What arguments would you give to convince the office that this is not a good practice?

Question

You have been sent to a local sales office for your company. You discover that all users have the same username and password. The justification for this is that "it is easier to remember."

Answer 1

Accountability and tracking purposes is the most obvious answer.

Since it is a sales office, you can track productivity if everyone has a unique username.

Users can't be held accountable for issues if you have no way to verify who the last person to use the system was.

Answer 2

A practical argument would be by demonstration. Prepare yourself to recover from the demonstration, if possible? (e.g., make a registry backup and/or create a specific system restore point!) On at least one computer, use that "common" username and password to gain access, and change some essential settings of convenience (change font/size/color, background, other manner of things that may be recovered via system restore...) The demonstration might even be taken on more than one computer at once.

I proceeded in a similar manner with a demo on mainframe userids which, although they may not have the same userid, may have the same password. It worked.

Answer 3

Well if everybody had the same username and password, that would allow hackers the opportunity to hack into the company's system.

Answer 4

This sounds like a test question.

But anyway refer to the links on these pages:
http://www.t3technet.com/security.php
http://www.t3technet.com/privacy.php

Answer 5

It is none of my business how that vendor runs his/her business. Anyone with computer savvy knows better. Let him/her be hurt (loss of money) by this practice. That'll learn 'em.