You can *not* get the SAM in the %system% when NT is running, it holds a lock on it, but you can get the SAM file in the NT Repair directory. Then you can crack this with LC3.

Now the difficulty is to get the SAM...
If there is some shared source use that... after all you don't need to transfer the sam if you *have* another box. Just use the method I posted before. Set the domain on the other server box to that of the laptop and reset the user.

Isn't it possible to change login domain before startup / network boot? I think Novell Netware login can do that.