Re: How worse than Single User Mode?
"but usually physical access is enough to set the root password on *nix."
not entirely true. On FreeBSD, at least, it is possible to require the root password for single-user mode by specifying that the console is 'insecure'. And, Shirley, you COULD also boot a "live CD" (assuming that hasn't been locked out) or "live USB" image, and then mount the hard drive's root partition and do a password reset THAT way (jumping through necessary hoops to do so via the command line) but you can do this in Windows as well.
Or, if you're really desperate, remove the hard drive and plug it into a different computer that has the correct utilities on it for a password reset.
(I'd much rather make miscreants go through that last step)