Upgrading NT domain permissions

I read somewhere that you can upgrade Windows NT 4.0 domain controller permissions to Windows 2000 way of doing permissions. I have a 4.0 domain controller and most of my workstations are using win2k or XP, whenever I change permissions on profiles on Win2k or XP machines I need to go to the Domain controller and reset permissions or else useres cant log on. Can anyone tell me where I can find the upgrade?