) to get to your C drive on your Win2K machine. If this works, you are successfully transmitting security credentials to your Win2K PC.
 
Now, this is the "from scratch" method for getting a basic workgroup off the ground. You could also use the "Computername" domain that Win2K allows you to logon with after you install the Win2K OS. This "Computername" domain will always be there, so in case you have a connectivity problem to a domain controller and cannot verify your credentials, you can at least get on the local machine and get local information. If you use this default domain, you can try to get your Win98 box to join this domain by following from step "E:" forward. If you have any problems, post back here.
 
------------------
Regards,
 
clutch

When your brother first boots up his PC he should get and network login prompt. Find out whatever name and p***word he is using, leaving the p***word blank makes it easier. In 2000, make a standard user account using the same login name your brother is using and the same p***word. When you share out your printer give your bothers account on your machine permission to use that printer. Now install the network printer on your brother's computers and it should copy files and tell you its installed properly. Whenever your brother wants to print make sure he selects your printer.
 
That should do it!
 
------------------
Frank
A+, Windows 98 and NT Certified Technical Support Representative

It seems like it'd make more sense (at least, to me) to have both a login and p*** prompt when you try to access the 2k machine remotely. It could give a message like, "You current username is unknown to this machine. You must login with a username and p***word valid to this machine to access its resources." and then ask for both. I resolved the problem, but I just decided to take my spare parts, and build a little network server from Win98. A P90 w/ 48 megs ram running ICS. Works fine for the most part. I'm still working out the kinks, but it's now the print server.

NT behaves in the manner in which you speak of. If you try to connect to a resource that your logon credentials aren't enough for, in some cases you can use "logon as" to get what you need. The general idea behind the domain concept is to have as few accounts as possible, and to have the primary logon account be responsible for clearing the path to whatever resource you need. While it seems cumbersome now (and it sometimes is), try using it in an environment of 10 or more clients with a couple of servers, and you will begin to see the benefits.
 
------------------
Regards,
 
clutch

In domains, I can certainly see the benefits, but for small workgroups (which is what I'm using), it seems to be a extra pain in the ***.

I might add that those asterisks were NOT voluntary on my part. Not being able to say *** sucks.

another tip is this - if u dont want to arse around with logging on to 98 then simply set it up so it auto logs on (user name but no p*** disables the log on) and create an account on the win2k box with the username that appears in the "log off ..." option when u shut down 98 - u can then use any p***word u want and still not have the annoying log on screen

I actually tried that, but that didn't work for me either. The Guest account was the only real way I could get it to work. My computer's behind a firewall, so I don't really need to worry about anyone logging in to it.