Lock-screen recovery entry
Employees can start reset (and account unlock where offered) from the Windows sign-in experience instead of the helpdesk.
Windows Lock Screen Password Reset
Reset Windows Passwords Directly From the Lock Screen
Give employees a secure self-service way to recover access to Windows without waiting for the IT helpdesk.
- Lock-screen recovery entry
- Governed verification
- Directory password writeback
- Account unlock APIs
Overview
Windows lock screen password reset is Orqit’s endpoint-facing Self-Service Password Reset (SSPR) path: employees start recovery from the Windows sign-in experience, complete governed verification, and write a new directory password—alongside the browser SSPR hub for users who can still open a portal.
Audience
Who this is for
- Employees who forget a Windows password or cannot sign in
- Helpdesk teams overloaded with reset and unlock tickets
- IT administrators responsible for password recovery policy
- Identity administrators who own directory password writeback
- Enterprise IT teams supporting distributed or after-hours workforces
Challenges
Problems we address
-
Stuck at Windows sign-in The employee cannot open a browser to use a portal reset page.
-
Helpdesk-bound recovery Every forgotten password becomes a ticket, call, or walk-up.
-
Waiting time Work stops until IT verifies identity and resets the password.
-
Repetitive unlock volume The same password-reset pattern consumes L1 capacity every day.
Context
How Orqit approaches this
When an employee is stuck at Windows sign-in, a browser SSPR hub is out of reach. Orqit SSPR backs a lock-screen recovery experience so identity verification and directory password reset can complete before the desktop unlocks—reducing repetitive password tickets without inventing a separate identity system.
Capabilities
Platform capabilities
Recover Windows access from the sign-in screen with Orqit Self-Service Password Reset.
Governed verification
Email OTP or enrolled authenticator TOTP must succeed before a directory password change.
Directory password writeback
After verification, Orqit sets the new password on the connected directory account (for example AD/LDAP via unicodePwd, or cloud directory APIs when configured).
Account unlock APIs
Parallel account-unlock challenges exist for locked directory accounts when unlock is enabled.
Versioned SSPR APIs
Endpoint agents call tenant-scoped REST APIs (begin → verify → complete) with admin-managed credentials.
Audit events
Reset requested, OTP sent/verified/failed, and password reset completed are recorded for security review.
Workflow
How it works in practice
-
1
Open reset from Windows sign-in
From the lock / sign-in screen, the employee chooses Reset Password / Account Unlock for their user.
-
2
Identify the directory user
The Windows recovery client starts an Orqit SSPR password-reset challenge with the user’s directory identifier.
-
3
Verify with email OTP or TOTP
The employee enters the email one-time code—or an enrolled authenticator code when TOTP is enabled for the tenant.
-
4
Set a new password
After verification, the new password is submitted; Orqit enforces a minimum length and writes the password to the directory.
-
5
Sign in to Windows
The employee returns to Windows sign-in with the updated directory credentials.
Outcomes
Results teams care about
Faster employee recovery
Access can be restored from the machine they are already standing in front of.
Reduced password-reset workload
Routine forgotten-password cases can complete without creating a helpdesk ticket.
Centralized SSPR capability
Portal hub and Windows lock-screen path share the same tenant SSPR controls and directory gateways.
Better employee self-service
Employees have a recovery path when they cannot reach a browser or an after-hours desk.
Fewer repetitive helpdesk requests
Self-service deflection for password and unlock volume—without claiming automatic ticket creation.
Use cases
Where teams apply this
Employee forgot Windows password
Cannot sign in; uses lock-screen reset, verifies, sets a new directory password, and signs in.
Employee locked out
Directory account lockout—use the account-unlock challenge path when enabled, after the same verification rigor.
Remote employee away from helpdesk
Recovery proceeds through Orqit SSPR and directory writeback without waiting for an on-site admin.
Helpdesk password-reset workload
Shift routine resets to self-service so agents focus on exceptions and abuse cases.
Large distributed workforce
Same tenant SSPR policy for portal and Windows recovery paths across sites.
After-hours password recovery
Employees can complete verified reset when the helpdesk is closed—subject to tenant enablement and directory connectivity.
Governance & security
Built for audit and least-privilege
- SSPR is tenant-configurable under Admin → Security (enablement, directory reset allowance, TOTP).
- Windows lock-screen UX is delivered with your endpoint agent / lock-screen package; Orqit server provides SSPR APIs, verification, directory writeback, and audit.
