password-reset-procedure

name	password-reset-procedure
enabled	true
description	Use when performing password reset procedure — self-service and assisted password reset workflow covering identity verification, reset execution across multiple systems, MFA recovery, and account lockout resolution. Provides step-by-step procedures for end users to reset passwords independently or with helpdesk assistance while maintaining security and audit compliance.
required_connections	[{"prefix":"itsm","label":"ITSM Tool (ServiceNow, Freshservice, etc.)"}]
config_fields	[{"key":"user_name","label":"Affected User Name","required":true,"placeholder":"e.g., Jane Smith"},{"key":"system_name","label":"System / Application","required":true,"placeholder":"e.g., Active Directory, Google Workspace, Salesforce"},{"key":"issue_type","label":"Issue Type","required":true,"placeholder":"e.g., forgotten password, account locked, MFA lost"}]
features	["HELPDESK"]

Password Reset Procedure

Password reset for {{ user_name }} on {{ system_name }} Issue: {{ issue_type }}

Decision Tree

START: What is the issue?
│
├─ Forgotten Password
│  ├─ Self-service portal available? → Guide to self-service reset
│  └─ No self-service? → Proceed to Assisted Reset
│
├─ Account Locked Out
│  ├─ Too many failed attempts? → Unlock account, then optional reset
│  └─ Locked by admin/policy? → Escalate to security team
│
├─ MFA Device Lost/Changed
│  ├─ Backup codes available? → Use backup code
│  └─ No backup codes? → MFA Recovery Process
│
└─ Expired Password
   └─ Guide through forced password change flow

Self-Service Reset Path

Prerequisites

• User has access to registered recovery email or phone
• Self-service portal is operational

Steps

1. Direct {{ user_name }} to the self-service password reset portal
2. User selects "Forgot Password" or "Reset Password"
3. User verifies identity via registered recovery method (email/SMS code)
4. User creates new password meeting complexity requirements
5. User confirms new password works for login
6. User re-enrolls MFA if prompted

Assisted Reset Path (Helpdesk Agent)

Identity Verification (REQUIRED before any reset)

• Verify {{ user_name }}'s identity using at least two of the following:
  • Employee ID number
  • Date of birth
  • Manager's name
  • Last four digits of phone number on file
  • Security questions (if configured)
  • Video call identity verification (for high-security systems)

Password Reset Execution

• Access admin console for {{ system_name }}
• Locate {{ user_name }}'s account
• Generate temporary password (minimum 16 characters, random)
• Set "must change password at next login" flag
• Deliver temporary password via secure channel (NOT email):
  • Preferred: in-person, phone call, or secure messaging
  • Never: email, Slack DM, or unencrypted channel
• Verify {{ user_name }} successfully logs in with temporary password
• Confirm {{ user_name }} has set a new permanent password

Account Lockout Resolution

• Check lockout reason in AD/IdP audit logs
• If excessive failed attempts: unlock account and advise user
• If suspicious activity detected: escalate to security team before unlocking
• Clear lockout counter
• Monitor for repeated lockouts (may indicate compromised credentials)

MFA Recovery

• Verify identity with enhanced verification (manager confirmation required)
• Remove existing MFA enrollment from {{ user_name }}'s account
• Generate new MFA enrollment invitation
• Guide {{ user_name }} through MFA re-enrollment
• Verify MFA is working with test login
• Remind user to save backup codes securely

Password Policy Reference

MINIMUM REQUIREMENTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Length:          12+ characters (16+ recommended)
Complexity:     Upper + lower + number + special character
History:        Cannot reuse last 12 passwords
Max Age:        90 days (or per organizational policy)
Lockout:        5 failed attempts = 15-minute lockout

Post-Reset Actions

• Document reset in ITSM ticket with verification method used
• Advise {{ user_name }} to update saved passwords in password manager
• If password was potentially compromised: force reset on all linked systems
• Close ticket

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

Generate a reset summary with:

1. User and system details
2. Verification method used
3. Reset actions taken with timestamps
4. Follow-up items if any