Well, depending on how you locked down your box, normal users often have readonly access to the %SYSTEM%\repair directory. Inside is an un-syskeyed backup copy of your SAM with the hash of the administrator password you set during installation.