r/sysadmin • u/RoyaleShrimp • 9h ago
Rant Average password reset experience
User said they forgot their password.
I offered them to change it.
They accepted.
I told them to note their new password.
They said it's done.
I am now waiting for them to change it.
Few minutes later, another user messaged me saying that the password I gave (they wrote it plain to me, meaning they now know the password of another user) is not working.
They sent me the password they tried. The user noted the password without noting the uppercases and mixed the numbers.
I love my blue collar users.
•
u/TxTechnician 9h ago
Bitwarden send. I stopped telling ppl passwords for this reason
•
u/JeanRoyale 9h ago
I’ve been doing this lately but I’ve had a few users who claim they are having issues accessing the link even though I can see in the logs that they opened the link, sometimes it’s such a headache that I just end up WhatsApping them the temporary password and prompt them to choose a new one upon sign in
Has that process been working well for you?
•
u/TxTechnician 9h ago
I get a tiny bit of resistance whenever it's somebody who's never used a link like that before.
Just the other day I had somebody click on the link. Have it open and then just not read anything at all.
A lot of our stress as cis admins and dealing with difficult users can be reduced if you just accept that some users simply do not read at all.
I have learned to deal with those kind of users by telling them to look one-quarter or one-third of the way down their screen from the top. You know, wherever the position of the item is on a regular screen that I want them to focus on.
That works. I don't know why it works, but it does.
For the ones who don't have the capacity to click on those links or are just problematic because they just are horrible with technology period. (Meaning they fully have the capacity to learn, but refuse).
I just text them (RCS encrypted).
•
u/AntagonizedDane 8h ago
A lot of our stress as cis admins and dealing with difficult users can be reduced if you just accept that some users simply do not read at all.
The fact that you just have to accept that there are people, who go through the day completely on autopilot, and still gets paid, is just so, so depressing.
•
•
u/TxTechnician 7h ago
Okay, those people do exist.
But it's not that the people who do not read are on autopilot.
It's that they have a disability that makes it difficult for them to process information that is written down.
It is a disability that they don't realize that they actually have. They've just figured out ways around it.
This exact same thing exists for other senses too.
Such as auditory processing disorder.
•
u/AntagonizedDane 6h ago
I get what you're saying. But as long as that condition don't get recognized (in the office setting, not medically in general) I refuse to suffer the consequences of being designated the office retard wrangler.
•
u/Loading_M_ 7h ago
cis admin
What would a trans admin be?
•
u/TxTechnician 7h ago
Transitioning from being a sysadmin babysitting users. To a sysadmin babysitting AI agents.
•
u/BrokenByEpicor Jack of all Tears 5h ago
That would be someone who came out of school as a developer but later transitioned to sysadmin. A lot of people hate those folks for no good reason, but I think they're perfectly alright.
•
•
u/JeanRoyale 9h ago
Thats fair enough, im glad to hear you encounter similar issues haha it sounds tough with your users that just don’t read the screen O.o luckily I haven’t had that one yet
•
u/kingdead42 5h ago
We have a self-hosted PwPush server that we use for sending passwords to users. There was a little bit of resistance initially, but it works out pretty well and most users can figure it out. And since we have an app that runs in its own memory space to reset passwords, it can talk to this server through an API call to generate the link, the helpdesk never has access to the original password and it's never stored anywhere (outside the PwPush server's database for the time-limited retrieveal duration).
•
u/FirefighterEasy1088 8h ago
bitwarden is a lifesaver for exactly this nonsense. the number of times ive had to bite my tongue when someone writes down a password in all lowercase on a sticky note and then blames IT for it not working
had one user keep a little notebook labeled "PASSWORDS" in their top desk drawer and just leave it unlocked every night
•
u/TxTechnician 7h ago
Honestly, for some of my clients who don't have staff that know how to use tech and aren't technically inclined.
Their bit warden instance is always unlocked and available on their computer so long as they log in.
You might think that that sounds crazy. Until you consider that the user is someone who doesn't do anything managerial and has no real access to any systems outside of a login to their own user account and email.
I had realized that for those users who didn't want to go through the extra step of putting in a password for their password manager.
It was a bigger security risk to have the password manager locked than it was just to have it auto unlock.
Because any time that those users created a new account unlike Amazon or something.
That new account wouldn't get saved to the company's vault because the user did not open their password manager.
For some people, you just have to put everything on autopilot.
