Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I am wondering if there is a way to find out who did a password reset. Interestingly the user profile is SSO enabled.
Sub :- "Finish resetting your Salesforce password"
'Salesforce recently received a request to reset the password for the username abc@abc.com. To finish resetting your password, go to the following link. This link expires in 24 hours"
If you didn't ask for your password to be reset, contact your Salesforce administrator.
Any help would be highly appreciated.
The Setup Audit Trail should have that information.
The setup audit trail history helps you track the recent setup changes that you and other administrators have made to your organization. Audit history can be especially useful in organizations with multiple administrators.
To view the setup audit trail history, from Setup, enter View Setup Audit Trail in the Quick Find box, then select View Setup Audit Trail. To download your organization’s full setup history for the past 180 days, click the Download link. The setup audit trail history shows you the 20 most recent setup changes made to your organization. It lists the date of the change, who made it, and what the change was. Additionally, if a delegate (such as an administrator or customer support representative) makes a setup change on behalf of an end-user, the Delegate User column shows the delegate’s username. For example, if a user grants login access to an administrator and the administrator makes a setup change, the administrator’s username is listed.
Anyone that is not a Delegated Authentication user can request a password reset here: Forgot Your Password (or on Sandbox, etc). All it requires is that someone knows your username. Even if the user is a SSO user, they can still request a password reset, as SSO is only an alternative method for logging in. You can even tell me your username, and I can "reset" your password for you. Note that the form only sends the email that allows a password reset; the original password remains intact until the link is used.
There's no way to tell who requested it, because, obviously, the form is public-facing and can be used by anyone, even if they don't have a salesforce.com account. Of course, they'd also need to have access to your email, possibly your mobile device, and know your security answers in order to get in, so this form is still reasonably secure. Unfortunately, you can't know who sent it. The best you can do is to delete the email.
