I remember when you could bypass the login prompt and open a web browsing session by going to HTML Help. If I recall correctly you could run executables from the resulting browser's address bar too.
Windows 98 was single-user, the login prompt was used only for network connections if I remember ?
hah yes, and because the help viewer is a process that inherited the permission of the parent, if you ran the help viewer from an admin app (like novel netware!), you get full admin privileges to execute anything!
I think that was still a bug in Windows XP.
With Windows 10 you can boot from a DVD/USB and replace system files in the Windows directory related to the accessibility options. The accessibility options are available at the login screen and are ran with admin privileges. Then you simply click the button to start the accessibility options and bam you've changed the administrator password.