Social engineering works the best. Get to know someone and half the time you can guess the password.

Case in point - was in a buddy's office, asked to use his PC for a minute, and it was pw protected. Jokingly he said to guess his password. Got it in one. He then changed the password, got it in one again. It helped I knew him fairly well, what he was into, and some other personal data. Half the time, look at someone's desk - pictures, plaques, name plates, awards, that stuff. The password is usually right there.