1. In the Admin console, open Directory > Users and select the correct account.
2. Choose the password-reset action and use the supported generated or custom password option.
3. Require a password change at the next sign-in where appropriate, then save the reset.
4. Deliver initial access privately to the verified user through an approved route.
5. Review the user's security settings and reset sign-in cookies as appropriate, especially when compromise is suspected.
6. Have the user sign in, complete their second factor and choose their own strong password.

For a compromised account, review active sessions, connected applications, forwarding, filters and recovery information. An attacker may have created another way to read messages or act on the user's behalf. Preserve relevant evidence before deleting suspicious settings when an investigation requires it.

A 2-Step Verification problem or a Google login challenge can remain after the password changes. Use the appropriate recovery procedure rather than resetting the password repeatedly. If your organisation uses an external identity provider, check where the authoritative password is managed.

Use the supported Google OAuth sign-in flow for mail and other clients. Avoid enabling obsolete less-secure authentication to make an old application work. Confirm the user can access browser Gmail before troubleshooting a particular device.

Record the account, authorised requester and completion time without storing the temporary password in an ordinary ticket. If the account must remain blocked during an investigation, coordinate the reset with suspension and the planned recovery owner.

• Helping a Google Workspace user who has lost a second factor
• Reviewing third-party app access in Google Workspace
• Reviewing Gmail forwarding and keeping an authorised copy
• Suspending a Google Workspace user while preserving business data

• Google Workspace password resets
• Google Workspace user security controls