As far as I know LC4 cannot grap the passwords from the win2k sam files anyway ;-(

If you have admn access, use pwdump3e.

Get it at http://www.polivec.com/pwdump3download.html

f you go down the route of rebooting into DOS then you would then need to copy the sam file using a another OS (linux) or an emulator like ntfsdos as win2k usually uses the NTFS filesystem (so dos aint gonna work). To really do it remotley you are gonna need admin rights to run the proggie mentioned above (pwdump3) and assuming there is a decent security policy on the box it will leave a trail in the security log because it runs as a service on the remote machine.