Not exactly sure if I understand what you're asking, but here's some basic info. If you protect normal IIS pages (non-anonymous access), the user will get a 401 browser challenge. Meaning a header is returned that tells the browser that the user needs to type in a username and password. So the browser pops up a dialog box.
The user enters that info, press okay. IIS will retrieve this info and validate that the username and password are correct (IOW, credentials must match as defined in NT's user manager).
If you're trying to spoof NT into thinking that the user has already answered a 401 challenge, I can't really think of a way to do this in straight PHP.
If the user already HAS answered a 401 challenge on a different server, then the user-name and password won't be sent to the NT server because it's a different machine as far as the browser knows. So IIS will re-prompt the user.
If the user has already answered a 401 challenge on the same server, then IIS will automatically receive it and validate it.
Not sure which scenario you're describing but those are the basics around NT security.
Dave
===========================================
http://badblue.com/helpphp.htm
Free small footprint web server for Windows
P2P file-sharing, PHP, wireless apps & more