Choosing and Changing a Secure UMICH Password
R1162 April 2015
We recommend that you change your UMICH password every six months. An easy way to remember this is to change your password when you change your clocks for Daylight Saving Time (DST).
This document offers tips for creating secure passwords and provides instructions for changing your UMICH password. It also tells you what to do if you forget your password. You use your UMICH password with your uniqname to log in to many U-M services and systems. At the U-M Health System (UMHS), the UMICH password is called the Level-1 password.
Some of the many services and systems that your uniqname and UMICH password give you access to are Wolverine Access, the MCommunity Directory, M+Google Apps, MFile, Virtual Sites, MWireless, and Mainstream Storage, as well as many other centrally and departmentally provided services.
Table of Contents
Why You Need a Secure Password
Choosing a secure password reduces the risk that your password can be guessed or stolen by a password thief. A password thief can use your password to access your email and send email in your name, change your personal information in Wolverine Access and the MCommunity Directory, send spam, or publish inappropriate or illegal material. Such a thief may also be able to use your password to break into U-M systems.
It is in your own best interest, as well as the interest of the university, for you to have a strong secure password for use with university computing services and resources.
Guidelines for Creating a Secure Password
When you change your password using the Change Password page inside UMICH Account Management, your new password is checked for strength.
Your new password must:
And must not:
- Be a word or simple phrase—or contain four numbers in ascending or descending order (for example, 12345 or 8765).
- Use parts of your name.
TIP: Make a strong and memorable password by using the first letters of the words in a phrase. For example, "Four score and seven years ago our fathers brought forth" becomes 4S&7yaofb4th.
IMPORTANT: Select a unique password for U-M use — not one you are using or have used outside the university for other computing accounts. The university uses strong encryption methods to protect your password. If you use that same password for services that do not offer such protection, you put your UMICH password at risk.
ATTENTION UMHS USERS! Your UMICH password (usually called Level-1) will be checked to ensure that it is different from your UMHS password (Level-2). A secure password is one that is not reused across services, even within the university.
Tips for Protecting Your Password
Don't tell anyone your passwordnot even trusted family members and computer support staff.
Use a different password for each online account. That way, if one password is compromised, your other accounts are not at risk. It is especially important that you not use your UMICH password for non-university services.
If you have the option to set security questions to help you reset your password in case you forget it, do so. See Set Security Questions in Case You Forget Your Password below for how to set these for your UMICH password.
Use only secure programs when connecting to the U-M computing environmentprograms that protect your password and your data.
If the service provides a logout feature, use it.
Change your password for security about once every six months. A good way to remember this is to do it when you change your clocks for Daylight Saving Time. When you change your password, you stop anyone who might have stolen it from using it. Also, as password encryption technology is improved over time, passwords that are more than a few years old may stop working as the technology used to encrypt them is upgraded and replaced.
If you must write down your password to help you remember it, it is better to write down a clue to jog your memory rather than the actual password. Keep it in a safe, secure place, and do not leave it where others could see it. For help remembering and managing multiple passwords, see How to Manage All Your Passwords.
Set Security Questions in Case You Forget Your Password
Security questions allow you to reset your password if you forget it. Anyone with a U-M uniqname can reset their own password if they set up these questions and add an external email address. The process is simple and only needs to be set up once.
Set five security questions and answers that only you know. Select questions and answers that are easy for you to remember and difficult for others to guess or discover. If you forget your UMICH password in the future, you can answer a random selection of the questions to receive a password reset code at an external email address or phone number. You can then use that code to reset your password.
Go to UMICH Account Management and log in. After logging in, click the Security Questions tab.
Select a question from each question drop-down menu and type your answer.
IMPORTANT: Answers must be at least 4 characters long, can include punctuation or symbols. To reset your password in the future, you must respond to the questions with the exact same answers as you entered. Capitalization does not matter, but spaces do.
NOTE: If you forget your answers to the questions, but remember your password, you can set new questions and answers at any time.
The Save Responses button at the bottom of the page will become clickable after you have selected five questions and provided answers for all of them. When you are satisfied with your responses, click Save Responses.
Check your questions and answers. If they are what you want them to be, click Confirm Responses. If you want to make changes, click Go Back or Cancel to return to the previous screen.
CAUTION: Clicking Go Back or Cancel will erase all your questions and answers, and you will need to start over. It is not possible to change the answer to just one question.
If you are not automatically directed to the External Email page, click the External Email tab to get there. Provide an external email address where you can receive a password reset code.
In the Enter Email Address field, enter a personal email address that is not your @umich.edu address. Enter the same email address in the Confirm Email Address field, and click Save Responses.
NOTE: If you wish to receive the password reset code to your mobile phone, follow the instructions under Text Message Instructions.
You will see confirmation that you have completed setting up your security questions. In addition, you will receive confirmation notifications at both your @umich.edu and external email accounts.
NOTE: You can change your security questions and answers at any time.
Changing Your UMICH Password on the Web
ATTENTION UMHS! Members of the U-M Health System community can use their Level-2 password to change their UMICH password. On a UMHS workstation, in the Search box above the Start icon, type the word password. Then click the Change UMHS Password (Level-2) icon that appears. From there, you will be able to change your UMICH (Level-1) password. For more detail, see Medical Center Information Technology (MCIT) Accounts & Passwords (UMHS users only; login required).
Instructions for All Members of the U-M Community
Go to Change Password inside UMICH Account Management and log in.
