Please refer to the following Knowledge Articles as well:
56051
47804
Please note, the above articles do not specify the ESSOController account. If the QESSO service account has sufficient permissions, you can confirm in the WGSS log if the ESSOController account is attempting the reset.