ADSSP "Unlock Account" Link Not Appearing

Occasionally, a user may report that the "Reset Password / Unlock Account" link is not appearing below the password field on the Windows login screen, despite the AD Self Service Plus client being installed on their computer.

We have determined that this can occur when the Duo authenticator app is also installed, causing a conflict.  The Duo app is installed for IT personnel with access to sensitive systems and apps (like Active Directory) and other employees who use FedLine and other programs.

Per ManageEngine, follow the steps below to create an exception, allowing the self-unlock tool link to appear despite the Duo app being installed simultaneously.

Registry Changes:

  * In HKEY_LOCAL_MACHINE\SOFTWARE\Duo Security\DuoCredProv, right click and create a new Multi-String Value and name it as ProvidersWhiteList

  * Double Click ProvidersWhiteList , enter the following value, including the brackets: {B80B099C-62EA-43cd-9540-3DD26AF3B2B0}

Say OK to any error message that pops up.

Add the DUO as a wrapping provider to the ADSelfService Plus as given below.

* Go to the registry of the client machine.

* In HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ZOHO CORP\ADSelfService Plus Client Software, right click and create a new string value and name it as WrappingProvider

* Double Click WrappingProvider, enter the following value, including the brackets: {44E2ED41-48C7-4712-A3C3-250C5E6D5D84}

The ADSSP self-unlock tool link should now be appearing on the Windows login screen.

*If not, then proceed to Mange Engine's ADSSSP portal (https://wclels02.ffl.net:9251/) and uninstall/reinstall the client.

Configuration > Administrative Tools > GINA/MAC/Linux (Ctrl+Alt+Del) > GINA/MAC/Linux Installations > Search PC name under new or installed machines > then uninstall/reinstall. 

*Please note: check and verify on whether the registries on the PC or not. I they are not proceed to the steps above. If everything is correct, upon locking the PC, the ADSSP link should appear.