Sorry, work got in my way of surfing Pr0n and answering posts!

If you take a 2003 server CD and install it on a server, follow default prompts and then run the wizards to configure roles, a user with no domain admin rights can capture the hashes.

That being said, with metasploit and a few other tools, you can capture account information over the wire. You will also need a detailed understanding of TCP and http://web.mit.edu/Kerberos/

It is possible to craft a packet wrapper to force information about accounts and passwords to a dmp file. However, using this type of method you would need access to the local dmp file. And a real good understanding of dot net and c sharp. For windows that is.

LDAP. Probably not the what I would use. LDAP will give you this as a regular user

Code:
dn: cn=John Doe,dc=example,dc=com
 cn: John Doe
 givenName: John
 sn: Doe
 telephoneNumber: +1 888 555 6789
 telephoneNumber: +1 888 555 1232
 mail: [email protected]
 manager: cn=Barbara Doe,dc=example,dc=com
 objectClass: inetOrgPerson
 objectClass: organizationalPerson
 objectClass: person
not really anything useful
objectClass: top