ADSelfService Plus Force Enrollment

What does the Force Enrollment feature do?

In a nutshell, the Force Enrollment feature prevents unenrolled users from using ADSelfService Plus. Enrollment is required for users to self-reset passwords or self-unlock accounts. The Force Enrollment feature in ADSelfService Plus ensures that users enroll for self-service password reset and account unlock instead of relying on help desk assistance. There are two ways through which you can force users to perform self-service enrollment.

1. When users log in to their machines, a logon script configured in ADSelfservice Plus will display a message asking them to enroll for password self-service. When users click that message, they'll be taken to ADSelfService Plus in a web browser. Only after self-service enrollment will the user be granted access to other resources in their machine.
2. When users log in to ADSelfService Plus, they'll be presented with a persistent screen that requests them to complete self-service enrollment.

In appearance, this feature is a tiny check box but it carries great potential as a deployment policy. The Force Enrollment feature puts an end to an administrator's ordeal of reminding their domain users to enroll in order to use self-service password reset or account unlock facilities.

Read this guide to learn how to force enrollment in ADSelfService Plus.

What does it have to do with ROI?

The longer users stay unenrolled, the higher their chances of falling back on the help desk for password reset or account unlock help. It defeats the purpose of a self-service password reset solution, which isn't just to give your domain users self-service password reset and account unlock capabilities but also to completely eliminate password reset tickets! What's the point of giving domain users self-service password reset software and then having them call the help desk? It's a waste of time and money!

That's the reason ADSelfService Plus includes the option to force enrollment. You can calculate your ROI here.

Why do you need it?

We've seen organizations using self-service password reset software without the Force Enrollment feature and still paying hefty help desk operations costs, the bulk of which could be attributed to password reset tickets. Sending out enrollment reminder emails alone might not be effective; that's when a stronger deployment policy like Force Enrollment will help.

When you observe software users carefully, you'll find that they usually fall into any of these categories:

• Explorers: They never wait for a cue or instruction. Give them software and soon they'll start tinkering, sometimes enough to be able to write a thesis on the software!
• Disciplined: They never miss any of your instructions on how to use software.
• Forgetful: They never remember to fulfill any prerequisites of software so they can enjoy it to its fullest potential. Sometimes you feel like your lifetime will be spent reminding them what has to be done!
• Non-believers: They never believe what you teach them! They live in a blissful delusion that they can find better ways to use software and mostly do the opposite of what they've been instructed.

Every IT administrator faces these kinds of users in their domain. While the first two types are a delight, the last two can cause deployment failure of self-service password reset software or even organizational policies. Though these users are highly eager to utilize the software to self-reset passwords or self-unlock accounts, they're bound by the idiosyncrasies and might take their own time to enroll.

Empirical analysis shows that, more than reminder notifications, these users need a visual cue that will instigate them to complete any initiation process involved in software deployment. That's why ADSelfService Plus brings you Force Enrollment, an easy way for you to implement a stringent deployment policy without appearing strict.

Now that you know what the Force Enrollment feature is and why it's important, let's see how you can enable it.

How to enable the Force Enrollment feature in ADSelfService Plus

You can force enrollment in two ways:

• Force enrollment using a logon script

  Once this feature is enabled, ADSelf Service Plus will search for unenrolled users and associate their accounts with a logon script that will prompt them to enroll whenever they log in to the network. You can achieve this in a few, simple clicks with ADSelfService Plus' interactive UI. Click here for a step-by-step guide.

• Send enrollment notifications via email or push

  Send periodic email or push notifications reminding your users to perform self-service enrollment. Based on the frequency you set in the built-in scheduler (daily, weekly, monthly, and more), ADSelfService Plus will send alerts to unenrolled users automatically. Click here for a step-by-step guide.

Alternatively, you can enroll your users in bulk if you already have all their enrollment data. You can use either of the following methods:

• Import enrollment data from a CSV file

  All you need to do is import a CSV file containing all your users' enrollment data and they'll be enrolled for self-service password reset and account unlock automatically. Click here for a step-by-step guide.

• Import enrollment data from an external database

  Connect databases such as Oracle, MS SQL, MySQL, or Postgre SQL with ADSelfService Plus and import the data stored in them. Click here for a step-by-step guide.