Password Reset admin guide

The Password Reset application enables an end user to reset or change a password using a self-service process. Alternatively, your organization can implement a process that requires a service desk agent to reset passwords for end users.

Watch the video: Introducing Password Reset (Video)

Password Reset processes

Users with the password_reset_admin role configure how the process of resetting a password works for an end user.
  • Self-service process: Users reset passwords over the Internet using a browser on any supported interface, including mobile devices.
  • Service desk-assisted process: A user requests the assistance of a service desk agent, over the phone or in person. Users do not reset passwords.

End-user experience of the self-service process

The following example is typical:

  1. On the login page, the user clicks the Forgot Password? link to start the process.
    Login page
  2. The Identify page opens and the user enters their identifying information (typically username or email address). The example includes the default CAPTCHA security feature:
    Identify page
  3. On the Verify page, the user verifies their identity by providing information that proves that they are who they say they are. You, the admin, configure the method of verification and you can require multiple verifications. In the example, the admin has configured the Security Question verification. The user must answer a question to prove identity. (The user had earlier selected the question and provided a secure private answer while enrolling for the password reset process.) Other possible verifications require the user to enter a code number that was sent to a mobile device by SMS text, through the Google Authenticator app, or by email.
    Verify page
  4. The system checks the credential store to verify identity and then displays the new password on the Reset page.
    Reset page

Elements of a password reset process

You configure the following elements of the process for your organization:

  • A connection to the credential store for your organization where user credentials (like username/password) are securely stored.
  • One or more user groups on the ServiceNow instance that can use the password reset process.
  • The type of identification that users must enter to identify themselves (typically username or email address).
  • One or more verifications — methods to verify the identity of the user. Examples:
    • Answer a question that only the user knows how to answer — the QA Verification (based on the Security Question verification type).
    • Enter a code number that was texted to a mobile device — the SMS verification.

How you implement a password reset process

  1. Plan your implementation: Ensure that all applicable organizational guidelines, security policies, and areas of the organization are considered.
  2. Set up the elements of the password reset and password change processes according to the plan:
    • Connection to the credential store.
    • User groups that will use the password reset process.
    • Identification type to use.
    • Verifications to use.
  3. In the service desk-assisted model, assign service desk agents to monitor and reset passwords as needed.
  4. Monitor password reset activity to identify security threats and to ensure compliance with the password policy requirements of your organization.

Password Reset Windows Application

If a user forgets the password or gets locked out of a Windows computer, the user can reset the password directly from the Windows login screen. The user clicks the Forgot Password? link and is then guided through the process of resetting the password. To learn more, see Password Reset Windows Application.

Password Change application

The Password Change application extends the Password Reset application by letting admins define how users change their passwords. Only a self-service process is supported and an admin must publish the URL to the password change form.
  1. The user logs in to the instance and then selects the Change Password module or link from the user profile record.
  2. On the Change Password page, the user selects the credential store where the password resides.
  3. The user enters the old password and then enters and confirms a new password.
  4. Workflows validate the old password and then implement the new password.
  5. The system notifies the user that the password was changed.

What to do next

Plan your Password Reset strategy