I just set up a Windows 2008 server on a workgroup; it has not joined our domain yet. But when I log in to the server and browse to the other servers that are on the domain, I can browse anything and everything there with no password authentication to the domain. Why? Since the server is not on the domain, I assumed it would ask for a user name and pw to access domain shares. It seems like this is a major security issue, as it didn't take any administrative rights to do this--just a fresh install of 2008 server on a new machine.