None of these folks are right and all of these folks are right.
None of them are right unless they all have setup their Win2k3 domains in a FIPS compliant manner. I don't expect this to be the case. Password hashes are stored in a domain controller's registry, and are quite accessible and easily cracked to reveal the true password. If you do have a FIPS compliant setup, just put your servers on a hub and capture all the traffic, and sniff password hashes from that.
All of them are right in that there's no reason for you to know anyone's password aside from your own. I don't know how things are setup that this might be required. I would highly recommend revisiting what about the setup requires you to know or change ANYONE's passwords, and change it. Your techs should have accounts good enough to log off any user, and your users should be trained wel enough to save their documents often so it doesn't matter if they are forced to logoff while they're out.
Your default admin account should be renamed using policy. Then you should set that account's password to something sooo ridiculously long and complex you'll never remember. Use the help of something like randpass.com for this. Once that's set, seal it in an envelope and drop it in your offsite storage safe.
Go buy LC5 from Symantec and you'll have everything your need. LC5 is difficult to get, and only available to US/Canada residents. (It might be easier now, I bought it mid-Symantec-acquisition)
There's also a number of free utilities available that will do this, too.
