Many systems come with default user accounts with well-known passwords that administrators forget to change

Often, the default location of installation files can be exploited which allows a hacker to retrieve a file from the system

Many software packages come with "samples" that can be exploited, such as the sample programs on IIS web services

Enabling firewall and anti-virus software on the local system