Currently our clients authenticate only to NDS on NW60SP5. Many
third-party client management services or utilities (e.g., a centralized
antivirus product) expect to see a domain or AD.

Is NW60 or 6.5/OES capable of emulating a domain or AD controller? The
idea being that a network management function would be able to talk to
the clients without those clients actually needing MS CALs?