They had both NetSupport and DeepFreeze installed. At the time, NetSupport config files could be decrypted with a simply python script, and contained the password. Turns out, it was the general admin password.
So I had admin creds, full control of any PC with NetSupport, and the ability to install anything on a computer and have it survive past a reboot.
People still put passwords in encoded vbscript... If we could all get over thinking your code is some sort of special secret life would be so much better :P