We should be implementing Softerra's Adaxes over the coming weeks and months.
One of the things it does is self service password reset, which with 500 or so users seems like it will have its place.
It seems like it's something that's very powerful and very easy to implement in haste and then regret not having planned out how to do it.
Whether to offer the capability from outside of the LAN is a big question - obviously people forget passwords whilst offsite but exposing the password reset website to the public internet is a concern.
So, to those of you who offer self service password reset, what's your policy and process and what pitfalls have you encountered?