Password & MFA Recovery

Complete this credential recovery with identity verified per the ladder, the account
state diagnosed first, and the new credential delivered securely. The ticket
documents everything except the secret itself.

1. Diagnose before touching anything: is the account locked (bad-password lockout),
   disabled, or expired? A disabled account may be an offboarded/suspended user — do
   NOT re-enable it as part of a "reset"; stop and confirm with the client's
   authorized contact why it is disabled.

2. Verify identity using the client's ladder before any credential action:
   - Remote, standard: full name plus employee ID, or confirmation from the user's
     manager.
   - Remote, higher assurance (VIPs, finance, admins, or anything smelling of
     compromise): call the user back on a number already on file — never a number
     provided in the ticket or email itself.
   - In person: photo ID.
   If the client documents a stricter policy (knowledge base / IT Glue documentation),
   that policy wins. No verification, no reset.

3. Password path: reset with "user must change password at next sign-in" forced. If
   hybrid AD, run an AD Connect delta sync and verify before telling the user to try.

4. MFA path: clear or re-register the lost method, then either walk the user through
   re-enrollment or issue a Temporary Access Pass (TAP) / equivalent time-boxed
   credential so they enroll the new device themselves. Prefer the TAP path over
   disabling MFA — never leave MFA off.

5. Deliver the temporary credential only through the client's secure transfer channel
   (secure link, password-manager share, or read over a verified call). Never plain
   email, never pasted into the ticket or chat.

6. If anything suggests compromise (user didn't request the reset, unfamiliar sign-in
   activity, MFA-fatigue reports), revoke active sessions and escalate to the
   security-alert process instead of finishing here.

7. Note the ticket in plain text: verification method used (not the answers), account
   state found, action taken, delivery channel — no credential content. Log time.

Guardrails: never reset on an unverified request; never verify against contact
details supplied inside the request itself. Never paste a password, TAP, or one-time
code into the ticket, chat, or email — temporary credentials go only by secure
handoff. Never re-enable a disabled account under cover of a reset. Force change at
next sign-in on every temporary password. When in doubt about identity or account
state, do nothing and escalate.