Lol "credentials". This was done directly on the server, which was kept always logged in with the admin account so anybody in the server room could access it. It was OK though, this was just a small company ... just Reliance Electric, now part of Rockwell Automation.
And you thought "security through obscurity" was bad - this was "security through apathy".