Help-desk-assisted password reset for Active Directory

The problem with password resets at the service desk

Password resets are one of the most frequent and repetitive requests a service desk handles. They consume IT staff time that should go toward higher-priority work and keep users locked out of systems while they wait in a queue.

The obvious answer is self-service password reset. But many organizations hesitate, particularly for privileged accounts or users with access to sensitive systems, because self-service removes the human check. What they may not realize is that the human check at a traditional service desk is already the weakest link.

When an agent resets a password over the phone, identity is verified through knowledge-based authentication such as a mobile number, a department name, or a manager’s name. This is information that is rarely hard to find. A social media profile or a prior data breach is often enough for an attacker to answer correctly. In 2025, Marks and Spencers experienced a breach in which attackers used social engineering to obtain a credential reset from a third-party service desk, exfiltrated the Active Directory database, deployed ransomware, and caused an estimated £300 million in damages. The agent did exactly what they were trained to do. The verification process itself was the failure point.

The answer is not to choose between self-service and help desk oversight. It is to combine both, backed by MFA-enforced identity verification at every step.

How approval-based help-desk-assisted password reset helps

ADSelfService Plus places an approval-based workflow between a user’s self-service request and the final change in Active Directory. Users initiate the password reset or account unlock themselves, from any device, at any time. They verify their identity through Active Directory attribute-based security questions, and the request is routed to a technician for review. The change is written to Active Directory only after the technician approves it. For directory self-update and mail group subscription, users authenticate through MFA at portal login before initiating the request, which then follows the same approval process.

The workflow integrates with ADManager Plus, which serves as the workflow engine and the technician-facing approval console. Admins configure rules per OU or Active Directory group; standard users can self-reset freely while privileged accounts, contractors, and remote workers pass through the approval step. Different rules can apply to different parts of the directory simultaneously. The model covers four self-service action types: password reset, account unlock, directory self-update, and mail group subscription. Every action is recorded in full, creating an audit trail that supports compliance with SOX, HIPAA, the PCI DSS, and the GDPR.

How help-desk-assisted self-service works

1. The user initiates the request by:
   1. Opening the self-service password reset or account unlock portal from the Windows, macOS, or Linux login screen portal; web browser; or mobile app and providing their username
   2. Entering the latest directory attribute details, or subscribing to the required mail groups after accessing the ADSelfService Plus user portal
2. For self-service password reset and account unlock, the user has to additionally answer Active Directory attribute-based security questions to verify their identity.
3. The request is automatically routed to ADManager Plus and the user receives confirmation it has been sent.
4. A service desk agent approves or rejects the request according to the configured workflow rules.
5. If approved, the user receives an email link to reset their password or unlock their account. For directory self-update and mail group subscription, the change is written automatically to Active Directory.
6. The full transaction is recorded in ADSelfService Plus reports, and the user is notified of the outcome.

For self-service password reset and account unlock, users authenticate through MFA before completing the reset. For directory self-update and mail group subscription, users authenticate through MFA at portal login before initiating the request.

Supported authentication methods

ADSelfService Plus supports 20 authentication methods for MFA, including FIDO2 passkeys (Windows Hello, Apple Touch ID, Android biometrics, and FIDO2/U2F-compliant security keys such as YubiKey and Google Titan Key), TOTP authenticator apps (Google Authenticator, Microsoft Authenticator, Zoho OneAuth, and custom TOTP apps), push notifications via the ADSelfService Plus mobile app, QR code-based authentication, biometric authentication via Android or iOS devices, SMS OTP, email OTP, RSA SecurID, Duo Security, Azure AD MFA, RADIUS, SAML-based IdP authentication (Okta, OneLogin, and others), smart card authentication, and Active Directory attribute-based security questions.

Admins select and enforce required methods per OU or group, and can mandate specific factors, such as requiring a hardware security key for privileged account resets, independently of the methods applied to standard users.

Benefits of approval-based help-desk-assisted password reset

• Eliminate hold times: Users submit reset requests online at any hour without waiting in a call queue.
• Reduce ticket volume: Fewer password reset requests reach the service desk, freeing agents for higher-priority work.
• Replace verbal verification with security questions: Users verify their identity through the portal before any request reaches a technician, removing human interaction.
• Give technicians verified evidence: Agents review confirmed authentication data, not a self-reported claim.
• Apply granular approval policies: OU- and group-based rules enforce different requirements for privileged users, contractors, and remote workers.
• Prevent unauthorized changes: Users cannot bypass the approval step or write changes directly to Active Directory.
• Log every request in full: Each transaction records the requesting user, authentication methods used, approving technician, and timestamp of each step.
• Support compliance requirements: Records meet audit needs for SOX, HIPAA, the PCI DSS, and the GDPR.
• Remove the dependency on VPN or phone: Remote workers and employees on unmanaged devices initiate resets entirely online.