Disable user password reset by Agent

mpev

Getting ready to go live with v1.18.2 and just found that all our Agents can initiate the Send Password Reset Email from the User Directory. We do have different Roles set up for some Agents but I don't see anything at the Role level that would control this.

Since we're using LDAP I don't think this has any effect but is there a way to disable this?

KevinTheJedi

mpev

Funny enough that’s the only one not gated by a permission (see here). As long as client registration is enabled then any Agent can send password reset email. In that same breath the Users themselves will be able to request a password reset at any time (as long as they are registered of course).

Cheers.

mpev

Thanks, at least I know I didn't miss anything. I do have the users blocked from changing their password and I think I'll just remove the User Directory from all Agents except the administrators, it's an internal helpdesk so we won't lose anything.