It was a very very small shop (3 in IT, 2 in Accounting, 2 in Sales, 4 in Billing, and the Owner) owned by a dude in his late eighties. He made his son CTO and he set all the infosec policies, until his dad let him go because my co-admin and I convinced him that our practices were bad and outdated.

His health started declining and he got more nervous about changing things and losing control until he passed. So while we were modernizing the server room to virtualize and containerize servers (his son had every service running on its own late 90s/early 00s machine), he didn't want to have his cheese moved (ironically, he made every new employee read Who Moved My Cheese). That included the password to his son's Domain Admin account, which he used to log in to a few things and was the only Domain Admin account he wanted on the network. My co-admin was required to use this account to manage many things and often left his PC locked on that account.

His son inherited the business after he passed and put a freeze on any more changes to "his" network, so our hands were tied until I left.

My coworker and I were both in our early 20s and were naïve to say the least.