The FIM Self Service Password Reset deployment is explained very well on the following TechNet site: http://technet.microsoft.com/en-us/library/ee534892(WS.10).aspx More specific I was following the steps to implement delegation so that Helpdesk users can unlock people for SSPR. Although the guide is very detailed I had a minor issue with it. More specific during the execution of “Step H5: Create an MPR enabling helpdesk users to read password reset users”.

The problem I had was that when my Helpdesk test user click edthe search button in the portal to locate users, no results were retrieved. At least except for his own account.

The steps where things go wrong: In Resource Attributes, select Select specific attributes, and then enter Resource Type and DisplayName. Click the validate icon, and then click Finish. [EDIT: also select Resource ID see bottom]

In fact you should click the browse button, select users (search within) and then enter Resource Type & DisplayName and select both. This will ensure you get the attributes of the user class.

My source for this solution: Joe Stepongzi on http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/a1bf7c7b-97d3-4d90-aeac-3a430a86a47a

In a following post I plan to explain how to enable the UI for Helpdesk users to be actually able to see the “Unlock Users” shortcuts as this is currently missing from the TechNet procedure.

[Edit 30/09/2010] I altered the title as I came upon a second minor issue:

Besides selecting Resource Type and DisplayName you also have to select the attribute Resource ID. When I left the Resource ID out, I got an access denied when clicking a user to view whether it’s locked or not. Enabling the MPR User management: Users can read selected attributes of other users” made it work. Well I didn’t wanted this policy to be enabled. I just wanted the Helpdesk to be able to unlock other users, not read all their attributes. So I started eliminating and finally got to the Resource ID attribute.