I have a tool that, if you can boot on it, will crack all the passwords complex or otherwise on a windows, NT, 2K or XP box. That's why we don't rely on local windows hashes to protect networks.
Network managers need those tools though, to get *back* into machines when the
@#$%@#$ user has flummoxed the whole thing up while they were drunk in their hotel room.
And just for the record... give anybody worth their salt physical access to a unix or linux box and they'll own that one too. It ain't a windows thing. It's a computer thing. Systems Security doesn't mean cutting off all possible access once you have physical control of the box. You wouldn't want that, even if you could get it.