Resetting Passwords

Permission required

Password resets require Reset passwords (ad.password.reset). Bulk resets also require Run bulk operations (ad.bulk.execute).

Reset one password

1. Open Users and find the account.
2. Open the row actions menu and click Reset password. You can also select the account and use Reset password in the toolbar.
3. Review the confirmation. It explains that the password is created automatically, is viewable once, and must be changed at the next logon.
4. Click Reset password.
5. In the Password reset dialog, click View password.
6. Copy the password and relay it to the account owner out-of-band, then click Done.

The Agent generates the password. You cannot enter or choose a password in the desktop app, and the password is not sent to the Agent by the operator.

Reveal the password before closing

The view code is a one-time burn link. After you click View password, the generated password cannot be retrieved again. Copy it before closing the dialog.

The Agent also requires the account to change the generated password at next logon. The reset outcome is recorded in the Audit Log, but neither the view code nor the plaintext password is written to the audit trail.

Reset several passwords

1. Select the accounts with the checkboxes on the Users page.
2. Click Reset password in the action toolbar.
3. Review the target list, then click Reset passwords.
4. In Password reset results, click View password separately for each successful account.
5. Copy and relay each password out-of-band before closing the results dialog.

Each successful reset has its own one-time view code. A failed account displays its error in the results list.

Dual approval for high-risk bulk operations

Dual approval is enforced by the broker for bulk operations that reach the organisation’s approval threshold. Four high-risk operations have a hard server-side approval floor and cannot have approval disabled:

• Bulk password reset
• Bulk delete
• Bulk change to password never expires
• Bulk move to another OU

This is a gate on qualifying bulk commands, not an administrator toggle that makes every password reset require approval. A single-account reset follows the standard confirmation and one-time reveal flow above.

If a reset or reveal fails

• If the reset fails, keep the dialog open long enough to read the returned error, then correct the directory or permission problem and try again.
• If a reset succeeds but secure delivery fails, the password cannot be retrieved. Run another reset for that account.
• If a view code is invalid, expired, or already used, the generated password cannot be shown again. Run another reset.