This is it right. Most corporations spend shit on IT when it is what really drives their business today. If they would consider something like single sign-on and smart cards, it would improve security and usability. But, instead, they want to keep sending their corporate shills on bullshit travel and training events that don't add much to the bottom line at the end of the day.
i also blame vendors who use proprietary systems that wont work with AD users/groups
i work at a large area hospital in the IT dept. i have 2 passwords for everything I need
1 is for groupwise, because they dont want to pay for exchange
1 is for AD, which works with peoplesoft, mcafee, zenworks, and a host of other things
now, im in IT. clinical users, like nurses and doctors and all sorts of other teams, have to access systems that have their own user database for account management. blame those vendors. i dont even have a login to healthspan, softmed, 3m, sunquest, and god knows what the fuck else.
its not *always* the fault of IT at the hospital that the passwords cant be used for single sign on, its the fault of the vendors who make shit that cant or wont interact with everything else, either because the software we use for some applications is still dated or because the vendors have their heads up their ass.
IT doesnt even get a say in which department uses what software a lot of the time. a department will take their budget and needs, get software, then tell IT to make it work, and they dont give a shit what that may or may not involve.