from the doc: 'Windows 2000 and Windows NT administrator passwords are CACHED by WinLogon using the Microsoft Graphical Identification and Authentication (MSGINA.DLL) module displays administrator logon credentials including password on machines using the MSGINA'
passwordreminder.exe