Remedion

End User Authentication & SSPR

Prove who is on the phone—then reset passwords without leaking secrets.

Built for helpdesk and service desk teams: enrol end users once, verify callers with escalating checks or out-of-band codes, and run self-service or assisted Active Directory password resets with a security model designed so the new password never travels loosely through job queues.

End User Authentication
Service desk

Enrolled users

412

Linked PCs

638

Verifications today

17

Richard Elstob · [email protected]

Linked: CONTOSO\relstob · QUAD-WIN11LAP-R

EnrolledCaller verify ready

Verify caller

Password → security Q1 → security Q2

Escalation stops at first pass

6-digit code

4 2 3 0 4 8

Also shown on user's PC

Endpoint verification prompt

Remedion User Prompt Helper

Your verification code

423048

Read this code to the support agent on the phone. Expires in 10 minutes.

  • Enrol on the user's PC

    Personal password and security questions captured in a branded dialog.

  • Out-of-band verification

    Codes appear on the endpoint and in the portal for the same support call.

  • Verify callers before sensitive actions

    Service desk staff confirm identity with personal password and security questions before password resets or account changes.

  • 6-digit codes on the user's screen

    Issue a one-time code from the portal—it appears in a branded endpoint prompt and in the admin view for the same support call.

  • Enrolment on the endpoint

    Users set their verification profile in a Remedion dialog on their own PC—secrets are not stored in plain text for admins to read.

  • Immutable audit trail

    Code issuance, verification attempts, and admin actions are logged for governance and CE Plus evidence.

SSPR security model

Self-service password reset, secured by design

When a reset is approved, Remedion does not push the new password out in the job body. The domain controller authenticates as itself, claims a single-use expiring ticket from the portal, applies the change in Active Directory, and every step is logged.

  • Password never rides in the job payload

    The remediation job that reaches the domain controller does not contain the new password or a redeemable ticket in clear form.

  • DC claims a single-use ticket

    Only the targeted domain controller redeems the reset material, authenticating with its own agent API key and hostname. Claims expire and cannot be reused.

  • Designed for helpdesk and AD reset

    Self-service and assisted resets apply through Active Directory on the DC—with unlock handling and a full portal audit trail.

Escalation model for live calls: pass password, first security question, or second security question—verification stops at the first success.

See this in a live demo

Walk through the portal with our team and map Remedion to your estate.

Book a demo