Active Directory Account Creation

Question

We are creating the AD account and password automatically. The Helpdesk will not know the password or use it in way. I'm looking for other companies that are maybe doing the same type of procedure. We will be asking the end user to come to the Helpdesk to reset their password. I'm looking for other types of options where we still don't know the password but need to give the end user support.

Answer 1

You might check out SSRPM from www.tools4ever.com.

Answer 2

You don't need the helpdesk to know the end user password. What you can do is:

1. create account using a password generator - tell no-one the password
2. on new user start date, one of the helpdesk responsibilities is to reset the user password when the user calls in and the helpdesk gives the user that new password. At that time the helpdesk also sets the "user must change password at next logon" option. Note that this is auditable and should be audited regularly.
3. user logs in at their workstation and is forced to generate a new password.

There are a couple of questions that your question brings up:

1. if the password is autogenerated, what is the mechanism for the end user to get the initial password?
2. How do you currently handle forgotton passwords? What makes a "new" forgotton password (new account) different than an existing one?
3. Why does the user need to come to the helpdesk to reset their password?

Answer 3

Assuming your HR system can publish data then you can grab something from that (say DOB) as the initial user password, and one to reset user passwords to, and write a tool to allow the helpdesk to reset a user's password to their DOB without telling the helpdesk what the DOB actually is. (This tool should set the "user must change password at next logon" flag, forcing the user to change to a more secure password at logon)

They can then tell the user "Your password is your DOB in the following format ../../.." without knowing the actual DOB. Obviously, given that most people don't regard their own DOB as a state secret then it isn't rocket science for the helpdesk / a malicious attacker to mess around so you should be careful. But then how else will you be able to have the heldpesk tell a user "your password is reset" and the user know what the password has been reset to if the helpdesk doesn't know the new, temporary password".

We do something similar to this at the college I work at, except the helpdesk can see a user's DOB as ported from our student records when resetting a password (our students seem to give us their DOB incorrectly enough times that this is a needed troubleshooting step for us).

You do need to think this through carefully - if this is being done to satisfy someone's theoretical idea of a "secure" system then I wonder if that person has actually thought about the impact on your end users and the workarounds they and the helpdesk will have to employ just to get work done that will not only undermine the idea but result in worsened security overall.