0

I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management requested to use same process for all applications which are using in our factory.

Currently we ask them to raise help desk ticket and IT team will reset according to their request. But we have security issue on this process because if windows password is lost, he ask to raise ticket to another user. Therefore any user can request password change for someone else.

what would be technical solution and process to avoid this security issue and reset user password securely.

0

I work in a IT-department at a University, where students and employees forget their passwords all the time. Each user has a unique username and an email within the domain. Below is the bare minimum process and you can add several factors like date of birth etc. to make it more secure.

Please note that there are several systems integrated with Active Directory that can handle this automatically, but this is the process explained.

  • Before the user is registered in the domain, you should collect the information about them like first- and surname, phone number and their email address in a database. Already you've set identifiers for this individual.
  • Whenever the individual sends the helpdesk an email (with the address you got registered) regarding a password reset, you can easily verify this up to their username through Active Directory and in your database.
  • When the user has been verified, you should send a text to their phone with the new password. Sending passwords over email is NOT secure, unless it's encrypted.

As an additional note, you should also let the users know what the mail requires for a password reset to make the verification process easier and shorter for the IT-team.

|improve this answer|||||
  • The problem in question is when the users are unable to access their email address. It's easier if the user could drop by the helpdesk and they could physically check the user's identity. In big companies (manly with off-site people) it may be tricky – gusto2 Oct 23 '19 at 7:54
  • @gusto2 And I describe how to solve it in my answer. Storing their private email address in a database. If they've lost access to their private email address - that is not part of the issue here. – Sanguinary Oct 23 '19 at 8:09
0

Currently we ask them to raise help desk ticket and the IT team will reset according to their request. But we have a security issue on this process because if widows password is lost he ask to raise a ticket to another user. Therefore any user can request a password change for someone else.

Indeed, in some companies, it's possible to request a password reset even by phone.

what would be a technical solution and process to avoid this security issue and reset user password securely.

In theory, the service-desk should validate the requesting user - e.g. check the calling phone number or call back the user to a registered (company) phone

In our company, we have a self-service service (web page), where users could register their alternate phone numbers, emails (e.g. private emails), security questions. In that case, they could reset their domain password themselves.

|improve this answer|||||
  • can you give me little more information about self-service portal in your company? how do you access it? and how it is functioning? – Infra Oct 23 '19 at 6:46
  • @Infra I am not sure what are you asking for. The user needs to enroll its alternate email or security questions upfront (while having access). The service is available publicly (having many off-site people). Still - there is a risk that someone using a simple security questions can be impersonated. Btw - almost all IAM solutions could provide such a service (WSO2 IS, OpenAM, Okta ..) – gusto2 Oct 23 '19 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.