After a user's account is locked, and an admin goes to unlock it, should the user be required to reset their password? Or should they just be able to login without changing their password?
Best practice is to, first, verify that the person requesting the unlock is the owner of the account. This can be tricky as it's the source of many social engineering attacks (these days it's quite simple to find personal identifying information for a target). If this is for an internal corporate user then often I've seen things like Employee Number used (this is decent because it's not something that an attacker would typically have), but also I'd recommend using another factor, e.g. calling the user's cell phone or emailing a secondary account for verification.
Once the user is verified then the administrator should request more information about the lock: did they cause the issue, or was it caused by an attack? If caused by an attacker then escalate the issue to the Information Security team, who should work on gathering additional information about the attack and take steps to prevent future attacks.
Assuming that the account was locked, I suppose it was not compromised. So, there should be no immediate need to reset the password.
I would recommend some additional steps :
- Log success/failed login attempts and have a page where user can review them. (Details like : Browser, OS, IP, etc are useful) (this is for next login; as user have the account locked in present)
- If user sees that recent login requests are not familiar (ie: she didn't attempt to login with showed browser/os/ip specs), then it implies that an attack is being made for that user. In such cases, you can suggest to increase the security level. Some ways to achieve this would be :
- Enable additional factor of authentication . Like : 2-factor-authentication (OTP/SMS based), etc.
- If above is not supported by the system, suggest to change password to a more secure one. (like : password with longer length, multiple cases in password, etc)
Note* : You mentioned that admin unlocks the account. This is OK. However, It's better if this unlock procedure can also done by user herself. This is because, an attacker can trigger account-lock for multiple users and if admin unlocks for all of them, it would be cumbersome.
Some ways in which self-unlock could be thought of are :
- Unlock account when a password-reset is triggered with Forget-Password.
- The whole point of account-lock is to prevent attacks such as brute-force. It would be ok to automatically unlock after a certain period of time (set by admin)
To go even further, consider removing account-lock itself. Instead, just add some delays between subsequent login attempts. Like : Captcha, or 5 sec delay, etc