Are you expected to give iT support your passwords?

[Ninetwenty]

We've recently had an IT upgrade which hasn't gone according to plan (no idea exactly what). In order to fix things IT have asked for my laptop and password.

I'm sure at previous employers IT had an "admin" password and wouldn't have asked for your personal login.

I know I can change it when I get it back, but anything they do will be under my name. There's nothing that awful they could do, in terms of data or money, but even e.g. sending an email could (if anyone was minded to use it that way) be a massive issue.

So, it makes me uncomfortable that I'm being asked. Is it usual?

They could do that as admin. It's going to be a bit laborious to correct the upgrade using individual passwords, surely?

Getting everyone's laptops in sounds slightly iffy to me.

Giving anyone else your password is a complete no no in security training! They should do remote access, and if not, arrange a day for you to see them in person so that you can enter the password for them. Never ever give your password to someone else, even if it is an “IT colleague”. Terrible protocol on their part.

It's very poor practice. I have worked in IT for 30 years and we haven't needed to ask for passwords for yonks.

You shouldn't have anything on a work laptop you wouldn't want your manager to see anyway.

It's actually the director of IT on this occasion. Much more senior than me.

No. But that's not my concern.

Very very red flag. Are you sure it's genuine?
Very few IT directors ever have the need to do low level fix stuff

I think this has been such a disaster it's all hands on deck. I'm not sure what you mean by genuine. He's genuinely the IT director and it is genuinely him.

Do not give your password to anyone..
In my experience IT support staff have a high level of access and security that does not need it. They may ask you to log in yourself to see if the problem has gone.

if the IT director is asking then he is probably checking company rules and protocols to see if you are complying with them.

In that case just check with your line manager that it's the correct protocol.

We were in the middle of installing and testing a new finance system when I left exjob. Something would be installed, we'd log in on our PCs, test it, say yup works/nope doesn't work, file a report and project manager, IT and external company would do some more work and we'd retest.

Taking individual laptops and passwords just sounds a bit like hard work.

Good lord. I’m assuming you work for a very small company with a very small IT team? It’s shocking practice by the ITD, regardless of how up the creek they are with the upgrade! It’s doesn’t sound like a scam at least, just old fashioned incompetence.
Please don’t do anything on your work laptop you wouldn’t be happy ending up on the internet, sounds like security is a shitshow. I would definitely avoid entering card or payment details.

I agree with a previous poster. Check with your line manager that this is allowed (and make sure you have their answer in writing). Then if there is any comeback over it you will not be the one in trouble.

I work for a tech firm and we are constantly reminded never to divulge our passwords to anyone including IT.

😂I work in a school. A big one, so IT issues are quite common and the IT manager has occasionally needed my password to sort out problems with my laptop.

At school I believe they use the admin account to sort out the hundreds of computers that are there. But staff also have a school laptop to take home and work on, and these have personal passwords. Schools nowadays have so many upgrades to firewalls, etc (I'm not technical) to stop kids accessing inappropriate content that laptops need software upgrades every year or so.

I promise they are not a 'dodgy outfit'.

If IT need to do anything to/with my laptop they either log in remotely when I'm also logged on or they use their IT admin passwords /log ins etc.

Because a well known phishing scam is someone pretending to be someone senior and asking for something inappropriate. Asking for your password would be an absolute red flag for me and be flagging as impersonation scam

I would decline to share the password, because it probably isn’t a genuine request. It is more likely to be a test/training. If they genuinely needed access they would use an admin log-in or remote access. And they should have the ability to reset your password from their end anyway if you refuse to share it. Surely people forget their passwords sometimes after annual leave etc, so they need to be able to reset it. Happens all the time at our place.

He was stood in front of me at the time, and I know him quite well, so if it was impersonation it was very good!

No. Our IT never ask for our passwords.

They either use their admin login or on occasion they may ask me to input the password but they cannot see what is typed in.

Our IT director sent out an email telling us that bonuses were going to be paid (hooray! first time ever!) and click on this link for details.

It was a test to see if people would click on dodgy links. If it is a test, that's part of it. You know and trust him so of course he wouldn't do anything dodgy, would he?

You'd be sent to a cyber security refresher in my company if you did that. IT has admin passwords, they don't need yours.

Usually there is an account with admin privileges and a password set by the IT team, most normal users do not have admin privileges to prevent them installing software or altering configurations, so there is no benefit to the IT dept knowing your personal log in.. When I was working, IT could connect to my laptop (and remotely wipe it if required) whenever it was connected to the company network or to the internet. occasionally they would ask for the laptop to do upgrades, but that was only to ensure that I didn't turn it off part way through

This. We’re always told that IT will never ask for our passwords so don’t reply to any emails or phone calls asking for such as they’re phishing.

That's incredibly bad practice and should not be required. I would raise this with someone more senior. If you work in a half decent organisation this would break any Acceptable Use policy you may have signed.