•
•
u/ReadyAimTranspire 6h ago
had one user keep a little notebook labeled "PASSWORDS" in their top desk drawer and just leave it unlocked every night
It's better than the "random post-it notes jumbled up in a drawer" system at least.
I had one user who honest to god probably spent 10% of their entire workweek looking for, being unable to locate, and then changing their passwords.
•
u/RikiWardOG 7h ago
We have some users who literally cannot for the life of them understand how to use 1password. It's absurd.
•
u/ReadyAimTranspire 6h ago
The paradox of the password manager, now I'm not spending time helping people change passwords all the time, but rather helping them get through using the PM for the 20th time.
•
u/GiggleyDuff IT Manager 7h ago
How does this work for windows accounts?
•
u/EpicSimon 2h ago
Wanna know this too. How do I send them a password for their Windows account when they cant log in to said account?
•
u/TxTechnician 1h ago
It's a secure link to your bitwarden sever. Email it, text it, print out a qr code and staple it to their forehead.
I use Vault Warden. Some of my clients pay for their own individual bit-warden accounts.
Bitward and send is something that is built into all of the open source Bitward and Apps. And it uses your server, whether that's a Vault Warden or Bit Warden.
So: myvqultdomain.com/superpassword123
•
u/CantaloupeCamper Jack of All Trades 9h ago
I recently re-worked authentication on an application.
It was a hellscape of “it’s not working”. So many users with like 3 or 4 password managers and no effort to understand what they’re doing.
•
u/music2myear Narf! 8h ago
"It's not working" meaning some variation of "the button moved".
•
u/CantaloupeCamper Jack of All Trades 7h ago
Just for fun I made the password inputs when you change your password obscenely large.
It might have actually helped ...
•
u/freewarefreak 6h ago
Sounds like you should have implemented SSO
•
u/CantaloupeCamper Jack of All Trades 5h ago
Oh we GREATLY encourage it for many clients and some do it and problem solved.
But the application pre dates when SSO became viable so there’s a lot of old school stuff going on.
•
u/MortadellaKing 7h ago
If management doesn't care, I don't care. Too tired for that fight these days.
•
u/atbims 8h ago
Have you ever been asked, after repeating a password 3 times and being told it didn't work... "Where is the dollar sign on my keyboard?"
•
u/carl5473 6h ago
I love the thought in their brain "its close enough right?" when trying the password without using the dollar sign
•
u/Generico300 6h ago
There are people who go through there entire life with "close enough" being acceptable for literally everything they do. It's called being a non-technical.
•
u/RoyaleShrimp 6h ago
They think the computer is a dude pressing a red and green button that has pity and indulgence
•
u/traumalt 5h ago
You laugh at this, but once it took us a month to realise that a customer is using an UK-English keyboard and not an English International one and the @ keys were being mistyped.
•
u/PaintDrinkingPete Jack of All Trades 4h ago
Our company has international offices, I've learned to avoid regional symbols in passwords as much as possible.
But honestly the entire concept of having to set a user's password for them is pretty much obsolete at this point anyway.
It does get tough when folks from one of the European offices are visiting us in the US and can't figure out how to actually type their password symbols on the US keyboard that's in front of them.
•
•
•
u/Funlovinghater Solver of Problems 5h ago
I remember when I was young and games like Deus Ex had passwords hidden on datapads or written on white boards. I remember thinking how dumb that was.
Then I got older and started working in IT and found out that a large percentage of users have sticky notes with their password right on their monitor.
•
u/CeC-P IT Expert + Meme Wizard 1h ago
How is there a living, breathing person on the face of the earth that works at a functioning, non-Amish company that doesn't know passwords are case sensitive. I've had extremely non-technical users ask if usernames and emails are case-sensitive because they at least know some things are.
•
u/Quigleythegreat 49m ago
My favorite one was the users keyboard was actually broken. Then I felt bad.
•
u/mediweevil 31m ago
some years ago when doing desktop support -
user consistently failing auth, insists they're entering the password correctly.
OK, only option is for me to reset. no, I have no way of retrieving your current password. no, I have no way of setting a password for you, all I can do is generate a random one.
tolerate several minutes of moaning about the tragedy of needing to remember an 8-character mixed case alphanumeric password. world is ending, how is an average person supposed to remember that etc.
reset password, and she still can't log in.
reset password again and she still can't log in.
finally I do something I am absolutely not allowed to do. I log into the user's account and set the password to something I think she might be able to cope with. log back in with that password so I know for sure it is working.
OK, your password is now your first name, with a capital first letter, and the number 1 on the end. that is absolutely as simple as the system will allow me to make it.
she still can't log in. yeah sorry, can't help you any more.
