Microsoft has gradually improved the safety of its SAM file, but has also maintained backwards compatibility with systems such as Windows 9x inherently unsafe. With the increasing sophistication of tools capable of brute force attack by the LM and NTLM hashes, encryption (especially the GL) has become virtually useless if the password is not really entropic and complex. In Vista, finally, it has eliminated at least the weakest link, the LM hash.
If we study the outcome of a dump online or offline (after 'leapfrog' the SysKey) of the SAM, we'll see something like this:
Manager: 500:42 f29043y123fa9c74f23606c6g522b0: 71759a1bb2web4da43e676d6b7190711:::
hiding in reality the LM hash of the password
(42f29043y123fa9c74f23606c6g522b0) and the NTLM hash
(71759a1bb2web4da43e676d6b7190711)
Read more »