Configure your Password Reset process
To implement the process, you configure credentials, verification methods and settings, and enrollment settings. You also specify to which users the process applies.
Before you begin
Role required: password_reset_admin
- Be sure to Plan your Password Reset processes.
Create the credential store record for user names and passwords that are managed.
Note: For LDAP integrations: If the Active Directory settings require users to reset the password when logging in, the results depend on the installed Password Reset plugin.
- The Password Reset plugin cannot change an AD password. End users will not be able to log in to the instance.
- The Self Service Password Reset plugin depends on the Password Reset Basic plugin. Self service is intended for password reset only on the local ServiceNow instance and cannot change an AD password. In order to change AD password, you must install the Microsoft AD spoke for Password Reset.
- The Password Reset Windows App (com.glideapp.password_reset_desktop) plugin supports changing the AD password.
- Define the verifications that the process can use.
- Configure Password Reset to auto-enroll users or to enable users to enroll for the program. See Configure your Password Reset process to auto-enroll users and Enable users to enroll for Password Reset.
Configuring password reset for external users: External users (users with the snc_external role) cannot manually enroll their devices in the password reset system. Security restrictions prevent external users from writing data to the password reset enrollment tables, and the enrollment form is not accessible to external users by default.
To enable password reset for external users, configure an automatic verification that does need manual enrollment such as Personal data verification or Email Code or SMS Code verification. Make sure that their email address or phone number is already stored in their user record.
To configure automatic verification for external users:
- Navigate to Password Reset > Processes.
- Select any of the automatic verifications from the related list of a process record ie Personal data/SMS/Email.
- Ensure that the SMS/Email are of type Automatic and for that navigate to Password Reset > Extensions > Verification types.
- Select the Automatic enrollment option.
- Ensure that external users have a valid email address or phone number in their user profile.
Once configured, external users can receive a one-time verification code to their registered email address or phone number to complete the password reset process.
About this task
A Password Reset process consists of the following elements:
- The credential store that contains user login credentials.
- Optionally, the user groups that are authorized to use the Password Reset process.
- The verifications that verify the identity of the requesting user and that enable the service desk agents to authorize reset of the password. (Verifications are implemented by script includes.)
- Process strength configuration that helps view the security score of the process. You see the score in digits and colors based on the verification methods you select for the process. If enabled, notifications can be sent for potential configuration improvements to the process. If there are any deviations between the maximum attainable and current scores, an email with an actionable list of recommendations to improve the configuration is sent.
Procedure
Navigate to All > Password Reset > Processes.
Click New and then specify a meaningful Name and Description for the process.
Select the Credential store that contains the user credentials that the process applies to.
Specify the process that you are defining: Select the Password reset check box, the Password change check box, or both check boxes.
Specify the Apply to all users setting.
Setting of the Apply to all users check box Result Selected All users use the process that you are defining. This setting is useful only if all users have access to the authentication methods that are defined in this process. Not selected Only the users in the groups that you specify use the process. You specify the groups in the Groups related list. For more information about the fields on the Password Reset Process form, see Password Reset Process form.
For Password Reset, configure settings on the Password Reset Details tab.
For information about the settings and fields on the Password Reset Details tab, see Description of the fields on the Password Reset Details tab.
For Password Reset, configure settings of interest on the Advanced tab.
For information about the fields on the Advanced tab, see Description of the fields on the Advanced tab.
For Password Reset, fill in any fields of interest on the Enrollment Reminder tab.
Save your changes on the Password Reset Process form.
The form refreshes, and additional related lists appear.
From the Password Reset Process Verifications related list, select one or more verifications.
From the Password Reset Process Groups related list, select the user groups that use the process that you are defining.
The Password Reset Process Groups related list appears only if the Apply to all users check box is not selected.
Save the record and then select the Active check box to enable the Password Reset process that you configured.
The check box is available only after the record has been saved.
Click Update.
Navigate to Password Reset > Properties to set the properties that configure the Password Reset experience for end users.
Calculating the security score for password reset process
The security score of the password reset process is a critical metric for the password reset administrators to assess the strength and configuration of the password reset process.- Configure password expiration reminder
You can configure the password reset expiration reminder feature to send notifications to change or reset a user’s password whenever it is going to expire. - Credential stores for Password Reset
Credential stores hold user information such as user names and passwords that can be used as login credentials. Examples include the User table [sys_user] or an Active Directory server. - Password Reset verifications
Each verification specifies the method and process for verifying the identity of the user that is requesting a password reset. - Configure your Password Reset process to auto-enroll users
To simplify management, many organizations auto-enroll users in the Password Reset program. Every base-system verification type enables you to specify automatic enrollment for your process. - Enable users to enroll for Password Reset
To enable users to enroll for the Password Reset program, you specify a UI macro that takes the user through the enrollment process and a script that processes the enrollment data that the user entered. The base system includes a functioning macro and script. - Configure Password Reset properties
You can specify properties that configure the Password Reset experience for end users. - Send email to remind users to enroll for Password Reset
You can automatically send messages that remind users to enrolled in the Password Reset process. You specify the text of the message and can configure the messages to repeat at intervals. - Configure the required strength for passwords
The password that a user defines must meet certain requirements — for example, it must contain at least 12 characters, it must include a numeral, and so on. You can configure the requirements as needed for your organization. - Specify lockout for failed login attempts
The system provides inactive script actions that enable you to specify the number of failed login attempts before a user account is locked and to reset the count after a successful login. - Configure Google reCAPTCHA for the password reset process
To use the Google reCAPTCHA service, instances that are running on a domain other thanservice-now.comrequire an API key pair from Google.
Parent Topic:Configuring Password Reset
Related topics