Its been a while sense I hacked NT 4.0, but I remember most of the time the easiest way was to gain access was without exploits.  If I remember correctly, it was important that DCOM was correctly set up and functioning on those boxes if you wanted to run an exploit.   For instance, if the 2 machines you're trying to connect over DCOM do not have security rights for the user names to be used to access the machines, then you'll never get DCOM to work. Well that and among other things.  To be realistic, you need to set up the box in a fully functional environment with all the services running correctly.  The more functionality the more vulnerable.   You can take most operating systems and turn off almost all the services and make it impossible to exploit, but in reality that can make it worthless as a server.