This section describes activities that provide core actions of the helpdesk workflows, such as Reset password in Active Directory, Unlock account, etc.
About Password Manager
Getting Started
Different Site for Different Roles
Password Manager Components
Licensing
Checklist: Installing Password Manager
Installing Password Manager
Password Manager Architecture
Configuring Password Manager Service Account and Application Pool Identity
Enabling HTTPS
Steps to Install Password Manager
Instance Initialization
Installing Legacy Self-Service, Password Manager Self-Service, and Helpdesk Sites on a Standalone Server
FailSafe support in Password Manager
Installing Multiple Instances of Password Manager
Specifying Custom Certificates for Authentication and Traffic Encryption Between Password Manager Service and Web Sites
Step 1: Obtain and Install Custom Certificates From a TrustedWindows-Based Certification Authority
Step 2: Provide Certificate Issued for Server Computer to Password Manager Service
Step 3: Provide Certificate Issued for Client Computers to Self-Service and Helpdesk Sites
Configuring Management Policy
Configuring User Scope
Configuring Permissions for Domain Management Account
Adding Domain Connection
Specifying Advanced Options for Domain Connection
Changing Domain Management Account
Removing a Domain Connection
User Logon Requirements
Adding Secret Questions
Password Manager Components and Third-Party Solutions
Management Policies
Password Manager Service and Administration Site
Self-Service Site
Helpdesk Site
Password Policy Manager
Secure Password Extension
Offline Password Reset
Migration Wizard
Telesign
SQL Server Database and SQL Server Reporting Services
One Identity Quick Connect Sync Engine
Defender
Password Manager Secure Token Server
RADIUS Two-Factor Authentication
Quest Enterprise Single Sign-On
Redistributable Secret Management Service
Location sensitive authentication
Password Manager permission checker
Working with Power BI templates
Password Manager Credential Checker
Typical Deployment Scenarios
Simple Deployment
Deployment of the Legacy Self-Service, Password Manager Self-Service site and Helpdesk Sites on Standalone Servers
Realm Deployment
Multiple Realm Deployment
Password Manager in Perimeter Network
Installing Password Manager in Perimeter Network with Read-Only Domain Controllers
Installing Password Manager in Perimeter Network with Reverse Proxy
Installing Password Manager in Perimeter Networ kwithout AD DS
Management Policy Overview
Password Policy Overview
Using One Identity Password Policies
Using Fine-Grained Password Policies
Applying Multiple Password Policies
Using Password Policy Manager
Secure Password Extension Overview
Locating Self-Service Site
reCAPTCHA Overview
Obtaining Self-Service Site URL from Service Connection Point
Changing Self-Service Site URL on the Administration Site
Launching User Notification
How It Works
How to Use reCAPTCHA on Password Manager Sites
System Requirements for Using reCAPTCHA
References
User Enrollment Process Overview
Questions and Answers Policy Overview
Password Change and Reset Process Overview
Resetting and Changing Password in Connected Systems
Enforcing Password History When Resetting Password
Replicating Password Changes
Data Replication
Phone-Based Authentication Service Overview
Checklist: Configuring Password Manager
Understanding Management Policies
Configuring Access to the Administration Site
Configuring Access to the Self-Service Site
Configuring Access to the Helpdesk Site
General Settings
Specifying Advanced Options for Domain Connection
Changing Domain Management Account
Removing a Domain Connection
Configuring Questions and Answers Policy
Workflow overview
Custom workflows
Custom Activities
Custom Activity Settings
Creating Custom Activities
Importing and Exporting Custom Activities
Removing Custom Activities
Self-Service Workflows
Register
Manage My Profile
Forgot My Password
Manage My Passwords
Unlock My Account
My Notifications
I Have a Passcode
Self-Service Activities Overview
Helpdesk Workflows
Authentication Activities
Display CAPTCHA
Display reCAPTCHA
Authentication Methods
Authenticate with Password
Authenticate with Q&A Profile (Random Questions)
Authenticate with Q&A Profile (Specific Questions)
Authenticate with Defender
Authenticate with an external provider
Authenticate with RADIUS Two-Factor Authentication
Authenticate via Phone
Authenticate with Passcode
Action Activities
Register
Manage My Profile
Edit Q&A Profile
Reset Password in Active Directory
Change Password in Active Directory
