I was also expelled for basically doing the exact same thing. Exploiting cached domain admin passwords for Novell via a local SAM file. NTLM hashing does something incredibly dumb for legacy purposes by splitting passwords longer than 7 letters into multiple hashes for the first 7 letters and the second 7 letters. We got caught because a kid left a flash drive with teachers passwords in a computer lab and when the teacher tried to find out who the drive belonged too, he found that kids homework and his own password. There's some news stories that came from it:

https://www.sandiegouniontribune.com/pomerado-news/sdpn-rbhs...

https://www.sandiegouniontribune.com/sdut-poway-letter-to-st...

https://www.latimes.com/archives/la-xpm-2008-may-13-me-brief...

https://www.kpbs.org/news/2008/apr/29/officials-investigate-...