Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are creating the AD account and password automatically. The Helpdesk will not know the password or use it in way. I'm looking for other companies that are maybe doing the same type of procedure. We will be asking the end user to come to the Helpdesk to reset their password. I'm looking for other types of options where we still don't know the password but need to give the end user support.

share|improve this question
    
Why not just set a temporary password and tick "User must change password at next logon"? –  jscott Oct 1 '10 at 20:06
    
Is this for new hire situations, or situations where helpdesk needs to log in as them for some reason, and then you guys need to reset the pw afterwards? –  Matt Oct 1 '10 at 20:06
add comment

3 Answers

You might check out SSRPM from www.tools4ever.com.

share|improve this answer
add comment

You don't need the helpdesk to know the end user password. What you can do is:

  1. create account using a password generator - tell no-one the password
  2. on new user start date, one of the helpdesk responsibilities is to reset the user password when the user calls in and the helpdesk gives the user that new password. At that time the helpdesk also sets the "user must change password at next logon" option. Note that this is auditable and should be audited regularly.
  3. user logs in at their workstation and is forced to generate a new password.

There are a couple of questions that your question brings up:

  1. if the password is autogenerated, what is the mechanism for the end user to get the initial password?
  2. How do you currently handle forgotton passwords? What makes a "new" forgotton password (new account) different than an existing one?
  3. Why does the user need to come to the helpdesk to reset their password?
share|improve this answer
add comment

Assuming your HR system can publish data then you can grab something from that (say DOB) as the initial user password, and one to reset user passwords to, and write a tool to allow the helpdesk to reset a user's password to their DOB without telling the helpdesk what the DOB actually is. (This tool should set the "user must change password at next logon" flag, forcing the user to change to a more secure password at logon)

They can then tell the user "Your password is your DOB in the following format ../../.." without knowing the actual DOB. Obviously, given that most people don't regard their own DOB as a state secret then it isn't rocket science for the helpdesk / a malicious attacker to mess around so you should be careful. But then how else will you be able to have the heldpesk tell a user "your password is reset" and the user know what the password has been reset to if the helpdesk doesn't know the new, temporary password".

We do something similar to this at the college I work at, except the helpdesk can see a user's DOB as ported from our student records when resetting a password (our students seem to give us their DOB incorrectly enough times that this is a needed troubleshooting step for us).

You do need to think this through carefully - if this is being done to satisfy someone's theoretical idea of a "secure" system then I wonder if that person has actually thought about the impact on your end users and the workarounds they and the helpdesk will have to employ just to get work done that will not only undermine the idea but result in worsened security overall.

share|improve this answer
2  
This depends on your industry. FIRPA for example, prohibits the use of SSN, DOB, or any other personally identifiable data from use in passwords that allow access to other private/protected data. In this case, random generation and then snail mail or inter-office mail is really the only alternative. –  MDMarra Oct 2 '10 at 2:19
    
You're quite right Mark... I'm a Brit so I'm not really familiar with US laws but my answer does assume that you're legally allowed to use data in the way I suggest... I think we need to know what the asker's employer is hoping to achieve with this idea to advise which kind of system is more appropriate, anyway. –  RobM Oct 2 '10 at 8:07
    
Lucky you! You don't have to deal with illiterate users whose initial passwords are Gfr1@#g1 or something of the sort. It's an almost guaranteed password reset for new employees :( –  MDMarra Oct 12 '10 at 19:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.