How does a legitmate administrator get a user's password in ActiveDirectory?

Question

If a password is stored with reversable encryption in Active Directory, how does an administrator/developer extract and decrypt this password?

Specifically, I'm referring to this setting.

Answer 1

The following series of blog posts explains some details:

Passwords stored using reversible encryption: how it works (part 1)

Passwords stored using reversible encryption: how it works (part 2)

The author of this blog, Niels Teusink, also made the source code of his tool RevDump available for download.

It goes without saying that reversible encryption should not be used globally and only in very exceptional cases.