Yes they do. I had a colleague who opened up his machine to another using the logon "remote" and let them set the password.

It was cracked the next day. It turns out having 12345678 is probably a bad password.