Self-service password reset

There are a number of solutions that can help end users help themselves. These solutions rely on the same basic features including an administration console, an end-user website for users, and a client application that adds logon assistance to the Windows logon screen. For additional security and flexibility, consider the following evaluation questions:

• Does the solution use more than just security questions to verify users? Multi-factor authentication helps users access the self-service password reset system without using security questions.
• Where and how is data stored? Choose a solution that does not use an external database to store user data, enrollment data, or passwords.
• Does the solution report on system usage and password resets? Reporting capabilities can help track system usage, and event activities such as the number of password resets and account unlocks. This data allows you to measure your return on investment.
• Is the solution user-friendly? Users prioritize convenience over security. A common barrier in the self-service password reset process is the inability to set a new password that fulfills the complexity requirements. Look for a solution that displays the password complexity rules to help users satisfy the policy on the first try.

For more advanced features, and how our password reset solution measures, see our comparison of self-service password reset tools for Windows.

You have purchased a self-service password reset system, now comes the hard part. You will be asking employees to change – convincing them to use the system, instead of calling the helpdesk. It’s not enough to simply ask users to use the system. System adoption is most effective with the right solution in place.

Enrollment is the process of collecting end user information to verify their identity when they forget their password. Without an enrollment, users can’t use the self-service password reset solution. An effective solution includes features that encourage the enrollment process. Enrollment reminders via email and SMS are effective in guiding users through the process. For more impact, notifications should be configured to appear when the user logs into their account.

To make self-service adoption easier, you can remove the task from end users altogether. This can be done with authentication methods that have identifier information stored in Active Directory, such as mobile number (mobile verification code), or even high-trust authentication investments such as Symantec VIP, and Duo Security. An administrator would pre-enroll all of the users into the self-service system based on the information stored in Active Directory. Want more tips? Check out our top tips for employee self-service password reset adoption.