ITS Documentation

Choosing and Changing a Secure UMICH Password

R1162 • April 2014

This document offers tips for creating secure passwords and provides instructions for changing your UMICH password. It also tells you what to do if you forget your password. You use your UMICH password with your uniqname to log in to many U-M services and systems. At the U-M Health System (UMHS), the UMICH password is called the Level-1 password.

Some of the many services and systems that your uniqname and UMICH password give you access to are Wolverine Access, the MCommunity Directory, M+Google Apps, MFile, Virtual Sites, MWireless, and Mainstream Storage, as well as many other centrally and departmentally provided services.

Table of Contents


Why You Need a Secure Password

Choosing a secure password reduces the risk that your password can be guessed or stolen by a password thief. A password thief can use your password to access your email and send email in your name, change your personal information in Wolverine Access and the MCommunity Directory, send spam, or publish inappropriate or illegal material. Such a thief may also be able to use your password to break into U-M systems.

It is in your own best interest, as well as the interest of the university, for you to have a strong secure password for use with university computing services and resources.

Guidelines for Creating a Secure Password

When you change your password using the Change Password page inside UMICH Account Management, your new password is checked for strength.

Your new password must:

  • Use nine or more characters.

  • Have at least three of these:

    • lowercase letters
    • uppercase letters
    • numerals
    • punctuation

And must not:

  • Be a word or simple phrase—or contain four numbers in ascending or descending order (for example, 12345 or 8765).
  • Use parts of your name.

TIP: Make a strong and memorable password by using the first letters of the words in a phrase. For example, "Four score and seven years ago our fathers brought forth" becomes 4S&7yaofb4th.

IMPORTANT: Select a unique password for U-M use — not one you are using or have used outside the university for other computing accounts. The university uses strong encryption methods to protect your password. If you use that same password for services that do not offer such protection, you put your UMICH password at risk.

ATTENTION UMHS USERS! Your UMICH password (usually called Level-1) will be checked to ensure that it is different from your UMHS password (Level-2). A secure password is one that is not reused across services, even within the university.

Tips for Protecting Your Password

  • Don't write down your password.

  • Don't tell anyone your password—not even trusted family members and computer support staff.

  • Set security questions to help you reset your password in case you forget it.

  • Use only secure programs when connecting to the U-M computing environment—programs that protect your password and your data.

  • If the service provides a logout feature, use it.

  • Change your password for security about once every six months. A good way to remember this is to do it when you change your clocks for Daylight Saving Time.

Set Security Questions in Case You Forget Your Password

Security questions allow you to reset your password if you forget it. Anyone with a U-M uniqname can reset their own password if they set up these questions and add an external email address. The process is simple and only needs to be set up once.

Set five security questions and answers that only you know. Select questions and answers that are easy for you to remember and difficult for others to guess or discover. If you forget your UMICH password in the future, you can answer a random selection of the questions to receive a password reset code at an external email address or phone number. You can then use that code to reset your password.

  1. Go to UMICH Account Management and log in. After logging in, click the Security Questions tab.

    Screen shot showing the UMICH Account Management home page with login link in upper right

  2. Select a question from each question drop-down menu and type your answer.

    IMPORTANT: Answers must be at least 4 characters long, can include punctuation or symbols. To reset your password in the future, you must respond to the questions with the exact same answers as you entered. Capitalization does not matter, but spaces do.

    Screen shot showing the security questions page with instructions to click the drop down arrow to select a question, then type your answer in the box below that question. There are five questions. Click show responses to display your answers as you type them.

    NOTE: If you forget your answers to the questions, but remember your password, you can set new questions and answers at any time.

  3. The Save Responses button at the bottom of the page will become clickable after you have selected five questions and provided answers for all of them. When you are satisfied with your responses, click Save Responses.

    screen shot showing last question and save responses button is now clickable

  4. Check your questions and answers. If they are what you want them to be, click Confirm Responses. If you want to make changes, click Go Back or Cancel to return to the previous screen.