Reset Password in Active Directory and Connected Systems
Change Password in Active Directory and Connected Systems
Reset password in connected systems through embedded connectors
Unlock Account
Enable Account
Force User to Change Password at Next Logon
Subscribe to Notifications
Lock Q&A Profile
Display User Agreement
Restart Workflow if Error Occurs
Issue BitLocker Recovery Key
Provide product feedback
Notification Activities
Assign Passcode
Reset Password
Unlock Account
Unlock Profile
Verify User Identity
Enforce Update of Profile
Helpdesk Activities Overview
Notification Activities
Customizing Notifications
Email User if Workflow Succeeds
Email User if Workflow Fails
Email Administrator if Workflow Succeeds
Email Administrator if Workflow Fails
User Enforcement Rules
General Settings Overview
Search and Logon Options
Import/Export Configuration Settings
Outgoing Mail Servers
Diagnostic Logging
Scheduled Tasks
Upgrading Password Manager
Invitation to Create/Update Profile Task
Reminder to Create/Update Profile Task
Reminder to Change Password Task
Active Directory Sites
Maximum Password Age Policy Task
User Status Statistics Task
Clear Old Records from Reporting Database
Environment Health Checker Task
Update RADIUS server status
Web Interface Customization
Instance Reinitialization
Realm Instances
Domain Connections
Using Domain Connections
Specifying Access Account for Domain Connections
Changing Access Account for Domain Connections
Specifying Advanced Options for Domain Connection
Removing a Domain Connection
Extensibility Features
RADIUS Two-Factor Authentication
Password Manager components and third-party applications
Unregistering users from Password Manager
Bulk Force Password Reset
Working with Redistributable Secret Management account
Redistributable Secret Management Service supported platforms
Customizing Redistributable Secret Management log path
Email Templates
Upgrade Requirements
About Secure Password Extension
Upgrading Multiple Instances of Password Manager
Upgrading Password Manager
Administrative Templates
In-place upgrade
Upgrade 5.7.1 or later versions
Running the Migration Wizard
Modifying the service account
Converting Q&A Profiles
Upgrading Secure Password Extension
Upgrading Password Policy Manager
Installing Administrative Templates
Configuring Administrative Templates
Updating Administrative Templates
Removing Administrative Templates
Secure Password Extension
Configuring Access to Self-Service Site from Windows Logon Screen
Deploying and Configuring Secure Password Extension
Password Policies
Deploying Secure Password Extension
Configuring Secure Password Extension
Managing Secure Password Extension Using Administrative Templates
Uninstalling Secure Password Extension
About Password Policies
Installing Password Policy Manager
Uninstalling Password Policy Manager
Creating and Configuring a Password Policy
Managing Password Policy Scope
Deleting a Password Policy
Enable S2FA for Administrators & Enable S2FA for HelpDesk Users
Reporting
Reporting and User Action History Overview
Password Manager Integration
Appendixes
Setting Up Reporting Environment
Using Reports
User Action History
Managing Connections to SQL Server and Report Server
Best Practices for Configuring Reporting Services
Appendix A: Accounts Used in Password Manager
Glossary
Password Manager Service Account
Application Pool Identity
Domain Management Account
Password Policy Account
Account for Using One Identity Quick Connect
Appendix B: Open Communication Ports for Password Manager
Appendix C: Customization Options Overview
Customization of Steps in Self-Service and Helpdesk Tasks
Email Notification Customization
User Agreement Customization
Account Search Options Customization
Web Interface Customization
Customization of Password Policies List
Customization of Password Strength Meter
Customization of User Name
Appendix D: Feature imparities between the legacy and the new Self-Service Sites
Action Activities
Reset Password in Active Directory
Management Policies > Helpdesk Workflows > Helpdesk Activities Overview > Reset Password in Active Directory
Reset Password in Active Directory
This is a core activity of the Reset Password workflow. The activity allows helpdesk operators to reset user passwords in Active Directory only. If you want to enable helpdesk operators to reset passwords in several systems, configure the Reset password in connected systems and Active Directory activity. For more information on configuring this activity and using One Identity Quick Connect Sync Engine, see Reset Password in Active Directory and Connected Systems.
