I got an email saying my password would expire in a few days, so I clicked on the link in the email and updated it. After doing so, I realized I could no longer log in to my computer, except by disconnecting from the network and using my old password. I immediately opened a support ticket. The next day, I was working from home, and someone from IT finally contacted me over Skype messenger. He asked me what my new password was. I was desperate to get the problem fixed since I wasn't able to connect to certain essential services whose credentials were linked to my Windows login, so I sent it to him despite my reservations.
My questions are:
- Is requesting a password over a company messaging system an acceptable practice?
How should I have responded to this request?
Aside from resetting my password again, are there any other steps I should take (such as reporting the behavior)?
I care a great deal about security and I know that the upper management at my company does as well.
To address some of the comments/answers: I'm sure that the email was legitimate because it came from a company email address and directed to a company website that I already had bookmarked. (I've updated my password twice since this incident using the same method). The password had been updated everywhere except on my personal laptop. (This is why I couldn't log in without disconnecting from the network.) I'm also sure that the person I spoke to was from the IT department because his account was on the company domain and he was able to log in to my laptop remotely with admin privileges to fix the issue.