Password Reset

The actions in the Virtual Agent use plugins.

When a user requests a password reset, based on the application for which the password reset is requested, the process works either synchronously or asynchronously.

Verify your identity while resetting your password by enrolling for the Password Reset program using a third-party authenticator app.

Credential stores hold user information such as user names and passwords that can be used as login credentials. Examples include the User table [sys_user] or an Active Directory server.

The self-service process is a typical process that you might follow to reset your password. Your experience might differ.

The Password Reset plugin installs script includes that implement password reset processes. To enable you to extend functionality, each base-system script include provides extension points that you can use to invoke "extension scripts" that you customized.

The Password Reset application provides several tools for monitoring and troubleshooting password reset activities.

Personal data verifications allow users to verify their identity by providing answers to questions that are generated from personal information stored in the User table [sys_user].

Each verification specifies the method and process for verifying the identity of the user that is requesting a password reset.

Using the Simple Message Service (SMS) Code Verification type, a user can verify identity with the help of any SMS-enabled device, like a cell phone that accepts text messages. When a user requests password reset, the system sends a numerical code to the device and the user then enters the code on the Password Reset Verification page.

You can create a Password Reset credential store record to configure access to your Active Directory server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see, restrictions on password reuse, the allowed number of failed reset attempts, and other settings.

Create a Password Reset credential store record to configure access to your Microsoft Entra ID server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see and other settings.

When the Microsoft Entra ID Integration for Password Reset store app is activated, the Password Reset application can manage passwords of a Microsoft Entra ID application. The application manages passwords by referencing a Microsoft Entra ID user with appropriate roles and password change privileges.

You can automatically send messages that remind users to enrolled in the Password Reset process. You specify the text of the message and can configure the messages to repeat at intervals.

The password that a user defines must meet certain requirements — for example, it must contain at least 12 characters, it must include a numeral, and so on. You can configure the requirements as needed for your organization.

To simplify management, many organizations auto-enroll users in the Password Reset program. Every base-system verification type enables you to specify automatic enrollment for your process.

Description of the fields on the Password Reset Process form.

To enable users to enroll for the Password Reset program, you specify a UI macro that takes the user through the enrollment process and a script that processes the enrollment data that the user entered. The base system includes a functioning macro and script.

Each verification in Password Reset is based on the settings for a verification type. If the verification types in the base system do not meet your needs, you can create a custom verification type.

A credential store type is a set of workflows that specify how to connect to a credential store. You can connect to Password Reset Credential Stores to view the list of example credential stores that are based on the base-system types.

A credential store type is the set of flows to manage password and account of Microsoft Entra ID user. Navigate to Password Reset Credential Stores to view the list of example credential stores that are based on the base-system types.

You can specify UI macros that add a header or footer to the pages that end users work in while resetting a password (the Identify, Verify, and Reset pages).

Password Reset scripts enable you to customize Password Reset by creating your own credential store, verification, and identification types, and extend them by defining extension scripts. You can also create a custom credential store type, custom verification type, or verification.

Domain separation is supported in the Password Reset application. A password reset process that you define in any domain is isolated from a process that you create in any other domain. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

To verify your identity while resetting your password, you enter a code that was sent to your email address. You can enroll for this program on a mobile device.

Verify your identity while resetting your password by using a Soft PIN. To use it, you must enroll for the verification using a Soft PIN.

Get an overview of Password Reset, Password Reset Windows Application, and Password Reset for Virtual Agent.

Request the Password Reset Windows App (Password Reset Orchestration) (com.glideapp.password_reset_desktop) plugin that enables connections to the Active Directory (AD) credential store types.

Enables end users to reset or change their Okta passwords using Password Reset and Okta spoke.

Activate the Password Reset Windows App (Password Reset Orchestration) (com.glideapp.password_reset_desktop) plugin and activate the Microsoft AD for Password Reset store app to use the Password Reset Windows Application.

The Password Expiration Configuration form allows you to define how frequently users must update their passwords and receive reminder notifications before expiration.

You can configure the system properties that support operations in password expiration.

The Password Reset application enables an end user to reset or change a password using a self-service process. Alternatively, your organization can implement a process that requires a service desk agent to reset passwords for end users.

Description of the fields on the Password Reset Credential Store form.

You can configure the password reset expiration reminder feature to send notifications to change or reset a user’s password whenever it is going to expire.

Augment an end-user experience with Password Reset for Virtual Agent that handles common support issues, using pre-built conversations.

You can configure the Password Reset global properties.

The ServiceNow Password Reset application enforces strong and secure passwords by enabling end users to reset or change their passwords either by using the self-service process or by requesting the assistance of a service desk agent.

Reference topics provide additional information about the lists and forms that you use to configure and administer Password Reset.

The Password Reset application is active by default and includes example verifications. The base system enables connections only to the local ServiceNow instance credential store types.

Description of the fields on the Password Reset Verification form.

Description of the fields on the Password Reset Verification Type form.

The Password Reset application enforces strong and secure passwords by enabling end users to reset or change their passwords either by using the self-service process or by requesting the assistance of a service desk agent.

Extension scripts allow you to extend Password Reset functionality in credential store, verification, or identification types.

You can use a custom extension script to extend Password Reset functionality for credential store, verification, or identification types.

The security score of the password reset process is a critical metric for the password reset administrators to assess the strength and configuration of the password reset process.

Tables, roles, business rules, scripts, and workflows are installed with the Password Reset application.

The example scripts perform a user account lookup and processes an identification form, define a credential store, and create an identification type.

You can request a default instance admin password reset via the Service Catalog, which triggers an automated process to securely complete the reset.