In this activity you can configure the Enforce password history option. Password history determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. Password history is defined for a domain through Group Policy settings.
Before selecting this option, you should consider the following by-design behavior of Password Manager when that the Enforce password history option is enabled:
- Password Manager uses two slots from the password history every time a password is reset. For example, if the password history value defines that users cannot reuse any of the last 10 passwords, then Password Manager checks only the last five passwords. Therefore, it is advised that you double the password history value for all managed domains.
- Having entered a new password that is not policy compliant, users may end up with a randomly generated password they don't know.
Reset Password in Active Directory and Connected Systems
Management Policies > Helpdesk Workflows > Helpdesk Activities Overview > Reset Password in Active Directory and Connected Systems
Reset Password in Active Directory and Connected Systems
Using this activity, you can configure Password Manager to use One Identity Quick Connect to reset passwords in connected systems. If used in conjunction with Quick Connect, Password Manager allows you to enable users and helpdesk operators to manage passwords across a wide variety of connected systems. To be able to integrate Password Manager with Quick Connect, you must have a working knowledge of Quick Connect Sync Engine.
To enable Password Manager to set passwords in connected systems through a Quick Connect server, the account used to access Quick Connect must be a member of the local administrators group on the Quick Connect server.
Before you can configure Password Manager to use a Quick Connect server for cross-platform password synchronization, you must do the following in Quick Connect:
- Create a connection to the Active Directory domains managed by Password Manager.
- Create connections to the systems you want Password Manager to synchronize passwords with.
- Map users from the managed domains to users in the connected systems.
For more information on how to configure Quick Connect to set passwords in connected systems, see One Identity Quick Connect documentation.
To enable Password Manager for cross-platform password synchronization
- Include the Reset password in Active Directory and connected systems activity in a workflow and click the activity to edit its settings.
-
In the Quick Connect server name text box specify the IP address or the fully qualified domain name of the Quick Connect server.
- Select the account to be used to access the Quick Connect server. You can use either Password Manager Service account or specify another account.
You can use either pre-Windows 2000 logon name (such as DomainName\UserName) or User Principal Name (such as UserName@DomainName.com) to specify the user name.
- Specify how you want Password Manager to act when the Quick Connect server is unavailable. To do it, select one of the following and click Next:
- Act as if no Quick Connect server was specified. Helpdesk operators can manage users’ passwords only in the Active Directory domain. No warnings are displayed if Quick Connect server is not available.
- Alert users and allow them to reset passwords only in Active Directory. Helpdesk operators are notified that other connected data sources are temporarily unavailable, and are allowed to continue managing users’ passwords only in the Active Directory domain.
- Do not allow users to reset passwords. Helpdesk operators cannot perform any password management tasks in the Active Directory domain and in connected data sources, if the Quick Connect server is not available.
- From the list of connected systems, select the systems in which you want to manage user passwords. For each selected system, specify the following options and click Next:
- System alias
- Reset password in this system independently from Active Directory. Select this option to allow helpdesk operators to reset users’ passwords in a connected system independently from Active Directory.
- Do not allow resetting password in this system independently from Active Directory. Select this option to prevent helpdesk operators from resetting users’ passwords in a connected system independently from Active Directory. Note, if you select this option, a user’s password will be reset in the connected system only after the password has been successfully reset in Active Directory. If the user’ password is not reset in Active Directory, it will be not reset in the connected system. Helpdesk operators can specify a different password for the connected system, if you select the Allow specifying different password for this system option.
- To enforce password history in the Active Directory domains managed by Password Manager, select the Enforce password history check box. Password history determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. Password history is defined for a domain through Group Policy settings.
- Click OK to close the wizard.