Vrftjkry

I have a bad habit of worrying a lot but I have a question for all you IT people.

I work in a company that uses Windows 7. I forgot my password or entered in the incorrect one way too many times so I was locked out.

The error was something like the referenced account is locked and cannot be logged on.

I told my manger and he opened a help desk ticket. IT gave me a new password to put in which after I put it in it allowed me to change it to whatever I want.

My concern is, did IT see my password that I had previously? Like what did they do and how?
And will they see what password I change it to after I log in?

And do they ever see any of my passwords?

Windows does not store your password. What it stores is a cryptographically-strong hash of your password. When you enter your password to log in, Windows computes the hash of the password you entered and compares it to the stored hash.

Hashes are designed so that they cannot be reverse-engineered. You can't get back the original password from a hash.

This form of hashing is required for systems to conform to non-repudiation requirements. Non-repudiation is the ability of a system to prove that you are who you say you are, and that you were the one who performed the actions you did on the system while you were logged in. That kind of non-repudiation cannot happen if it is possible for someone else (even an administrator) to retrieve your password.

Not all systems are secured in this way. Poorly designed websites and other applications can store password in a database in the clear, or provide insufficient salting to withstand rainbow attacks.

In a modern secure environment a password isn't saved as full password but as a hash which is let's say a weird sequence of numbers that can be used to check if you entered your password but can't be converted back to your actual password.

This means nobody can see the password because it isn't saved anywhere.

And do they ever see any of my passwords?

I assume your Windows environment works like that but I can't be sure and nobody else can be sure either.

That means the answer to this question is: not if every system you use is secure as I described. But nobody here knows what other systems your company uses that requires your password to be saved somewhere and that perhaps doesn't save it in a secure way.

IT probably didn't know your previous password, and wouldn't really care as they have the ability to reset your password and log in themselves if they had a need.

Don't forget that your work computer and associated Windows profile belongs to your employer, it's not yours. The company is allowed full access over your computer as and when required (which isn't often).

If you have a concern that you have private information on your work computer that your company can access, then the answer to that is simple - don't put private information on your work computer. Assume that your IT department has full access to your computer and the data on it.

If you're concerned that the IT department can see your past and future passwords because they're the same/similar as passwords you use in your private life, then (again), stop doing that. Credentials for your work computer/systems should be completely different to your personal passwords (but you should really be using completely random passwords for everything anyway...)

If IT is set up in a way that is not criminally insecure, there is no way anybody can read your password. However, if your IT is indeed run in an awfully insecure way, then they could read everybody’s password at any time. So whatever it is, the password reset makes no difference.