We use a truecrypt vault with our shared/hardcoded passwords. Some of the team keep an encrypted copy of the file on their phone.
We use AD to push out local Administrator passwords to our Windows servers.
We use puppet to change the local root passwords and remove ex employee ssh keys from our Linux servers.
We use Kiwi Cat tools to manage our Cisco hardware, and use it to reset passwords.
That still leaves less than a dozen "one-off" devices (UPS's, remote PDU's, printers, etc) that we manually update.
We change passwords every 6 months, or immediately when we lose a team member.