HELP FILE

Reset a User's Master Password (Super Admin)

LastPass admins can enable the "Super Admin - Master Password Reset" policy for their account to allow designated admins to reset a user's Master Password. Once enabled, new user accounts will be able to have their Master Passwords reset, and existing users who are actively logged in will need to log out and log back in via the LastPass web browser extension before the reset option will become available to the admin.

Note: Active users must log back in via the LastPass web browser extension only, as logging in via https://lastpass.com will not activate the Master Password reset option for the admin.

Topics in this article:

How it works

Enable the policy

Force active user logoff

Reset a user's Master Password

Why don't I see this option?

How it works

When using this feature, there is a 3-step technical process involved, as follows:

Step #1:  Enable the "Super Admin- Master Password Reset" policy

When an admin enables the "Super Admin - Master Password Reset" policy, an asymmetric key pair (public/private) is generated for the administrator. The super admin's Public Asymmetric Key is sent to the LastPass cloud and stored. The super Admin’s Private Asymmetric Key is encrypted with the named super admin’s Symmetric Vault Encryption Key and sent to the LastPass cloud and stored.

Note: At this point during the process, the listed super admin does not yet have the ability to reset a user's Master Password.

Step #2: User login via the LastPass web browser extension activates the policy option

Next, a Key exchange occurs when the selected user (for which the Master Password reset should occur) logs in via the LastPass web browser extension (not the website). LastPass then downloads each super admin’s Public Asymmetric Encryption Key from the LastPass cloud. Each super admin’s Public Asymmetric Encryption Key is used to encrypt the selected user’s Symmetric Vault Encryption Key. The encrypted Symmetric Vault Encryption Key is then sent back to the LastPass cloud and stored (one for each super admin listed on the policy).

Note: At this point during the process, the listed super admin will have the option in the Admin Console to reset the Master Password for their selected user.

Step #3: Super admin resets the user's Master Password

When the super admin resets their selected user's Master Password, the target user’s encrypted Vault and the user’s encrypted Symmetric Vault Encryption Key are downloaded to the super admin's local computer. The super admin also downloads their own encrypted Private Asymmetric Encryption Key from LastPass. The super admin then decrypts their Private Asymmetric Encryption Key using their Symmetric Vault Encryption Key, and uses this Private Symmetric Encryption Key to decrypt the user’s encrypted Symmetric Vault Encryption Key. The super admin can then decrypt the target user’s encrypted Vault using the user’s Symmetric Vault Encryption Key. Next, the super admin selects a new Master Password that is hashed (along with a salt of the target user’s username) to create a new Symmetric Vault Encryption Key for that user. The user’s new Symmetric Vault Encryption Key is encrypted with the super admin's Public Asymmetric Encryption Key and replaces the old data in the LastPass cloud. The target user’s newly encrypted Vault is also sent to LastPass to replace the original Vault.

Enable the policy

  1. Log in and access the Admin Console.
  2. Go to SettingsPoliciesAdd PolicySuper Admin - Master Password Reset.
  3. Click Edit Users, then add all admins to the list that you want to designate as super admins that can reset Master Passwords for users. Note: All users you add to this list must be account administrators in order to be added.
  1. Click Save when finished.

Force active user logoff

You can force active users to log off so that the Master Password reset option will become available to you as follows:

  1. In the Admin Console, go to Users in the left menu.
  2. Check the box next to "Email" in the user pane to select all users, otherwise you can check the box(es) next to individual user(s).
  3. Click the More (...) hyperlink, then select Destroy all sessions for selected users.
  4. Click OK to confirm, and your selected users will be logged out of LastPass immediately.

Reset a user's Master Password

  1. In the Admin Console, go to Users in the left menu.
  2. Click on the email address of the user, then click the More icon and select Super admin master password reset.
  3. When prompted, click OK.
  4. Enter your own Master Password, then click Submit.
  5. Enter a new password, then re-enter it to confirm. Optionally, you can click Change the user's email to also update their LastPass username. You can choose to uncheck the box to disable the "Force password change on next login" option, as it is enabled by default for security best practices.
  6. When finished, click Submit.

Why don't I see this option?

If you have been added as a super admin in your account's policies and not seeing the "Super admin master password reset" option for a user, it may mean that the user has not yet logged out of their active LastPass session. You can force the user to log off, then advise them to log back in to their account via the LastPass web browser extension (not the website). Once they have done so, you can refresh the User page in the Admin Console and try again.