How Password Reset Works
Virto Password Reset and Recovery resets the Active Directory password of a user who has forgotten it, using the account set in Administrative Options. The web part works in one of two modes.
This page describes version 3.3.0. Changes in each version are listed in the Version Release History.
E-mail address
- The user enters the user name and e-mail address and clicks Submit.
- If To send confirming message by E-mail is on, a confirmation link is sent to the e-mail address stored for the user in Active Directory. The link is valid for 30 minutes and can be used once.
- The user opens the link. The page explains what happens next; the password is reset only after the user clicks Reset password.
- The new password is sent by e-mail to the address stored for the user. It is not shown on the page.
If the confirmation option is off, the password is reset at once and the new password is sent by e-mail.
The settings of this mode are described in Email Request settings.
Security questions
The user enters the user name and the answers to the security questions. The answers are compared with the Active Directory attributes set in the web part settings.
The settings of this mode are described in Security Questions settings.
Protection
- New passwords and confirmation links are sent only to the e-mail address stored for the user, not to an address typed in the form.
- Too many reset attempts in a short time are refused for a while.
- Accounts of administrators cannot be reset from the web part.
- If organizational units are set, only users from these units can reset their password; the paths are counted from the top of the domain (for example,
Departments\Marketing). - Error details are not shown in the browser; they are written to the SharePoint log with a correlation ID.