[fuzzix]

I remember someone (not me, oh no...) used one for NT4 with inadequate policies to get Admin access.

Create a batch file with the content:

net localgroup administrators NewUser /add

...then stick this into the 'StartUp' directory for All Users. Break something. Call support. They log in as Administrator, running your batch file in the process.

NewUser would be created with Admin rights. You wouldn't promote your own login, of course.