You could give Offline NT Password Recovery a try... There is a boot floppy and a boot CD image. It has an option to disable syskey, but doesn't work 100% of the time...
http://home.eunet.no/pnordahl/ntpasswd/ --------------------------------------------------------------------------- ---------------------------------------------------------------------------
