Yup, the servers were all part of the same domain. I also found out that they used pretty much the most obvious password known to man (the same as their registered domain name) and none of their internal machines even had the built in Windows Firewall running.
Yes, knowing that, they pretty...