How to configure the Unlock Account Workflow for Unregistered Users. (4275896)

Users who are not registered with Password Manager may have need to unlock their AD accounts prior to registration.

The default “Unlock My Account” workflow requires the user to answers questions from their Q&A profile. This requirement needs to be removed since an unregistered user does not have a Q&A profile set up. However once this is removed then the user doesn’t have to authenticate before their account is unlocked and this could be a potential security issue.

Therefore it is recommended to substitute the requirement to authenticate with the users Q&A profile with the requirement to authenticate via the phone, defender, with a password or with a passcode.

For the purpose of this KB article “Authenticate via phone” will be used.

Navigate to the PMAdmin | Home | <Management Policy>

1. Click on the “Unlock MY Account” workflow.
2. Remove the “Lock Q&A profile” and “Authenticate with Q&A profile” activities
3. Insert the “Authenticate via phone” activity before the “Unlock account” activity.
4. Click on the “Authenticate via phone” and configure the settings as required.

At this point the workflow is updated.

To make the workflow visible to unregistered users.

5. Click on the “Workflow settings” link and the “Availability” tab
6. Under the “Enable the workflow:” section choose “Always”
7. Under the “Show the workflow…….” Section choose either “Always” or “Only if the workflow is enabled”
8. Click OK
9. Click Save

Test that the new workflow does as expected.