Domain Users trying to Capture Passwords

How can I prevent domain users from trying to capture network passwords by monitoring Challenge/Response activity across our Windows NT 4.0 network?

They are installing sniffer programs on their workstations and monitoring traffic that goes across the network and stealing administrative login information that way.