This was standard MO at my uni. Show up in person with ID during normal business hours and (re)set your password.

It was high friction by design. It only worked well because 98% of the entire user base lived within two miles of the IT office—and the amount of rage generated when a professor on sabbatical had to come back to campus just to reset their password was a sight to see.