-4

I have a bad habit of worrying a lot but I have a question for all you IT people.

I work in a company that uses Windows 7. I forgot my password or entered in the incorrect one way too many times so I was locked out.

The error was something like the referenced account is locked and cannot be logged on.

I told my manger and he opened a help desk ticket. IT gave me a new password to put in which after I put it in it allowed me to change it to whatever I want.

My concern is, did IT see my password that I had previously? Like what did they do and how? And will they see what password I change it to after I log in?

And do they ever see any of my passwords?

|improve this question

closed as off-topic by Philip Kendall, jcmack, gnat, Mawg says reinstate Monica, yoozer8 Nov 15 '18 at 17:59

  • This question does not appear to be about the workplace within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Just to be safe - regardless of how the system should be, you should not assume for certain that they cannot access your current, present, or future passwords. Good design would mean they can't, but there is plenty of bad design in the world - some due to ineptness, some to malice. If there is some particularly threat you are concerned about (say, that your password is "MyBossSucks"), it would help if you add that to the question so people can try to better address your concerns rather than the pure "is it possible" scenario you have now. – BrianH Nov 15 '18 at 5:39
  • Well I was just upset that it got to the point where I had to reach out for IT to reset my password like I tried my best to guess my password then it locked me out and o even waited sometime and tried the password again but it still locked me out so my concern is now that they reset my password like do they know what it was before I and is there any harm in them resetting my password mike are they going to monitor my computer now or like how was the process that they reset m password what did they do? – Steve P Nov 15 '18 at 5:42
  • Having worked in IT, at most places resetting a password is incredibly common (perhaps the most common IT task of all), and most places don't make a big deal of it or anything like that. Bigger places develop an automatic system where you can reset it yourself precisely because it is so annoyingly common. If you assume a reasonable, normal, healthy IT system, they just click a few buttons and the system generates a special reset password that requires you manually change it when you next login, no one involves sees any actual passwords, etc. But many companies do log passwords, regardless. – BrianH Nov 15 '18 at 5:46
  • 3
    This question is not about the workplace, it is a technical question. Maybe security.stackexchange.com would be better for this. – Brandin Nov 15 '18 at 5:54
  • 4
    I'm voting to close this question as off-topic because it is an IT / information security question much more than a question about navigating the workplace. – Philip Kendall Nov 15 '18 at 6:35
2

In a modern secure environment a password isn't saved as full password but as a hash which is let's say a weird sequence of numbers that can be used to check if you entered your password but can't be converted back to your actual password.
This means nobody can see the password because it isn't saved anywhere.

And do they ever see any of my passwords?

I assume your Windows environment works like that but I can't be sure and nobody else can be sure either.
That means the answer to this question is: not if every system you use is secure as I described. But nobody here knows what other systems your company uses that requires your password to be saved somewhere and that perhaps doesn't save it in a secure way.

|improve this answer
  • This. At the end of the day, the company controls the computers on their network, they can do anything they want including replacing the default Windows password behaviour. It would be highly unusual, but they could conceivably do it and only their IT could tell you if they indeed have. – Moo Nov 15 '18 at 5:34
  • I think that replacing the default Windows password behaviour would be rather difficult to do – Mawg says reinstate Monica Nov 15 '18 at 9:40
  • @Mawg yes the Windows password backgrounds will be hard to change. But in case the question targets passwords in other systems also, no assumption can be made. Every system they use can vary from super secure to absolutely bad and visible password treatment. – puck Nov 20 '18 at 16:46
2

Windows does not store your password. What it stores is a cryptographically-strong hash of your password. When you enter your password to log in, Windows computes the hash of the password you entered and compares it to the stored hash.

Hashes are designed so that they cannot be reverse-engineered. You can't get back the original password from a hash.

This form of hashing is required for systems to conform to non-repudiation requirements. Non-repudiation is the ability of a system to prove that you are who you say you are, and that you were the one who performed the actions you did on the system while you were logged in. That kind of non-repudiation cannot happen if it is possible for someone else (even an administrator) to retrieve your password.

Not all systems are secured in this way. Poorly designed websites and other applications can store password in a database in the clear, or provide insufficient salting to withstand rainbow attacks.

|improve this answer
  • Thank you guys so when they went to reset my password so I can get in, we’re they able to see my previous one? – Steve P Nov 15 '18 at 5:27
  • 1
    You overlook the fact that the company IT team can tell Windows or Active Directory to do anything they want with the password, including sending it to their own service where they can log it. – Moo Nov 15 '18 at 6:17
  • @Moo: Naturally, if IT installs keyloggers on every system, then all bets are off. But that's not how Windows is designed out of the box. – Robert Harvey Nov 15 '18 at 15:46
-1

IT probably didn't know your previous password, and wouldn't really care as they have the ability to reset your password and log in themselves if they had a need.

Don't forget that your work computer and associated Windows profile belongs to your employer, it's not yours. The company is allowed full access over your computer as and when required (which isn't often).

If you have a concern that you have private information on your work computer that your company can access, then the answer to that is simple - don't put private information on your work computer. Assume that your IT department has full access to your computer and the data on it.

If you're concerned that the IT department can see your past and future passwords because they're the same/similar as passwords you use in your private life, then (again), stop doing that. Credentials for your work computer/systems should be completely different to your personal passwords (but you should really be using completely random passwords for everything anyway...)

|improve this answer
  • that'd depend on the jurisdiction involved. EU law e.g. places many restrictions on whether companies can access computers assigned to their employees and what they can do with the data they find there for example. – jwenting Nov 15 '18 at 10:26
  • So you suggest change my work system passwords and make them different than my personal ones right? – Steve P Nov 15 '18 at 19:26
  • It seems obvious, but yes. And consider using a password generator to help you have a different and unique password for every service/website you use. Google “good password practice “ for more advice. – Snow Nov 15 '18 at 20:02
  • My passwords are all different just are similar before but I didn’t change them like I know once overthinkjng becusse even if they’ve did see my previous password it was different than all my other passwords but maybe had a couple numbers that were the same but words are completely different – Steve P Nov 15 '18 at 21:34
  • Thank you and how long does IT keep a log of it like that they had to reset my password??? – Steve P Nov 16 '18 at 3:26
-1

If IT is set up in a way that is not criminally insecure, there is no way anybody can read your password. However, if your IT is indeed run in an awfully insecure way, then they could read everybody’s password at any time. So whatever it is, the password reset makes no difference.

|improve this answer
  • How about applications you use in the computers like adp and stuff can theysee that password? – Steve P Nov 15 '18 at 19:42
  • Thanks, so you’re saying password reset makes no difference at all and I shouldn’t worry about it at all? Like with a password reset, they can’t see my previous password right? – Steve P Nov 15 '18 at 22:06
  • Hey do companies hash their passwords? – Steve P Dec 3 '18 at 4:11
  • Hi Sorry this is random but I have a question for you Do smart phone apps listen to your in person convos? Like you know how you can give them access to your mic in settings like I was having a convo with a friend in person and my phone was beside me like does it listen in? I have Instagram and WhatsApp and both have permission to access the mic but only my Instagram was in the background – Steve P Dec 5 '18 at 0:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.