Cracking Win2000 domain passwords

Aside from pwdump2 that works if you are in the domain controller itself, do somebody know how to crack the Windows 2000 domain password in other ways or using other softwares? Say cracking it from the other Win2000-clients?

This is only for educational purposes and not for exploitation. Thank you very much in advance.