An important setting is the way initial passwords are set. If you select the default 'temporary password generated by email' option, teachers and students will receive an email as soon as their account is created. This email contains a password that is generated by the system. The email is, by default, written in the language of the user creating the account. You can also specify a custom welcome message. In this case, the message is not dependent on the selected language. Make sure that custom messages contain the correct placeholders for username and the generated password. If you select the 'temporary password specified by teacher / administrator' option, a password for the new user needs to be entered twice while creating the new account. In this case, the person that creates the account needs to provide the username and password to the new user.

When a user logs in for the first time, a new password has to be chosen. By default the temporary password is valid for 60 days. You can change the validity period yourself. For all accounts you can set a minimum password strength. This setting does not cover temporary passwords, for this a fixed minimum of 8 characters is required. When you choose to allow password reset by teacher / administrator, the password of an existing account can be manually set to a new temporary password. The current password chosen by the user then becomes invalid. If a teacher has forgotten his password, you (as administrator) can reset this. If a student has forgotten his password, the teacher can reset this.

​

When you choose to allow Password reset via email all users that have forgotten their password can request a reset via the site by specifying an email address. For this the user has to solve a CAPTCHA first. An email with further instructions will be sent to the specified email address.

If temporary generated password via email is selected, you can also choose to use a short form with email address(es) as username for creating new accounts. These rules then apply:

• Uppercase letters in the email address will be converted to lowercase.

• The username of the new account will be the same as the email address (in lowercase).

• The user cannot change the account's email address.

• On first login the user has to fill in the first name and the last name.

• Multiple email addresses can be entered, for example by pasting a list of email addresses in the input field. For every address an account will be created.

• This option is not available when you have configured that users cannot change their account details in the privacy settings.

• For import of student accounts the username, first name and last name are optional.

​

If you switch on notification on failed login, an email will be sent to the user (student, teacher or administrator) on every failed login attempt. If the submitted username is unknown, no notification will be sent. The attempt however will be listed in the login attempts log. You can also make two factor authentication available or required for teachers and students. If two factor authentication is available, users can activate it in their account settings. If it is required, the user has to configure two factor authentication after logging in with username and password, before being able to use the LMS. If the user has lost the secret key, logging in is no longer possible. To solve this for a teacher account you can switch off the two step authentication.  If a student has lost the secret key, an authorised teacher can switch the two factor authentication off for the account.