Admin accounts can immunize other user accounts regardless of their passwords. This function is disabled when the machine is a terminal server though (or you've specified nouserhives). If you want to...