Password Reset processes

• Self-service process: Users reset passwords over the Internet using a browser on any supported interface, including mobile devices.
• Service desk-assisted process: A user requests the assistance of a service desk agent, over the phone or in person. Users do not reset passwords.

End-user experience of the self-service process

The following example is typical:

1. On the login page, the user clicks the Forgot Password? link to start the process.

   

2. The Identify page opens and the user enters their identifying information (typically username or email address). The example includes the default Google reCAPTCHA security feature:

   

3. On the Verify page, the user verifies their identity by providing information that proves that they are who they say they are. You, the admin, configure the method of verification and you can require multiple verifications. In the example, the admin has configured the Security Question verification. The user must answer a question to prove identity. (Earlier, the user selected the question and provided a secure private answer while enrolling for the password reset process.) Other possible verifications require the user to enter a code number that was sent to a mobile device by SMS text, through the Google Authenticator app, or by email.

   

4. The system checks the credential store to verify identity and then displays the new password on the Reset page.

   

Elements of a password reset process

You configure the following elements of the process for your organization:

• A connection to the credential store for your organization where user credentials (like username/password) are securely stored.
• One or more user groups on the ServiceNow instance that can use the password reset process.
• The type of identification that users must enter to identify themselves (typically username or email address).
• One or more verifications — methods to verify the identity of the user. Examples:
  • Answer a question that only the user knows how to answer — the QA Verification (based on the Security Question verification type).
  • Enter a code number that was emailed to the user — the Email verification.
  • Enter a code number that was texted to a mobile device — the SMS verification.
  • Enter a code number that appears on the Google Authenticator app on a mobile device — the Google Authenticator verification.

How you implement a password reset process

1. Plan your implementation: Ensure that all applicable organizational guidelines, security policies, and areas of the organization are considered.
2. Set up the elements of the password reset and password change processes according to the plan:
   • Connection to the credential store.
   • User groups that will use the password reset process.
   • Identification type to use.
   • Verifications to use.
3. In the service desk-assisted model, assign service desk agents to monitor and reset passwords as needed.
4. Monitor password reset activity to identify security threats and to ensure compliance with the password policy requirements of your organization.

Password Reset Windows Application

If a user forgets the password or gets locked out of a Windows computer, the user can reset the password directly from the Windows login screen. The user clicks the Forgot Password? link and is then guided through the process of resetting the password. To learn more, see Password Reset Windows Application.

Password Change application

1. The user logs in to the instance and then selects the Change Password module or link from the user profile record. Password change is supported on mobile devices.
2. On the Change Password page, the user selects the credential store where the password resides.
3. The user enters the old password and then enters and confirms a new password.
4. Workflows validate the old password and then implement the new password.
5. The system notifies the user that the password was changed.

What to do next