Doug Clow's Imaginatively-Titled Blog

So, it’s mandatory password change day for me today. In line with many organisations, the OU requires its users to change their password at regular intervals – at the moment, every three months/90 days. Also, in pursuit of improved security, they’ve recently reduced the number of unsuccessful login attempts you can make on your account before it locks you out. This has the unfortunate side effect of meaning that when you change your password on your desktop machine,  your phone or tablet – sitting quietly in your pocket or handbag – will keep trying to connect using your old password, which will lock you out of your account.

I had a very bad encounter with this issue six months ago when I lost most of a day to it. The problem was made particularly hard to resolve by the fact that we’d just gone over to IP phones connected to our PCs, so when I was locked out of my account, and therefore my PC, I couldn’t phone IT to get them to unlock my account, and had to go to another office some way away to ring them.  Which meant the ‘Try now – is it working?’ bits of the conversation had big gaps in the middle while I hung up and scurried back to my desk, then went back to room with the phone, redialled, waited to get through, and then updated the new person at the other end of the line with what’s going on. (Things are better now – I have a direct IP phone on my desk, and these days my office usually has people in it, which means I can borrow a phone from someone if that one’s not working.)

Three months ago – the last time I had to update my passwords – I was aware of the problem, and did it carefully and systematically in just under an hour, with no accidental lockouts! I also kept a sketchy list of what I did. Today I did it again, tweaking the list a bit as I went so I can follow it quickly next time.

Here’s my procedure. I’m posting it mainly to make it really easy for me to find in three months’ time (and I’ll print off a copy and leave it in my desk drawer). It’s obviously only directly relevant to me and my devices, but it might be useful to other OU people or people with a similar setups.

(cc) mendhak on Flickr

Before getting in to campus wifi range

• Disable wifi on laptop
• Disable wifi on phone

 On campus

• Check iMac is asleep

PC

• Wake up PC
• Unlock PC using old password, prompted to change to new password – do so.
• Outlook 2010: perhaps better left to later, but I had left it open – asks for username & password. Give it the new one and tick ‘Remember my password’.
• Chrome: Settings, Show advanced settings, Passwords and forms, Manage saved passwords (link). Search (box in top right) for any saved passwords for open.ac.uk (except dev servers and wikis) and delete.
• IE: Tools, Internet Options, Content tab, AutoComplete, Settings button. Delete AutoComplete history. Deselect all but Temporary Internet Files (for housekeeping) and Passwords.  Delete (button). (IE doesn’t let you manage individual saved passwords except by going to the site it’s saved a password for, highlighting the username and pressing the delete key, which gives you a prompt to delete it. I believe there exist plugins/toolbars to do this for you, but I’m not keen.)
• Restart PC. (Start work on phone while it reboots.) (Triggers a UNS.exe Application error with memory that could not be “read” (!). That happens sometimes when I restart. Make note to explore that a bit later.)
• Log in to PC using new password.
• Test network folders, Outlook, IE, Chrome.

 iPhone

• Double-check wifi is off.
• Settings > General > Restrictions. Allow Changes (near bottom), Accounts. Change to ‘Allow Changes’.
• Settings > Mail, Contacts, Calendars. oucu@open.ac.uk account, then Account. Change password to new one, tap Done. Says verifying, then ‘Unable to verify account information’ (because wifi off). Tap Done again, then Save.
• Settings > Wifi > On, then as soon as the list of networks comes up, tap the arrow on each one and click ‘Forget this network’ on eduroam, ouguest, and oustaff, before the connection completes. (This step is easier on Android, where you can see and manage – and more importantly, delete – wifi networks that are not in range.)
• Tap ‘eduroam’ to join; enter oucu@open.ac.uk as username and new password. Accept the security certificate offered (ignore the ‘Not Verified’ warning). (Rejoin ‘oustaff’ and/or ‘ouguest’ later, if/when needed.)
• Check email, check web.
• Settings > General > Restrictions. Allow Changes (near bottom), Accounts. Change to ‘Don’t Allow Changes’.

Laptop (original model MacBook Air)

• Wake it up.
• Double-check wifi is off. Shut down all apps and pause Dropbox syncing.
• Chrome: Settings, Show advanced settings, Passwords and forms, Manage saved passwords (link). Search (box in top right) for any saved passwords for open.ac.uk (except dev servers and wikis) and delete.
• Safari: Preferences, Autofill tab, ‘User names and passwords’ Edit button. (Same list as above – this is probably a redundant step.)
• System Preferences, Network. Check Location is ‘roaming-home’ (my usual), then click Advanced button. Airport tab, Preferred Networks – find eduroam, ouguest, oustaff in the list and click ‘-‘ (minus) button to remove them from the list.  802.1X tab, oucu-eduroam profile, change password to new one. Click Ok.
• Change location to ‘eduroam’. Same again: delete eduroam, ouguest, oustaff from Preferred Networks list, and change password in 802.1X tab. Same again for locations ‘oustaff’ and ‘ouguest’.
• Switch back to usual Location. Click Apply.
• Turn AirPort on. Click 802.1X Connect.
• Check web access, resume Dropbox syncing.
• Outlook 2011: Get ‘Mail could not be received at this time / Would you like to try re-entering your password?’. Yes. Enter new password and tick ‘Remember this password in my keychain’.

iMac (wired Ethernet)

• Wake it up.
• Chrome: Settings, Show advanced settings, Passwords and forms, Manage saved passwords (link). Search (box in top right) for any saved passwords for open.ac.uk (except dev servers and wikis) and delete.
• Go to Intranet, enter username and password.

Job done in 50 minutes, including the time to tweak this list to be up to date. Next quarter, maybe only half an hour!

Things that keep this list from being longer: Not using OU services on any of my Linux VMs, so none of them have my OU password anywhere. Not having mail set up on the desktop iMac. Not having mail set up or any OU passwords saved on my home PC. Not having a tablet. Saving fewer OU passwords in the browsers I use. (It would, of course, be even shorter if I only ever used a single desktop PC that was very locked down.)

A Mac-expert colleague, whose expertise I trust (and who is welcome to identify themselves and comment further), suggests that this is more work than is needed, and that if you’re not using the ouguest network (which they recommend you shouldn’t), you are Ok if you just shut down all your devices except the one that you change the password on, then bring the others up one by one and change the wifi passwords when they try to connect but fail.

Update 3 June 2013: This quarter’s update took more than an hour, but most of that was not password stuff, but my aged desktop PC having trouble doing too many things at once (applying a week of security patches). I did the quick procedure my colleague mentioned – turned off all devices, change password on desktop PC, then bring the others up one by one and enter new passwords as prompted – and it worked a dream.

Update 4 September 2013: And even better this time. My password expired while I was on leave, which was a bit of fun and games to get working again. (Note to self and others: all the info about how to do it yourself is behind the login – but the link you need is https://pwreset.open.ac.uk/ (the s in https is required) – which works so long as you set it up before your password expired.). But the Helpdesk were helpful, and it was only about 30 minutes work total including having to do a lot of it twice – once for the temporary reset password, and then again for the new one.

–
This work by Doug Clow is copyright but licenced under a Creative Commons BY Licence.
No further permission needed to reuse or remix (with attribution), but it’s nice to be notified if you do use it.

This entry was posted on 4 March 2013 at 10:42 am and is filed under mine-rants, too-much-techie-detail. You can subscribe via RSS 2.0 feed to this post's comments. Both comments and pings are currently closed.