The ticket: Forgot my Windows password – now locked out
At dont, Tier 1 is delegated Reset Password on DONT › Staff. Domain Admin isn't needed.