    CAUTION: Clicking Go Back or Cancel will erase all your questions and answers, and you will need to start over. It is not possible to change the answer to just one question.

    Screen shot of confirm responses page with confirm responses button circled

  5. If you are not automatically directed to the External Email page, click the External Email tab to get there. Provide an external email address where you can receive a password reset code.

    Screen shot of external email tab with boxes to enter your email address and confirm your email address.

  6. In the Enter Email Address field, enter a personal email address that is not your @umich.edu address. Enter the same email address in the Confirm Email Address field, and click Save Responses.

    NOTE: If you wish to receive the password reset code to your mobile phone, follow the instructions under Text Message Instructions.

    Screen shot of external email page with external email address entered and re-entered in the boxes and save responses is clickable

  7. You will see confirmation that you have completed setting up your security questions. In addition, you will receive confirmation notifications at both your @umich.edu and external email accounts.

    NOTE: You can change your security questions and answers at any time.

Changing Your UMICH Password on the Web

  1. Go to Change Password inside UMICH Account Management and log in.

  2. In the New Password box, type your new password. The strength of your new password will be checked as you type. As you meet each password strength requirement, it will be checked off in the box at right. With only a few characters entered, your password will be weak.As you enter more characters and meet more requirements, you'll be notified that your password is strong.

    Screen shot showing to type the new password in the new password box, and the word strong will appear below it after you have typed a strong password. The requirements for a strong password are listed in the boxes to the right. You can click the show passwords button to display your passwords as you type them

  3. In the Confirm Password box, retype your password. The word Match will appear next to it when you have correctly confirmed it. Then click the Change Password button.

    NOTE: If you copy and paste your password into the Confirm Password box, it may not show Match immediately. You must type something in the Confirm Password box before a match will be registered. You will not be able to change your password until the word Match displays.

    Screen shot showing the word Match that appears when your retyped password matches the new password you entered. The change password button then becomes clickable.

  4. Next, you’ll see a page indicating that your password is being changed.

    Screen shot of page that displays indicating that your password is being changed, with a rotating set of arrows to indicate progress.

  5. Finally, you'll see confirmation that your UMICH password has been changed. A password change confirmation email will be sent to your @umich.edu email address and any other account you have specified in UMICH Account Management.

    Screenshot of the password change confirmation. The words Your password has been changed successfully appear.

     

  6. You can stop here safely by closing your browser window or tab; your password has been changed. If you are using a shared or public computer to change your password, close your browser and log out completely.

    • If you have not already set security questions, which allow you to reset your password if you forget it, you can do so by clicking Continue.

IMPORTANT! When you change your UMICH password, you are actually changing several passwords. (Your new password is synchronized to several systems by the UMICH Password Hub.) It may take a little time for your password change to be processed, so please be patient and try logging in again in a few minutes if your new password does not work immediately.

NOTE: If you have stored your password on your phone or other mobile device, be sure to update your device with your new password. For example, if you access your U-M email on your phone, you will need to log in to the app that you use for your email with your new password. You may also need to update your password for MWireless. See Connecting to MWireless for configuration instructions.

IF YOU USE YOUR UMICH PASSWORD TO LOG IN TO YOUR U-M WINDOWS LAPTOP: It is recommended that you lock and unlock your computer after changing your UMICH password. Wait a minute or two after changing your password, then

  1. Lock the computer by pressing ctrl-alt-delete on your keyboard, then clicking the Lock this computer link.

  2. Unlock the computer by pressing ctrl-alt-delete on your keyboard, then log in with your uniqname and UMICH password as you normally do.

Changing Your UMICH Password with a Terminal Program

IMPORTANT! The password strength checking used when you change your password this way does not check a couple of the requirements imposed by Active Directory. If you set your password using a terminal program, it is possible to set a new password that will not properly synchronize to AD, which will cause problems when you try to log in to services that use AD for logging in. For this reason, we recommend that you use the Change UMICH Password page to change your password if at all possible.

