Onyen Password Challenge-Response Questions FAQs

What is the Password Challenge-Response System?

The Onyen Password Challenge-Response System is a service UNC provides for student, faculty and staff members who have forgotten their Onyen passwords and wish to reset them without physically coming to the IT Service Desk. This can be done by calling 919-962-HELP (4357) or 1-866-962-4457 (US and Puerto Rico) to verify identity or have the password reset.

The Challenge-Response Questions requires you to initially set up at least five questions that are generated by the system. For each of these questions, you must choose an answer that is unique to you and set an answer that is hard for someone to guess. We recommend you do not set answers that can be found via social network sites, found through a search engine, or known by your friends. These questions can be used as a ‘challenge’ to your future password reset requests if you ever forget your password. The Challenge-Response Questions basically are used to prove your identity and you will be required to answer 3 of the 5 original questions that were set up before a new password is given. All that is required to sign into the system is an Onyen and Onyen Password.

Frequently Asked Questions

How do I set up the Onyen Password Challenge-Response System so that I can use it in the future

  • Open a web browser and go to Onyen Services and click on the Manage Password button.
  • Click on the Update Security Questions link.
  • Login to the Single Sign-On (SSO) with your Onyen and password.
  • Setup your Challenge-Response Questions by clicking the Answer.
  • Click Next to finish.

I’ve forgotten my password. How do I use the system?

Remember that you can only use the password response system if you set it up PRIOR to forgetting your password. If you never set it up, then you will have to call 919-962-HELP (4357) or 1-866-962-4457 (US and Puerto Rico) or visit the IT Response Center directly to get your password reset. If you did set up the Challenge-Response Questions, then go to Onyen Services and click on the Manage Password button.

  • Click on the Reset Lost or Forgotten Password link on this page.
  • Enter your Onyen in the field provided.
  • The system will then prompt you with the 3 questions out of 5 questions you originally chose to use when you set up the system.
  • Answer the three questions appropriately.
  • Submit Answers button will highlight when answers are filled in correctly.
  • When you answer all three of the questions correctly, the system will prompt you with a Security Information Request.  Click on OK.
  • On the Alert Carolina screen choose an option and click Next.
  • Update Emergency Contacts information and click Next.
  • On the Challenge-Response Questions screen, you will allow to change or add questions.
    • Click Edit button to change the answers to the related question.
    • Click Remove button to remove the answer the question.
    • Click the Answer button to input an answer or add an additional question.
  • Click Next when finished.
  • Enter a new password twice. After doing so, press Save button.
  • Your password is reset!

I got an email saying that I tried to reset my password and failed. I didn’t try to reset my password. What’s going on?

Anytime someone (even you) tries to reset a password using the Challenge-Response Questions and fails to answer the response questions, an email is automatically sent to the owner of the Onyen notifying them of the attempt.

If you ever get an email saying that someone attempted to change your password and failed, then forward that email immediately to security@unc.edu. The Network Security department will investigate the issue and try to find out who attempted to reset your password.

I forgot the answers I used when I originally set up the Challenge-Response Questions. What do I do?

  • If you still know your password, then you can set it up again without knowing what you chose originally for your answers.
  • If you don’t know your password or the answers, then you will have to contact the ITS Service Desk.

I answered my questions wrong and the system locked me out. How long will it be before I can try to change my password again?

  • If you answer questions incorrectly and have been locked out then you may visit ITS Service Desk page for contact information.

I am concerned that I will forget the answers to my questions. How can I safely store the answers in case I need to refer to them in the future?

Although it’s always a physical security issue to write down your passwords, it’s relatively safe to write down the answers to your Challenge-Response Questions as long as you store them somewhere out of public view. Don’t keep them on your desk or somewhere obvious. A safe or any place that requires a lock to open is ideal. If not, hide it somewhere relatively random but significant enough to you that you’ll remember where you put it. Preferably, you want to choose questions that you already know the answer to – questions like Your father’s middle name and The last 4 digits of your driver’s license are good choices because the answers are static and never apt to change.