Self-service password management tool for macOS users

Organizations today increasingly deploy macOS devices. Due to this overall influx, the amount of Active Directory (AD) password reset requests for macOS devices has grown exponentially as well. This means the IT teams of these organizations are forced to spend a lot of time handling repetitive tickets.

To solve this issue, organizations can now adopt a self-service password management and multi-factor authentication (MFA) solution, such as ADSelfService Plus. This solution provides macOS users a self-service web portal to manage their own passwords and accounts, without depending on the IT team, reducing administrative time spent on repetitive requests. ADSelfService Plus also offers MFA for macOS domain logins, securing user access to macOS devices.

Streamlining the solution

ADSelfService Plus' macOS login agent enables the implementation of a self-service password reset portal and machine login MFA tool. The login agent is an extension of the web client, allowing macOS users to securely reset their AD passwords right from their login screens and verify their identity during machine logins.

What can the login agent do?

The login agent is run by macOS as a part of the lock screen and the following features are enabled:

• The Reset Password/Unlock Account button is displayed. Upon clicking the button, a secure browser opens from which AD users can authenticate themselves and reset their forgotten passwords.
• Attempting to log in to the machine will bring up the MFA portal where users will have to prove their identity using the configured authentication methods. Upon successful authentication, users are logged in to their machines.

The login agent can be easily accessed from the desktop by keying in the keyboard shortcuts Control+Shift+Media Eject or Control+Shift+Power, depending on the device version.

How to enable the login agent

Installation of the macOS login agent is simple and quick. You can bulk install the login agent to the users' machines from a centralized ADSelfService Plus console, through domain or OU-based filters, or a CSV file with the necessary details of the macOS devices. ADSelfService Plus also allows administrators to customize the icon and text associated with the login agent. Learn more about customization details.

The ADSelfService Plus advantage

• Allow macOS users to reset their passwords and unlock their accounts directly from their devices without having to search for a secure terminal to access the ADSelfService Plus portal.
• Enforce MFA during machine logins using stringent authentication methods including biometrics and time-based one-time passwords.
• Reduce the workload of administrators and help desk personnel by removing users' dependency on them while resetting forgotten passwords.
• Comply with regulations like NIST, the GDPR, and HIPAA using MFA.
• Minimize the costs incurred on AD password reset requests.