Active Directory password recovery: An exercise in futility

While self-service password resets are a boon to any organization, you do not want users to endanger their accounts by resetting their passwords to weaker ones that easily lead to data breaches. ADSelfService Plus' Password Policy Enforcer allows you to create rules to ensure password complexity. With these rules, you can mandate the inclusion of multiple character types in passwords, restrict the use of dictionary words and phrases, restrict end users from using certain characters from old passwords and usernames, and more. By integrating ADSelfService Plus with the Have I Been Pwned? service, you can also restrict end users from using passwords that have already been exposed.

Using self-service policies, you can selectively grant users the ability to reset their passwords and perform other self-service actions. Self-service policies allow you to enable the self-service password reset capability for users belonging to specific AD domains, OUs, and groups. You can enable specific authentication methods for a group of users. You can also choose to allow a set of users to reset their passwords from one access point, like their logon screens, and provide other users with the self-service capability from another platform, like their mobile devices.

Eliminate expired passwords with ADSelfService Plus' password and account expiration notifications. ADSelfService Plus will automatically search your organization's AD for users whose passwords are about to expire, then send them phased reminders in the form of email, SMS, or push notifications to change their passwords. Users can change their soon-to-expire passwords via ADSelfService Plus' web portal and mobile app.

Typically, some users will fail to change their passwords on time, despite receiving multiple notifications, and ultimately find themselves locked out of their own systems. Save your help desk the time and frustration with ADSelfService Plus' automatic password reset/unlock account feature. It resets any expired passwords to a default value set by the administrator and automatically unlocks any locked accounts.

Receive email notifications whenever users perform password resets or any other self-service action. ADSelfService Plus also offers real-time audit reports that document everything, from the time of the password reset to the IP address on which it was performed. You can also create an approval workflow where users have to raise a request with the help desk and get it approved in order to perform a password reset.