  1. Using a secure terminal program, connect to the ITS Login Service using the host name login.itd.umich.edu.

    • Windows: Use PuTTY. U-M students, staff members, and faculty members can download this software at no charge from the Blue Disc website.

    • Mac OS X: Use the Terminal program, which is included as part of Mac OS. In your Applications folder, open the Utilities folder to find Terminal. Double-click Terminal to open it, then enter this command:
      ssh login.itd.umich.edu

  2. Log in with your uniqname and current UMICH password.

  3. At the % prompt, enter passwd and press RETURN or ENTER.

  4. At the Password for <youruniqname>@UMICH.EDU prompt, enter your current UMICH password and press RETURN or ENTER.

  5. At the Enter new password prompt, enter the new password you wish to use and press RETURN or ENTER.

  6. At the Enter it again prompt, enter your new password again and press RETURN or ENTER.

  7. You will see the words Password changed and be returned to the % prompt.

  8. At the % prompt, you may perform additional tasks or enter logout to finish.
    WARNING! Be sure to exit or quit your terminal connection program when you are finished.

Forgot Your UMICH Password?

NOTE: The answers to your security questions should be treated like your password—don’t share them with anyone. ITS does not have access to view your answers, and if you forget them you should set new ones.

Your UMICH Password Covers Multiple U-M Systems

When you change your UMICH password, you are actually changing several passwords at once. Your password change is synchronized to U-M systems and services by the UMICH Password Hub in MCommunity. Please be aware that the synchronization is not instantaneous. It can take several minutes for the process to complete and for your new password to work for some services, such as MWireless.

Update Mobile and Other Devices

If you have stored your password on your phone or other mobile device, be sure to update your device with your new password. For example, if you access your U-M email on your phone, you will need to log in to the app that you use for your email with your new password. You may also need to update your password for MWireless. See Connecting to MWireless for configuration instructions.

Additional Resources

Visit ITS's Information System to obtain ITS computer documentation and other resources. A list of relevant documents follows:

The ITS Service Center provides a variety of computing help resources.

For further help with this or any other topic, call 734-764-HELP [4357] or submit an online service request.

Appendix: Resetting Your Forgotten Password Using Your Security Questions

If you have security questions set up, you will be able to use them to reset your password. If you do not have security questions set up you will need to call the ITS Service Center at 764-HELP [4357] to receive a password reset.

  1. Go to UMICH Account Management and click Forgotten Password. Enter your uniqname in the Uniqname field and click Search.

    Screen shot of reset UMICH password page with uniqname entered in uniqname field and the search button circled.

  2. Answer the two security questions on the screen to verify your identity, then click Check Responses. You must answer these questions exactly the same as you did when you set them up. Capitalization does not matter, but spelling, punctuation, and spaces must match the answers you set up.

    Screen shot of reset UMICH password page with security questions answered in the boxes below the questions. Tip: click show responses to display your answers as you type. When the questions are answered, the check responses button will become clickable.

  3. If your answers were correct, a password reset code will be sent to the email account provided when you set up your security questions. Get the code and enter it in the box on the screen, then click Check Code.

    If your answers were incorrect, you will be given a second chance to answer your questions. If you are unable to provide the answers, call the ITS Service Center at 764-HELP [4357] to reset your password.

    Screen shot of reset UMICH password page where part of your email address displays with portions replaced with asterisks and a box below where you type the password reset code.

    NOTE: If you have not received a code in one hour, check your junk or spam folders. If the code is not there, phone the ITS Service Center at 764-HELP [4357] to receive a password reset.

  4. You will be taken to the Change Password page in UMICH Account Management, where you can set a new password.

    TIP: You may not set your new password to the same thing as your current password. If you attempt to change a forgotten password to your current (forgotten) password, an error message will display and you will need to enter a new password.

    IMPORTANT! Password reset codes expire one hour after they are sent. You can get a new code by starting over on the Forgotten Password page of UMICH Account Management.