- Password changes require a directory-backed account—Orqit staff login “Forgot password” is a separate local-account flow.
- Orqit checks minimum password length (8+) and matching confirmation; directory password policy may still reject weak passwords.
- SMS, security questions, biometrics, and SAML are not the SSPR verification methods implemented for this flow.
Analytics
Operational visibility
Security and identity admins enable SSPR per tenant, connect directories, issue API credentials for the Windows recovery path, and review authentication audit events for reset activity.
Details
In depth
The problem
Traditional forgotten-password recovery looks like this:
- Employee forgets their Windows password
- They cannot sign in to Windows
- They contact IT / the helpdesk
- A ticket is created
- IT verifies identity
- IT resets the password
- The employee finally regains access
That path costs lost productivity, helpdesk workload, waiting time, and a steady stream of repetitive password-reset tickets—especially for remote and after-hours workers who cannot walk up to a desk.
Orqit solution
Orqit Self-Service Password Reset (SSPR) adds a recovery path that starts where the employee is stuck: the Windows lock / sign-in screen.
- Choose Reset Password / Account Unlock on the Windows sign-in experience
- Identify the directory user and start an Orqit SSPR challenge
- Complete email OTP or authenticator TOTP verification
- Set a new password (minimum length enforced; directory policy may still reject weak passwords)
- Sign back into Windows with the updated directory credentials
The same SSPR platform also powers the browser SSPR hub for employees who can still open a portal. This page focuses on the Windows lock-screen differentiator.
Windows lock screen experience
From the employee’s point of view, recovery appears on the Windows sign-in UI next to their account—so they do not need an open desktop session or a working browser bookmark.
Under the hood, the Windows recovery client uses Orqit’s versioned SSPR REST APIs (password-reset begin → optional OTP resend → verify → complete, plus parallel account-unlock endpoints). Admins provision API credentials with password-reset / account-unlock scopes and a tenant identifier.
Orqit server responsibilities:
- Tenant SSPR enablement and policy
- Challenge creation and verification (email OTP / TOTP)
- Directory lookup and password writeback / unlock
- Auth audit events and rate limiting on API credentials
Endpoint packaging for the lock-screen UI is deployed with your Windows recovery client / agent package for the estate—confirm that package for your deployment rather than assuming every Windows configuration is covered out of the box.
Security controls (implemented)
| Control | What Orqit does |
|---|---|
| Tenant enablement | SSPR must be enabled per tenant in Admin → Security |
| Directory reset gate | Directory password operations respect `allowDirectoryReset` and connected directory configs |
| Verification | Email OTP and optional TOTP (when tenant TOTP is enabled and the user is enrolled) |
| API authentication | HTTP Basic API users + `X-Tenant-Id`, scoped for password reset / account unlock |
| Rate limiting | Per-credential hourly limits on the SSPR API surface |
| Abuse protection | OTP attempt limits and related auth abuse controls |
| Password checks | Confirm match + minimum length (8+); directory may enforce stronger policy |
| Audit | Events such as reset requested, OTP sent/verified/failed/expired, and password reset completed |
We do not claim “zero trust,” “military-grade,” or “100% secure.” Verification is challenge-based identity proof before directory mutation—not a substitute for your broader endpoint and identity security program.
Not used for SSPR verification in this product path: SMS OTP delivery, security questions, biometrics, or SAML as the SSPR challenge method.
Active Directory and identity
Windows password reset in Orqit is a directory password operation, not a local Orqit-only password change.
- Active Directory / LDAP — when configured, Orqit can locate the user and reset `unicodePwd` (and unlock via directory unlock attributes where supported).
- Microsoft Entra ID — when the Azure directory connector is configured, password reset uses Microsoft Graph password APIs.
- Google Workspace — when configured, password reset uses Google Admin Directory APIs.
Distinguish three related ideas:
| Concept | Role |
|---|---|
| Portal password reset | Browser SSPR hub (`/sspr`) for users who can reach the web |
| Windows lock-screen password reset | Sign-in-screen recovery client calling the same SSPR APIs |
| Directory synchronization | Keeps users aligned in Orqit; SSPR writeback still requires a ready directory config and privileges |
Directory sync alone does not reset passwords. SSPR must be enabled, and the recovery client must be able to reach Orqit’s APIs.