In the New Password box, type your new password. The strength of your new password will be checked as you type. As you meet each password strength requirement, it will be checked off in the box at right. With only a few characters entered, your password will be weak.As you enter more characters and meet more requirements, you'll be notified that your password is strong.
In the Confirm Password box, retype your password. The word Match will appear next to it when you have correctly confirmed it. Then click the Change Password button.
NOTE: If you copy and paste your password into the Confirm Password box, it may not show Match immediately. You must type something in the Confirm Password box before a match will be registered. You will not be able to change your password until the word Match displays.
Next, you’ll see a page indicating that your password is being changed.
Finally, you'll see confirmation that your UMICH password has been changed. A password change confirmation email will be sent to your @umich.edu email address and any other account you have specified in UMICH Account Management.
You can stop here safely by closing your browser window or tab; your password has been changed. If you are using a shared or public computer to change your password, close your browser and log out completely.
IMPORTANT! When you change your UMICH password, you are actually changing several passwords. (Your new password is synchronized to several systems by the UMICH Password Hub.) It may take a little time for your password change to be processed, so please be patient and try logging in again in a few minutes if your new password does not work immediately.
NOTE: If you have stored your password on your phone or other mobile device, be sure to update your device with your new password. For example, if you access your U-M email on your phone, you will need to log in to the app that you use for your email with your new password. You may also need to update your password for MWireless. See Connecting to MWireless for configuration instructions.
IF YOU USE YOUR UMICH PASSWORD TO LOG IN TO YOUR U-M WINDOWS LAPTOP: It is recommended that you lock and unlock your computer after changing your UMICH password. Wait a minute or two after changing your password, then
Lock the computer by pressing ctrl-alt-delete on your keyboard, then clicking the Lock this computer link.
Unlock the computer by pressing ctrl-alt-delete on your keyboard, then log in with your uniqname and UMICH password as you normally do.
Changing Your UMICH Password with a Terminal Program
IMPORTANT! The password strength checking used when you change your password this way does not check a couple of the requirements imposed by Active Directory. If you set your password using a terminal program, it is possible to set a new password that will not properly synchronize to AD, which will cause problems when you try to log in to services that use AD for logging in. For this reason, we recommend that you use the Change UMICH Password page to change your password if at all possible.
Using a secure terminal program, connect to the ITS Login Service using the host name login.itd.umich.edu.
Windows: Use PuTTY. U-M students, staff members, and faculty members can download this software at no charge from the Blue Disc website.
Mac OS X: Use the Terminal program, which is included as part of Mac OS. In your Applications folder, open the Utilities folder to find Terminal. Double-click Terminal to open it, then enter this command:
Log in with your uniqname and current UMICH password.
At the % prompt, enter passwd and press RETURN or ENTER.
At the Password for <youruniqname>@UMICH.EDU prompt, enter your current UMICH password and press RETURN or ENTER.
At the Enter new password prompt, enter the new password you wish to use and press RETURN or ENTER.
At the Enter it again prompt, enter your new password again and press RETURN or ENTER.
You will see the words Password changed and be returned to the % prompt.
At the % prompt, you may perform additional tasks or enter logout to finish.
WARNING! Be sure to exit or quit your terminal connection program when you are finished.
Forgot Your UMICH Password?
NOTE: The answers to your security questions should be treated like your password—don’t share them with anyone. ITS does not have access to view your answers, and if you forget them you should set new ones.
Your UMICH Password Covers Multiple U-M Systems
When you change your UMICH password, you are actually changing several passwords at once. Your password change is synchronized to U-M systems and services by the UMICH Password Hub in MCommunity. Please be aware that the synchronization is not instantaneous. It can take several minutes for the process to complete and for your new password to work for some services, such as MWireless.
Update Mobile and Other Devices
If you have stored your password on your phone or other mobile device, be sure to update your device with your new password. For example, if you access your U-M email on your phone, you will need to log in to the app that you use for your email with your new password. You may also need to update your password for MWireless. See Connecting to MWireless for configuration instructions.
Visit ITS's Information System to obtain ITS computer documentation and other resources. A list of relevant documents follows:
The ITS Service Center provides a variety of computing help resources.
For further help with this or any other topic, call 734-764-HELP  or submit an online service request.
Appendix: Resetting Your Forgotten Password Using Your Security Questions
If you have security questions set up, you will be able to use them to reset your password. If you do not have security questions set up you will need to call the ITS Service Center at 764-HELP  to receive a password reset.
Go to UMICH Account Management and click Forgotten Password. Enter your uniqname in the Uniqname field and click Search.
Answer the two security questions on the screen to verify your identity, then click Check Responses. You must answer these questions exactly the same as you did when you set them up. Capitalization does not matter, but spelling, punctuation, and spaces must match the answers you set up.
If your answers were correct, a password reset code will be sent to the email account provided when you set up your security questions. Get the code and enter it in the box on the screen, then click Check Code.
If your answers were incorrect, you will be given a second chance to answer your questions. If you are unable to provide the answers, call the ITS Service Center at 764-HELP  to reset your password.
NOTE: If you have not received a code in one hour, check your junk or spam folders. If the code is not there, phone the ITS Service Center at 764-HELP  to receive a password reset.
You will be taken to the Change Password page in UMICH Account Management, where you can set a new password.
TIP: You may not set your new password to the same thing as your current password. If you attempt to change a forgotten password to your current (forgotten) password, an error message will display and you will need to enter a new password.
IMPORTANT! Password reset codes expire one hour after they are sent. You can get a new code by starting over on the Forgotten Password page of UMICH Account Management.