I've used this in the past: http://home.eunet.no/~pnordahl/ntpasswd/
Is buteforce still about? if you can get the .pwd list file. I remember back in the day this is how we got our colleges entire password list. That was running windows 98 though..