But people don't change them unless forced to. Another place I worked, half the passwords were qwerty123 because the tech set them up in the expectation they would be changed. Another place, the passwords were usually "password". I once set up a bunch of accounts for a new domain with strong passwords which I printed on a credit card-sized laminated card, which people could keep in a wallet or purse. Mostly, this worked well, but still some people blu-tacked the cards to their desks or keyboards. It's unwinnable unless you force people to do the right thing.