passwords in Active Directory

guys does anybody knows where Domain Controller stores passwords for Active Directory users?
I ask this question, b/c after firing ophcrack remotely against a win 2k domain controller, it yield all passwords in AD. I know AD information is stored in the %SystemRoot%\ntds\NTDS.DIT file, I wonder if that's where AD stores users password.

thanks in advance

They are stored in the SAM file it should be located in C:\windows\system32\config\SAM I believe.

Alot of the time they are also cached and can be read easily in the registry
in HKEY_LOCAL_MACHINE\SECURITY\CACHE\NL$1 through NL$10