If a Google Workspace user loses access to their second factor, use the supported recovery process after verifying their identity. Changing the password alone may not resolve a 2-Step Verification requirement or a separate Google login challenge.
IN THIS ARTICLE
01 Identify the blockage
Ask for the non-secret error text and whether the user still has an approved backup factor. Never ask them to send a one-time code from an unexpected prompt. Check whether the account is suspended or uses an external identity provider, since those conditions need different action.
- Have the user try an existing approved backup method or recovery code if available.
- If administrator help is needed, use an administrator with the required User management privilege. Open Directory > Users, select the affected user, then open Security > 2-step verification. These settings are available when 2-Step Verification is enforced or enabled for the account.
- Choose Get Backup Verification Codes and use one eligible code through the approved private recovery process. Only a super administrator can generate backup codes for another administrator account. Follow the organisation's security-key requirements and any applicable recovery grace period.
- Deliver recovery access privately to the verified user and have them sign in promptly.
- Replace the lost factor and review other enrolled factors. Remove an old device or key when it should no longer authorise access.
- Test the new factor and arrange a separate protected backup method.
What should I do if a Google Workspace administrator is locked out?
Use another authorised administrator with the necessary privileges. If none can assist, follow Google's official administrator account recovery route and provide the ownership evidence requested. Nabtech billing access does not automatically bypass Google's organisation security.
02 Do not leave recovery unfinished
After access is restored, review sessions and suspicious activity if the device was lost or stolen. A temporary recovery step should end with a working approved factor, not an indefinitely weakened account.
Keep the support record limited to the identity check, account, action and time. Recovery codes, secret keys and screenshots containing live authentication material should not remain in an ordinary shared ticket or knowledgebase attachment.