A significantly modified version of pwdump3e, this program is able to extract NTLM and LanMan hashes from a Windows target, regardless of whether Syskey is turned on.
It is also capable of displaying password histories if they are available. It outputs the data in L0phtcrack-compatible form, and can write to an output file.
pwdump [-h][-o][-u][-p][-n] machineName
where -h prints the usage message and exits
where -o specifies a file to which to write the output
where -u specifies the user name used to connect to the target
where -p specifies the password used to connect to the target
where -s specifies the share to be used on the target, rather than searching for one
where -n skips password histories