Portal reset vs Windows lock screen
| Portal reset | Windows lock screen | |
|---|---|---|
| Location | Orqit SSPR web hub | Windows sign-in / lock screen |
| Use case | Forgot password but can open a browser | Cannot sign into Windows |
| Verification | Email OTP or TOTP | Email OTP or TOTP (same SSPR backend) |
| Password writeback | Directory account | Directory account |
| IT involvement | Self-service when enabled | Self-service when enabled |
| Orqit support | Yes | Yes (via SSPR APIs + deployed recovery client) |
ITSM and the helpdesk
Successful self-service password reset is meant to avoid opening a ticket for routine forgotten-password cases. The SSPR implementation records authentication audit events; it does not automatically create an ITSM incident on every reset.
Pair with IT Service Management for the exceptions that still need a human—failed verification, directory errors, or suspected abuse—not for every unlock.
Administrator benefits
- Reduced password-reset workload on L1
- Faster employee recovery at the device
- Centralized SSPR enablement, API credentials, and directory gateways
- Better employee self-service when the browser path is unavailable
- Fewer repetitive helpdesk requests for routine resets
No invented percentage savings—measure deflection in your own ticket data after rollout.
Who uses it
- Employees — recover Windows access without waiting on IT
- Helpdesk teams — deflect routine reset/unlock volume
- IT administrators — enable SSPR and operate recovery policy
- Identity administrators — own directory connectors and writeback privileges
- Enterprise IT — support distributed and after-hours recovery with one SSPR platform
Related capabilities
- Self-Service Password Reset — overall SSPR hub, unlock, admin controls, and APIs
- Active Directory Sync / Microsoft Entra ID — directory foundations for writeback
- Identity — product overview
- Operations Center — endpoint operations when investigation is needed beyond password recovery
- Workflow Automation — automate adjacent IT processes (not the SSPR challenge itself)
- Developers / API — platform API surface for integrators
- Pricing — plan positioning
FAQ
Common questions
What is Windows lock screen password reset?
It is Orqit’s Self-Service Password Reset path for employees who cannot sign in to Windows. Recovery starts from the Windows sign-in experience, verification runs through Orqit SSPR, and the new password is written to the directory account.
Can employees reset their Windows password without contacting IT?
Yes—when SSPR is enabled for the tenant, directories are connected, and the Windows recovery client is deployed. Employees still complete email OTP or TOTP verification before the password changes.
How does Orqit reset a Windows password?
The lock-screen client calls Orqit SSPR APIs to begin a challenge, verify email OTP or TOTP, then complete the reset. Orqit writes the new password to the user’s directory account through the configured directory gateway.
Does Orqit support Active Directory?
Yes. Directory SSPR can look up and reset passwords for Active Directory / LDAP accounts when directory sync and SSPR directory reset are configured with appropriate privileges. Cloud directories such as Microsoft Entra ID and Google Workspace are also supported when those directory connectors are configured.
Is Windows password reset different from portal password reset?
They share the same Orqit SSPR backend and verification model. Portal reset uses the browser SSPR hub (/sspr). Windows lock-screen reset starts from the sign-in screen via the endpoint recovery client and SSPR APIs—needed when the user cannot open a browser.
What happens if an employee cannot sign in to Windows?
They use the Reset Password / Account Unlock option on the Windows sign-in experience, complete verification, set a new password (or unlock when that flow applies), then sign in with the updated directory credentials.
What verification is required?
Implemented verification methods are email one-time passcode (OTP) and optional authenticator TOTP when the tenant enables TOTP and the user is enrolled. SMS and security questions are not implemented for SSPR verification.
Is password reset available from the Orqit portal?
Yes. Employees who can reach a browser use the tenant SSPR hub for password reset and account unlock. See Self-Service Password Reset for the portal experience.
Which Windows versions are supported?
This repository does not publish a fixed Windows version matrix for the lock-screen client. Confirm supported Windows editions with your Orqit endpoint / lock-screen package for the estate you deploy.
Does password reset automatically create an ITSM ticket?
No. Successful self-service resets are designed to avoid opening a helpdesk ticket. Orqit records authentication audit events; automatic ticket creation on every reset is not part of the SSPR flow.
Is this the same as Orqit staff login Forgot password?
No. Staff Orqit login recovery resets a local Orqit account. Windows lock-screen and SSPR hub flows reset (or unlock) directory identities used for Windows and enterprise sign-in.
Next step
Ready to modernize IT operations?
Launch a pilot workspace or book a walkthrough — with estimated seat savings versus legacy suites, plus 24/7 support.
Entity graph