I don't know if this is possible or not but you can install cain it dumps the default admin account password in plain text from the LSA file.