Comment by GFischer

As a security vulnerability, it's interesting but, as they stated, low-severity.

If you have physical access and a local user, it's much easier to use any Linux boot CD and one of the myriad "password recovery" systems.

I used Petter N Hagen's http://pogostick.net/~pnh/ntpasswd/

back in my tech support days (several years ago).

The current tech support guy swears by Hiren's BootCD

http://www.hiren.info/pages/bootcd