Choosing and Changing a Secure UMICH Password

This document offers tips for creating secure passwords and provides instructions for changing your UMICH password. It also tells you what to do if you forget your password. You use your UMICH password with your uniqname to log in to many U-M services and systems. On U-M's Medical Campus, the UMICH password is called the Level 1 password.

Some of the many services and systems that your uniqname and UMICH password give you access to are Wolverine Access, the MCommunity Directory, Google Apps UMICH, MFile, Virtual Sites, MWireless, and Mainstream Storage, as well as many other centrally and departmentally provided services.

Why You Need a Secure Password

Choosing a secure password reduces the risk that your password can be guessed or stolen by a password thief. Password thieves use sophisticated dictionary programs and other methods to crack passwords. A password thief can use your password to access your email and send email in your name, change your personal information in Wolverine Access and the MCommunity Directory, send spam, or publish inappropriate or illegal material. Such a thief may also be able to use your password to gain initial access to possibly break into U-M systems.

It is in your own best interest, as well as the interest of the university, for you to have a strong secure password for use with university computing services and resources.

Guidelines for Creating a Secure Password

When you change your password using the Change UMICH Password page, your new password is checked for strength.

Your new password must:

• Use nine or more characters.

• Have at least three of these:

  • lowercase letters
  • uppercase letters
  • numerals
  • punctuation

And must not:

• Be a word or simple phrase—or contain four numbers in ascending or descending order (for example, 12345 or 8765).
• Use parts of your name.

TIP: Make a strong and memorable password by using the first letters of the words in a phrase. For example, "Four score and seven years ago our fathers brought forth" becomes 4S&7yaofb4th.

TIP: Select a unique password for U-M use — not one you are using or have used outside the university for other computing accounts. The university uses strong encryption methods to protect your password. If you use that same password for services that do not offer such protection, you put your UMICH password at risk.

Tips for Protecting Your Password

• Don't write down your password.

• Don't tell anyone your password—not even trusted family members and computer support staff.

• Use only secure programs when connecting to the U-M computing environment—programs that protect your password and your data.

• If the service provides a logout feature, use it.

Changing Your UMICH Password on the Web

1. Go to Change UMICH Password.

2. In the Current UMICH Password box, type your current password.

   

3. In the New Password box, type your new password. The strength of your new password will be checked as you type. As you meet each password strength requirement, it will be checked off in the box at right. With only a few characters entered, your password will be weak.

   

    

   As you enter more characters and meet more requirements, you'll be notified that your password is strong.

   

    

4. In the Confirm New Password box, retype your password. The word Match will appear next to it when you have correctly confirmed it. Then click the Change Password button.

   

    

5. You'll see confirmation that your passwords were changed.

   

    

6. You can stop here; your password has been changed. If you wish, you can set a hint to help you remember your password later if you forget it.

IMPORTANT! When you change your UMICH password, you are actually changing several passwords. (You new password is synchronized to several systems by the UMICH Password Hub.) It may take a little time for your password change to be processed, so please be patient and try logging in again in a few minutes if your new password does not work immediately.

IF YOU USE YOUR UMICH PASSWORD TO LOG IN TO YOUR U-M WINDOWS LAPTOP: It is recommended that you lock and unlock your computer after changing your UMICH password. Wait a minute or two after changing your password, then

1. Lock the computer by pressing ctrl-alt-delete on your keyboard, then clicking the Lock this computer link.

2. Unlock the computer by pressing ctrl-alt-delete on your keyboard, then log in with your uniqname and UMICH password as you normally do.

Changing Your UMICH Password with a Terminal Program

IMPORTANT! The password strength checking used when you change your password this way does not check a couple of the requirements imposed by Active Directory. If you set your password using a terminal program, it is possible to set a new password that will not properly synchronize to AD, which will cause problems when you try to log into services that use AD for logging in. For this reason, we recommend that you use the Change UMICH Password page to change your password if at all possible.

1. Using a secure terminal program, connect to the ITS Login Service using the host name login.itd.umich.edu.

   • Windows: Use PuTTY. U-M students, staff members, and faculty members can download this software at no charge from the Blue Disc website.

   • Mac OS X: Use the Terminal program, which is included as part of Mac OS. In your Applications folder, open the Utilities folder to find Terminal. Double-click Terminal to open it, then enter this command: ssh.login.itd.umich.edu.

2. Log in with your uniqname and current UMICH password.

3. At the % prompt, enter passwd and press RETURN or ENTER.

4. At the Password for <youruniqname>@UMICH.EDU prompt, enter your current UMICH password and press RETURN or ENTER.

5. At the Enter new password prompt, enter the new password you wish to use and press RETURN or ENTER.

6. At the Enter it again prompt, enter your new password again and press RETURN or ENTER.

7. You will see the words Password changed and be returned to the % prompt.

8. At the % prompt, you may perform additional tasks or enter logout to finish.
   WARNING! Be sure to exit or quit your terminal connection program when you are finished.

Forgot Your UMICH Password?

• If you set a hint when you last changed your UMICH password, you can retrieve your hint to help you remember your password. See Appendix: Setting and Retrieving a Password Hint for instructions.

• If you are unable to remember your password, you will need to have it reset by the ITS Service Center. Call (734) 764-HELP [764-4357] and select the option to reset your UMICH password. Do not send email. Password resets must be done over the phone so the Service Center can verify your identity.

Your UMICH Password Covers Multiple U-M Systems

When you change your UMICH password, you are actually changing several passwords at once. Your password change is synchronized to U-M systems and services by the UMICH Password Hub in MCommunity. Please be aware that the synchronization is not instantaneous. It can take several minutes for the process to complete and for your new password to work for some services, such as MWireless.

Update Mobile and Other Devices

If you have stored your password on your phone or other mobile device, be sure to update your device with your new password. See Connecting to MWireless and UM Wireless Network for configuration instructions.

Additional Resources

Visit ITS's Information System to obtain ITS computer documentation and other resources. A list of relevant documents follows:

• Windows Internet Access Kit (S4269)
• Macintosh Internet Access Kit for Mac OS X (S4298)
• Using PuTTY to Connect to Host Computers [Windows] (S4386)

The ITS Service Center provides a variety of computing help resources.

For further help with this or any other topic, call 734-764-HELP [4357] or submit an online service request.

Appendix: Setting and Retrieving a Password Hint

Setting a Hint

1. On the confirmation page after changing your password, click Set a password hint.

   

    

2. In the Hint box, enter a hint that will help you remember your password. If you had set your password to the example given earlier in this document, for example, you might enter something like "Fore score etc." Enter something that will trigger your memory but would not reveal your password to anyone else.

   From the Challenge pop-up menu, select a challenge question.

   

    

3. Enter a response to the challenge question. This is the response you will need to provide if you later request your hint. You will need to enter it exacltly the same way, so make sure you can remember whether you capitalized any letters and what spacing and punctuation you used. Then click Set Hint.

   

   IMPORTANT! Select your response with care. Anyone can enter your uniqname and see your challenge question — and try to answer it to retrieve your hint.

4. You will see confirmation that your hint has been set.

   

Retrieving Your Hint

1. Go to the hint retrieval page.

2. Enter your uniqname and click Show Challenge Question.

   

3. Enter your response to the challenge question exactly the way you entered it when you set your hint. Then click Show Challenge Question.

   

4. If the response you entered exactly matches the one you entered when you set your hint, your hint will be shown.