how are systems (laptops) not on the domain able to access the same network resources using only the username and password of an active directory user?
It depends on which "network resources" are involved. On a domain-joined Windows computer you're logged into, there are at least two client Kerberos identities in play:
- you, user@DOMAIN
- the computer, workstation$@DOMAIN
There is also host/workstation@DOMAIN, but that's generally the identification of a service running on the host, being accessed from elsewhere. If a privileged process on the host wants to do something -- say, add its name to DNS using Kerberos-authenticated dynamic DNS -- it will use its identity to do so, workstation$@DOMAIN. If you in your login session access some resource yourself, however -- say a CIFS network share, or an authenticated HTTP URL -- then the client identity is your principal name, user@DOMAIN (credentials for which are acquired automatically for you using the password you entered to log in). From your question, you seem to think that some combination is involved; it's not, they are separate.
This is why there's no problem using Kerberos to access Windows-based resources from other platforms. You can just as well type "kinit user" on a Linux box, enter your password to get a Kerberos credential (TGT) from a domain controller, and then use Firefox to access a Kerberos-authenticated web page on IIS. The protocols for all this are standard, and you don't need anything except your user credential.
A previous answer claimed that NTLM is required in this case; that's false (though certainly it may be used). However, when you access some resource from a non-domain computer and are prompted for your username and password, you don't necessarily know what authentication method is actually being used. It might use Kerberos. It might also just fall back to a password-based mechanism whereby it sends your username and password to the server for verification, and then cache your password so you don't have to re-enter it. Many protocols allow both via abstraction schemes like SASL. You'd have to look on the wire to see what's going on.