You must enable the smartphone recovery functionality in ePO - On-prem if a user forgets the PBA password and requires to reset it.
The client system prompts for authentication on the pre-boot logon page to access the system. When a user forgets the password, is disabled in the Active Directory, or loses the token, the user can't log on to the system.
Resetting the user’s password, unlocking the disabled user, replacing a lost logon token, and performing system recovery require a challenge and response procedure. The users must start their system and click Recovery on the Drive Encryption pre-boot logon page. This option needs to be enabled on the ePO - On-prem server before performing this task on the client systems.
Use ePO - On-prem to enable or disable the administrator (system and user) recovery functionality on the client computer.
Click → → , then select a group from the System Tree.
Select a system, then click → → to open the Policy Assignment page for that system.
From the Product drop-down list, select Drive Encryption 8.x. The policy categories under Drive Encryption display the system's assigned policy.
Select the Product Settings policy category, then click Edit Assignments to open the Product Settings page.
If the policy is inherited, select Break inheritance and assign the policy and settings below next to Inherit from.
From the Assigned policy drop-down list, select a product setting policy, then click Edit Policy to open the Product Settings page.
From this page, you can edit the selected policy, or create a new policy.
On the Companion Devices tab, enable or disable the Enable Companion Device Support option to perform system recovery through smartphone.
Click Save.
Select the User Based Policies policy category, then click Edit Assignments to open the User Based Policies page.
If the policy is inherited, select Break inheritance and assign the policy and settings below next to Inherit from.
From the Assigned policy drop-down list, select a user based policy, then click Edit Policy to open the User Based Policies page.
From this page, you can edit the selected policy, or create a new policy.
On the Companion Devices tab, enable or disable the Recovery option to perform system recovery through smartphone.
Select the required Password Definition option to create a password according to the option selected.
If the user has once set a higher password definition to the system, the user cannot change the password to a lower password definition (that is less secure) even if that policy is set in ePO - On-prem.
Click Save on the User Based Policies page.
Send an agent wake-up call.