Thousands of employees in the US Department of the Interior are using accounts that are easily hacked::The Interior Department is tasked with protecting the country’s natural resources, like gas pipelines. Hundreds of its senior officers even used “password-1234” on their accounts.
Not necessarily, it could mean they’re storing the old salted hashes.
I’m pretty sure this is a setting in Windows group policy, I assume Microsoft does it correctly.