Accessibility: password reset

OK

Publish a web UI.

Locked-out or mobile users can't get to it!

Good

Secure kiosk account -- login as "help" with no password to launch kiosk-style UI from login prompt.

Users need to know to do this.

Very good

Add an "I forgot" button to the login screen.

Available when needed.

Excellent

Modify login error messages to link to SSPR.

Harder to miss.

Good

Enable SSPR via telephone at the help desk phone number.

Some users like to call or need to fix their VPN.

Excellent

Enable SSPR over temporary VPN for mobile users.

Password reset for cached credentials is hard!