“We cannot change the weak domain administrator account password, as it is hardcoded into our ERP and we do not want to touch the code.”