Specops uReset

Specops uReset lets users reset or change Active Directory or Entra ID passwords through a browser, Windows logon screen, or mobile app. Access is available from any location, on or off VPN. For remote Active Directory users, it can update locally cached credentials even when a domain controller cannot be reached. It supports on-premises Active Directory, hybrid Active Directory and Entra ID, and native Entra ID environments.

Administrators can require one or more identity checks from more than 20 providers, with options including authenticator apps, YubiKey, passkeys, mobile codes, and Entra ID. Enrollment can be automatic or prompted through email and Windows logon notifications. Admins can restrict resets by country or IP range, and send login, reset, and identity-check events to SIEM or SOC platforms through the Specops Event API. The product can block known compromised passwords with Specops Breached Password Protection. Annual subscriptions are priced by user count, with pricing available on request; the maker says a demo or free trial can be arranged, but does not state a trial duration.

Specops uReset supports self-service password changes across on-premises, hybrid, and native Entra ID environments, with multiple verification and administrative controls. Pricing is by user count and available on request; the free trial has no stated duration.

uReset is for organizations using Active Directory, Entra ID, or a hybrid environment that want users to manage password resets themselves. It also suits administrators who need configurable identity checks and event visibility.

Specops uReset lets people reset or change Active Directory and Entra ID passwords without opening a helpdesk ticket. It is best for organizations with remote staff and established identity controls. Its strongest case is broad access and verification support; custom, user-count pricing means buyers should compare a quote against their scale.

Overview

Users can start a password reset in a browser, from the Windows logon screen, or through a mobile app, whether they are on or off VPN. For Active Directory users, uReset can also update cached credentials on remote devices when a domain controller is unreachable, helping prevent a password change from leaving someone unable to sign in locally.

The product supports on-premises Active Directory, hybrid Active Directory/Entra ID, and native Entra ID. Its authentication engine, web, and identity services are hosted in the cloud, while user data remains in Active Directory and administrators configure it through Group Policy. That model fits organizations that want cloud-hosted services alongside an AD-centered setup; it is a weaker fit for teams that require those services to run entirely on premises.

Key features

Identity checks and enrollment

Administrators can require one or multiple verification factors, drawing on more than 20 identity providers. Options include Duo Security, Okta, PingID, Symantec VIP, YubiKey, passkeys, mobile codes, and Google, Microsoft, and Entra ID authentication. The range gives organizations room to align resets with existing identity tools, while also making policy design and enrollment important parts of deployment.

Enrollment can happen automatically using identifiers from Active Directory, or admins can prompt users by email, Windows notifications, or a full-screen browser at logon. The First Day Password add-on lets new hires verify their identity before setting an initial Active Directory password, avoiding shared welcome passwords. It addresses a specific onboarding risk, though it is an add-on rather than part of the stated base subscription.

Administrative controls and monitoring

Admins can allow or block resets by country or IP address range. uReset also streams login, reset, and identity-check events to SIEM or SOC platforms through the Specops Event API, supporting audit visibility. With Specops Breached Password Protection, organizations can block known compromised passwords during reset. Together, these controls make uReset more suitable for environments with defined access and password policies than for buyers seeking only a bare reset page.

Its app integration methods include Windows logon, RADIUS for VPN and RDP, OIDC, SAML, and the Specops Event API. The published supported factors include Specops:ID biometrics and push notifications, YubiKey, SMS, Microsoft and Google Authenticator, and offline OTP.

Pricing

The Specops uReset plan uses annual subscriptions and custom pricing based on the number of users in scope. Hosting is included for the hybrid solution, while a hybrid authentication add-on may cost extra. There is no free plan. Annual subscriptions include technical support, product upgrades, SMS authentication costs, and training for administrators or helpdesk staff, giving buyers a defined support package alongside the software.

Specops offers a demo or free trial by arrangement, but no trial duration is stated. Organizations should request a quote that spells out the user count, any hybrid authentication add-on, and the subscription scope before comparing total costs.

Platforms

uReset lists Android, iOS, web, Windows, API, and self-hosted platform support. Its deployment model is hybrid, with support for on-premises AD, hybrid AD/Entra ID, and native Entra ID environments. That breadth serves organizations with mixed access needs, though the cloud-hosted authentication, web, and identity services matter to teams assessing deployment boundaries.

Who it's for

uReset is a strong candidate for organizations that want employees to handle password recovery remotely, especially where cached Windows credentials, multiple verification choices, geographic restrictions, and audit integrations matter. Its AD integration and Group Policy configuration suit teams already managing identity around Active Directory. Small teams with limited user counts or buyers seeking a no-cost option may find custom annual pricing harder to justify.

Pros and cons

• Pro: Resets work through browser, Windows logon, and mobile access on or off VPN, covering several common situations for remote workers.
• Pro: Cached credential updates can help remote Active Directory users sign in when a domain controller is unreachable.
• Pro: Multiple identity providers, multi-factor requirements, geographic rules, and SIEM/SOC event streaming give administrators meaningful control over recovery.
• Con: Pricing depends on user count and requires a quote, so buyers cannot readily judge cost without engaging the maker.
• Con: The hybrid authentication add-on may add cost, and the First Day Password capability is also an add-on.
• Con: Cloud hosting for authentication, web, and identity services may not align with organizations that require fully self-hosted services.

Alternatives

ManageEngine ADSelfService Plus is worth comparing for teams seeking a freemium option: its Free Edition costs nothing with no expiration and covers 50 users, unlimited domains, and 10 Endpoint MFA users. That fixed free tier is more approachable for small deployments than uReset's quote-based annual subscription.

Cayosoft Administrator is another quote-based choice, with subscriptions offered for 12, 36, or 72 months. Consider it if those subscription terms better match your purchasing needs.

Netwrix Password Secure has a Self-service plan priced at $60 a year, with a one-year minimum purchase commitment. Its stated price can make costs easier to evaluate against uReset's user-count quote.

ManageEngine ADManager Plus offers a Governance, Risk and Compliance add-on for $495 a year for Professional Edition users under an annual license. Consider it when that governance add-on is the requirement at hand.

One Identity Active Roles is a paid alternative with licensing based on managed user count.

Softerra Adaxes offers a 30-day free evaluation with full functionality, technical support, and no license key requirement, useful for teams that want a defined evaluation period.

Blazam is a free and open-source alternative under the MIT license for personal and commercial use.

LTB Self Service Password is free, GPL-3.0 licensed, self-hosted software that requires PHP and LDAP connectivity.

Browse Active Directory Management Software or Multi-Factor Authentication Software for more options in those categories.

Verdict

Choose Specops uReset when remote users need a reliable route to change directory passwords and your administrators value cached credential updates, flexible verification, and audit controls. Its strongest advantage is the way those recovery and security needs come together across AD and Entra ID environments. Look elsewhere if a free tier, published seat-based price, or fully self-hosted service is central to your decision.