You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes

You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc. Catastrophically-bad-by-design authentication is a Microsoft staple.