A significantly modified version of pwdump3e, this program is able to extract NTLM and LanMan hashes from a Windows target, regardless of whether Syskey is turned on.
It is also capable of displaying password histories if they are available. It outputs the data in L0phtcrack-compatible form, and can write to an output file.

USAGE:

pwdump [-h][-o][-u][-p][-n] machineName
where -h prints the usage message and exits
where -o specifies a file to which to write the output
where -u specifies the user name used to connect to the target
where -p specifies the password used to connect to the target
where -s specifies the share to be used on the target, rather than searching for one
where -n skips password histories

Website: http://swamp.foofus.net/fizzgig/pwdump/downloads.htm