I did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determine

I did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determined that there were a ton of the usual suspects. When we chatted up some helpdesk people over lunch, it turned out the problem was that they gave good passwords whenever someone from security asked because otherwise those jerks would scream at you. Everyone else in the company got easy passwords because it lowered call volumes. They literally were checking group membership as part of their reset script and giving the user the type of password which was most likely to get them to go away.