we had a similar system at high school: VNC on all computers, staff reguarly logging in to check you weren't doing anything fun

VNC ran as a separate user with its password hash protected by the relevant registry permissions

one day we found a machine undergoing an automatic rebuild, found the password hash, and of course VNC only supports upto 8 char passwords

apparently it turned out they used the same VNC password for every single machine, including the staff ones