Luckily, you can edit the configuration file, the .vmx file. Open it, and add the following line:
bios.forceSetupOnce = "TRUE"
Now, I end up in the BIOS and can change the default boot sequence in order attempt to boot from CD first. And it works like a charm:
Resetting to an empty password works (did this once before), so I'll go for that:
And sure enough: after rebooting into the server, Administrator no longer has a password, and I'm in!
Ready to do some SSO/WNA exercises...