Are you expected to give iT support your passwords?

[Ninetwenty]

We've recently had an IT upgrade which hasn't gone according to plan (no idea exactly what). In order to fix things IT have asked for my laptop and password.

I'm sure at previous employers IT had an "admin" password and wouldn't have asked for your personal login.

I know I can change it when I get it back, but anything they do will be under my name. There's nothing that awful they could do, in terms of data or money, but even e.g. sending an email could (if anyone was minded to use it that way) be a massive issue.

So, it makes me uncomfortable that I'm being asked. Is it usual?

Well fair enough ! Just a pretty amateurish IT dept them lol

Never given anyone my password. IT should have admin rights and you have to click a message to give them permission to enter your laptop.

Very dodgy. If we have any IT issues, then we have to grant remote access to our laptops to whoever from the IT department is assigned to help. Any divulging of passwords is strictly forbidden and you’d be assigned additional security training for any lapses in process.

I once got a talking to from my manager for having my password on a post-it note on my desk. I work from home, live alone and my cat can’t read so I was a bit bemused.

Yes, and I do genuinely think the request was as a result of the extreme pressure he's under following the cock up, and wanting to fix things as easily as possible, but was just checking it just wasn't me who thought it should be done differently.

But if IT did something untoward with your laptop, i'm sure you could prove it was them and not you. I wouldn't really put personal stuff on my work owned laptop though.

Or possibly just a small one.

I've been the the CTO before, and also the entirety of the IT team. I was writing software and spinning up servers, while also having sort out Windows updates when they wouldn't install automatically. Even the kettle would somehow be my responsibility if it broke. If it had a plug on it, it was basically my problem.

I did however have Admin access to every PC. I'd also have taken a fairly dim view of those PCs being used as a personal machine.

Ok, but I still find it odd. Software updates should be pushed through, M/s have made it so simple and then any hiccups dealt with by IT admin (remotely). In the old days IT support would have me login before fixing a problem but that was in person, I'd then change my password, but that was some years ago.

Absolutely not. It’s part of our annual data security training that IT will never ask for our password.

They can log in with an administrator id and do anything that is required.

There are times when you need to be logged in to the users profile. This week for instance I was asked to resolve an issue on a PC with a particular bit of software that wouldn't open. Turns out, it only wouldn't open on that users profile. So I needed to fix that profile. Easiest to diagnose and solve while logged in as that user.

But if thats needed, I'll always have the user log in, and sit next to me while I sort it. I don't need their password.

IT should be logging in as admin. If set up correctly the admin login would give them more privileges to look and alter files in the background that maybe could be causing an issue. IT should never ask you for your password. Rule number 1 in IT security is never give you password to anyone even if they say they are IT. Although they can ask for you to log in while they are connected to your computer if the issue isn’t happening when they log in as admin but is happening when you are logged in and using it.

This is terrible - there is no way I’d hand over my password. I’m responsible for everything that is done via my account and login. Handing over my password to anyone, IT or even company director would be instant disciplinary. (Also updates should all be pushed out automatically - usually user can refuse first few times and then it’s applied regardless and restarts)

We aren’t even allowed to step away from our machines to talk to a colleague without locking them.

I would refuse and they’d either have to sort out proper remote access and privileges for admins or I login and closely supervise if they are so incompetent.

So no not normal at all OP!

Is it a ‘test’? We often get IT requesting we click on links so they can assess security knowledge of employees.

Once I batted one of these to our IT security team and got a ‘thank-you’ for doing so as it was a test of employee knowledge around phishing and such like

No it isn’t. Husband is an IT manager, and confirms this should never happen. It means the system hasn’t been set up properly.

Absolutely not - regular repetitive training on this to never give passwords to anyone. Genuine IT should have legitimate ways to access.

Nope, this is not how things are done in a professional company. Even if the IT Director is sanding in front of you in person, you should not give him your laptop password. Never.

The IT company I deal with at work will log on remotely when you are online. They request that you stay at your computer the entire time that they are logged in. They have never asked for a password. Even if they are onsite they will ask you to log out and they log in as admin.

No. Don't give him your password. If he hasn't got an admin account, he shouldn't be doing the work, director or not.

I led a team running all the Unix accounts - thousands of them. We never needed to know a user's passwords. I could see in logs if they got the wrong password or their account had expired. I could reset passwords and force password changes without knowing anyone's password. We told them never to send passwords by email. And still people did it (that just meant we'd force a password change on them.) Most of the users were software developers or DBAs or network admins, and I did wonder about the security of the applications they were writing and supporting, given they seemed not to know the basics, despite all the internsl training.

But the thing that really annoyed me was if you ever raised a call with the desktops team, they asked for your Windows password. They did not need this (I refused) - they had admin accounts. They were just being lazy. I might have had a bit of a go at them about it.

(Thank you, I clearly needed to get that off my chest.)

Handing over passwords would be a breach of our IT security policy and I wouldn't do it, IT Director or not. Even when our IT have had laptops/PCs in for repair, when they couldn't be fixed remotely, they never ask for individual passwords.

@Hatty65 As lots of PP have commented, your experience may not be a ‘dodgy outfit’ but they are certainly not following best practice IT systems. This may be due to underfunding but as you have seen it’s a vicious circle.

It’s very likely that shortcuts have been taken in the set up, most probably due to budget constraints rather than simple ignorance, which now contribute to the ongoing issues that you experience. Just like everything else, IT systems need to have quality designed in, with up front costs required to prevent issues which snowball and cause ever more issues down the line.

Having to disclose individual passwords in order to ‘fix’ individual machines is a sure sign that the set up is just … wrong.

I'm sorry that this is your experience of IT now. It can be so much better with proper investment and know how.

No it’s not. Either you work somewhere with terrible IT practices or you are answering about something you actually know nothing about.

The problems would come if a burglar stole your computer and then would be able to access your work system

Unless your cat is actually a lion that's a real risk

I've worked at 100's of companies in a long freelance career and have spoken to lots of IT Engineers! they have always accessed remotely and if they need me to put in the password will either tell me iver the phone, bring up a message screen and type what they want ir just circle the mouse cursor around the password box on the screen indicating they want it filled in.

Incidently I'm on my lunch break and an IT chap I know has just walked into the canteen. He says IT can reset the password themselves and it looks very dodgy!

We encrypted them on Unix. Windows admins are just amateurs. 😉

IT can always reset anyone's password, regardless of operating system. It is simply a matter of having the appropriate rights. They can't see your password, but they need to be able to reset it if there is a legitimate need, such as the user forgetting their password. However, they should never ask for your password. On Linux and Unix they definitely don't need it as they can impersonate you running any command without knowing your password. That is not possible on Windows, so they should get you to log in to the machine then do what they need to do, with you watching so you can see what they do.