Reset a password or unlock a user account by requesting the assistance of a service desk agent.

Enable the subflows in credential store type to support third-party password auto-generation.

Enable connections to Active Directory (AD) by activating the Password Reset Windows App and Microsoft AD for Password Reset available in the ServiceNow Store.

Set up Microsoft Entra ID for Password Reset by activating the plugin and configuring the Microsoft Entra ID instance. The Microsoft Entra ID plugin is activated with the help of this plugin. Microsoft Entra ID for Password Reset is also available in the ServiceNow store.

To customize password reset processes or to integrate them with third-party credential services such as Okta or Microsoft Entra ID, use Integration Hub capabilities. Use Workflow Studio to create or modify actions like user unlock, change password, and get user status. Use Workflow Studio to create or modify subflows that perform the actions.

To use the Google reCAPTCHA service, instances that are running on a domain other than service-now.com require an API key pair from Google.

The Password Reset application can change passwords on an Active Directory credential store. The application changes passwords by referencing an Active Directory user role with the appropriate password change privileges.

You create a Password Reset credential store record to configure access to your credential store server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see, restrictions on password reuse, the allowed number of failed reset attempts, and other settings.

Create a custom credential store type when the base-system types do not meet your needs.

Create extension scripts only from the Password Reset Extension Script form. Do not create extension scripts in the System Definition Script Includes interface.

A custom identification type enables the user to enter alternative verification information such as an employee ID while resetting the password.

To implement the process, you configure credentials, verification methods and settings, and enrollment settings. You also specify to which users the process applies.

The Password Reset application includes several example verifications that you can use as they are or as the basis for a custom verification. If the verification types in the base system do not meet your needs, you can create a custom verification type.

Use a verification type in the base system as a template to design a custom verification. The Password Reset Windows Application does not support custom verifications.

To enroll for the 'Security Questions' verification, the user selects several questions and supplies confidential answers that only the user knows. You can add a custom question to the set of questions that are included with the base system.

Important: Before you delete the connection to a credential store, check all Password Reset processes to ensure that the credential store is not in use. If the credential store is being used by a process, update the process before deleting the credential store.

Your organization might ask you to select the questions to use when resetting your password. You select the questions and provide answers that only you know. At another time, when you reset your password, your answers verify your identity. You can enroll on a mobile device.

To verify your identity while resetting your password, you can use a code (the SMS code) that was delivered to your mobile phone or device. You can enroll on a mobile device.

The system provides inactive script actions that enable you to specify the number of failed login attempts before a user account is locked and to reset the count after a successful login.

You can configure the Password Reset application to send SMS codes for enrollment and verification using the ServiceNow Notify application (via the Twilio SMS Messaging system). Notify is tightly integrated with the workflow engine and business rules and delivers a highly configurable and trusted way to deliver SMS messages.

You can configure a site in the ServiceNow content management (CMS) application to define a single-site access point that includes the Password Reset service. For example, you can create an employee self-service site that provides Password Reset service.

To ensure security and efficiency, take the time to plan your Password Reset implementation.

The Reset Requests module displays the status of each password reset request from the Password Reset Request table [pwd_reset_request].

If your organization uses the Password Reset Windows Application, you can reset your password directly from your Windows login screen.

When designing a Security Questions verification for Password Reset, you can specify the number of questions to display when users enroll. You can also specify the number to display when a user is verifying identity while resetting the password.

You can specify properties that configure the Password Reset experience for end users.

If a user is manually banned or is flagged as exceeding max attempts, the user can be blocked (not allowed to use the Password Reset application). You can unblock a blocked user.

You should test the connection to a credential store after you configure a new credential store or when users experience problems that might involve the connection.

You can enable a Password Reset process in a Service Portal page by adding a widget that opens the password reset pages inside the portal.

Use a verification type in the base system as a template to design a custom verification.

You can view a password expiration table and validate whether a record is created in it.

You can view scheduled jobs for the process that you configured password expiration for. When you configure password expiration for a process, two scheduled jobs are created automatically.

The Password Reset Windows Application supports the use of a proxy server. There are three options for configuring the proxy server.

You can customize the appearance and other aspects of the application.

When the Password Reset Windows Application starts, the application passes the Windows language code to the instance. The instance then dynamically sets the language for the guest user session.

Download the Password Reset Windows Application installer.

Install Password Reset Windows Application using different available methods.

As an alternative to command-line installation, you can use a wizard.

Use the MSI file to install the Password Reset Windows Application on multiple computers over a network. As an alternative to MSI installation, you can also install from the command line.

As an alternative to wizard installation, you can run commands directly at the command line.

You use ePolicy Orchestrator (ePO) to enable McAfee MDE 7.2 on a Windows desktop computer to support the Password Reset Windows Application.

In this proxy configuration, the Proxy Auto-Configuration (PAC) file can be configured in Password Reset Windows Application registry settings.

The Password Reset Windows Application enables a user, who forgets the password or is locked out of a Windows computer, to reset the password directly from the Windows login screen.

If you cannot configure an exception policy, you must configure all Windows clients that use the Password Reset Windows Application to pass valid credentials to the proxy server.

You can configure an exception policy on your proxy server to allow unauthenticated access to the service-now.com domain.

You can configure registry keys to enable the Password Reset Windows Application to use a proxy server.

Configure the Proxy Auto-Configuration (PAC) file or Windows proxy auto detection (WPAD) using the Internet Explorer (IE) settings.

The Password Reset Windows Application has a few limitations.

Configuring security settings for the Password Reset Windows Application.

You can run either an EXE or an MSI file to uninstall the application.