•
•
u/fireandbass 8h ago
Tell them to go to https://passwordreset.microsoftonline.com/ and thats it.
•
•
u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 2h ago
You need to have pw writeback enabled in Entra AD connect in hybrid deployments for this to do anything just FYI for those with hybrid that don't already have self-service pw resets set up.
•
u/Alien8_8 9h ago
Annd I bet they put there password on a stickynote attached to thier monitor
•
•
u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 2h ago
there
thier
Bro what lol. Eye appreciate the effort aye guess.
•
u/UplinkPM 7h ago
Huge pain point. We deal with this a lot in municipalities. We discussed better processes but our concern has been that any solution presents more problems for users to struggle with. We dangle the idea of tools and processes but push back hard on our users and spend a lot of time training and educating- we use power users to help push this as well. If youre going to sit in front of a computer, there are just some things you have to learn and value.
We used to get calls every night because police officers would sign into a machine that wasnt theres and would not change the username, let alone entering the wrong passwords when finally at the right username. Accounts getting locked out left and right. We pushed hard on education and saw these lockouts decrease significantly.
This topic will never have a perfect solution- i like the approach above before anything else.
•
u/sheikhyerbouti PEBCAC Certified 4h ago
I knew some people who used to do tech support for Freightliner.
I never complained about my stupid users in front of them.
•
u/UserProv_Minotaur 4h ago
Just be glad your password policy doesn't have a profanity filter.
Gods, after they implemented that our password reset contacts tripled.
•
u/Reinhold83 3h ago
First time working with Blue Collar at my new gig. Wowsa, they don’t really know time zones
•
u/mahsab 3h ago
I'm with the user at their desk.Login prompt comes up.
"Now type in your password", I say.
"Password?", they look puzzled.
"Yes, the password you use to log into your computer, the one you type several times per day"
"You think I remember it??"
"Yes."
They sit at the keyboard, stare into the distance and pause while they try to remember the password.
They type it in.
"ITS NOT WORKING!!!!"
......
•
u/nimbusfool 1h ago
we have a substitute teacher who forgets his password at every single login. You always know he's out in a classroom because each of our front line staff will have talked to him several times that day. You know what- I'd rather be helping with his password than dealing with 30 teenagers in a classroom.
•
u/kombiwombi 11m ago edited 6m ago
Issue passwords with 0-9a-z over the phone. Do the math (base 2 logarithms) and make them long enough so these have the same number of bits as passwords using the full character set. The ease of reading easily makes up for the additional characters.
We do this for our router break glass passwords, which the network operations centre will read over the phone to people who successfully pass the challenge code (a per-staff member TOTP ocde).
•
u/1z1z2x2x3c3c4v4v 7h ago
Consider it job security. AI, (no matter your position on the tech), will never be able to understand them, reason with them, or help them. Only a human can figure them out and offer real help.
•
u/xCharg Sr. Reddit Lurker 5h ago
Oh yes it will absolutely "reason" with them producing endless supply of boilerplate for each "its not working" comment. Users will then screenshot these walls of text and send it to you. From user's perspective, expectation being you will have to read it and do whatever bullshit it guesses this time around.
It took some effort from our side to shut down some users doing it.
•
•
u/dustabor 5h ago
We typically change the password, log into their PC, type it for them and have them change it immediately without them ever knowing what the temp password is.
We also enroll anyone who shares a password in remedial KnowBe4 classes.
•
u/Coffee_Ops 3h ago
Stop using passwords.
If you cant, in order of desperation:
- Windows credential manager and Windows Hello for business
- Password vault
- hardcode static string into a yubikey
•
u/Shotokant 4h ago
Why are you still using passwords? Just go passwordless and never have the hassle again.
•
u/RoyaleShrimp 1h ago
We also thought about being computerless, but people have issues with reading cursive
•
u/apandaze 7h ago
Refreshing tablets.
I ask for their Apple ID password, they say they dont know it.
I ask to reset, they accept. Inform user of new pass.
Tell them to pick up the new tablet by the end of the week.
a week later, same user calls me complaining i changed all their passwords. they cant log into anything.
sigh
i love my blue collar users.
•
u/SealedLore 9h ago
I find if anything the blue collar workers are the ones who are better with that kind of thing.
Wait until you deal with doctors who refuse to remember a password, or even login for themselves and demand that the receptionist login for them every morning and have their device logged in to their medical software and ready to use before they arrive at their desk.