"Windows Authentication" works on each, and Windows 2000 does a decent job of impersonation from the client's IE to IIS and then to SQL Server.