People enter the passwords wrong, account gets locked, uncheck a box that says it's locked and they are good to go. Any time something suspicious happened we had to fill out an incident report, which was a long form that was overly complex and was almost never followed up on.
Enter stage right, Martha, a very friendly woman who calls me and says she is unable to get into her account. My boss had all my accounts turned off and my last day is today so I really need to get back in there and grab some stuff." You wouldn't think I would have to do them that often, what could happen when I'm getting calls because people don't know how to turn on their computer? Start to fill out the quick incident ticket to track what I've been doing before I finish, when she whispers "Could you hurry? Call her boss and tell him what's happening and then hear on the other end when she's escorted out of the building.
