Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To stop someone taking over a helpdesk account, secure two separate points of attack: the authentication and recovery event, and the authenticated session that follows it. Require phishing-resistant MFA for helpdesk and privileged identities, make factor replacement an independently verified process, protect cookies and tokens throughout their lifetimes, and monitor sessions so suspicious access can be terminated quickly.
MFA improves the login decision but does not invalidate a stolen session cookie or refresh token. Conversely, strong session controls cannot compensate for a helpdesk agent who can be persuaded to reset a factor for an impostor. The controls below are designed to close both gaps.
What a hardened helpdesk account must protect
Authentication and session theft are different incidents
Authentication establishes that a person or device may start a session. A session cookie, access token, or refresh token then represents that authenticated state to applications. An attacker who steals a valid session secret may access a service without repeating the original MFA ceremony. National Institute of Standards and Technology (NIST) guidance notes that access and refresh tokens can remain valid after an authentication session ends.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThat distinction determines the response. A password change or MFA reset addresses future logins, but it may leave relying-party sessions and tokens active. A complete control plan therefore covers login, recovery, session issuance, session use, revocation, and detection.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The control sequence
| Layer | Primary objective | Examples of controls |
|---|---|---|
| Authentication | Prevent an impostor from obtaining a valid authenticator output | FIDO2/WebAuthn or organization-supported PKI; MFA required for reset-capable identities |
| Recovery | Stop social engineering from replacing a genuine factor | Independent identity verification, separation of password reset and factor replacement, approval and notification |
| Session | Reduce the value and lifetime of stolen session secrets | HTTPS-only and HttpOnly cookies where practical, narrow cookie scope, inactivity and overall timeouts, logout and revocation |
| Detection | Identify unusual use and trigger containment | Timing, velocity, device/browser, geography, and IP risk signals |
| Response | Contain an active takeover | Terminate sessions, revoke tokens, restrict the account, re-establish identity, and review actions |
Require phishing-resistant authentication for helpdesk and privileged users
What “phishing-resistant” means
NIST defines phishing resistance as preventing an impostor verifier from obtaining valid authentication secrets or outputs without relying on the claimant’s vigilance. Verifier-name binding, as used by WebAuthn, ties the cryptographic response to the legitimate site or service.
NIST’s July 2025 SP 800-63B-4 states: “Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated.” An attacker can relay a manually entered one-time code to the real service, even when the code is technically valid.
Choose methods by threat and deployment constraints
| Method | Phishing and relay resistance | Operational considerations |
|---|---|---|
| FIDO2/WebAuthn security key | Strong when correctly registered and used with a compatible identity provider | Requires spare-key, enrollment, loss, and compatibility procedures; confirm support across the helpdesk platform, browsers, and endpoints |
| Platform WebAuthn authenticator | Strong verifier binding when the platform and identity provider support it | May avoid a separate key, but recovery and device replacement must be planned |
| Organization-supported PKI authenticator | Can provide cryptographic authentication without manually relaying a code | Certificate issuance, renewal, revocation, and endpoint support become operational dependencies |
| Number-matching authenticator app | Better than an unconfirmed push, but not equivalent to phishing-resistant cryptographic authentication | Useful as an interim or fallback method where stronger methods are not yet available; monitor for push-fatigue attempts |
| OTP application or out-of-band code | Not phishing-resistant under the NIST definition because the output is manually entered | Use only with an explicit migration plan and additional risk controls |
| SMS or email code | Weaker option; exposed to phone-number, mailbox, and relay attacks | Do not use as the preferred factor for reset-capable or privileged accounts |
CISA guidance presents physical security keys as a strong choice, number-matching applications as an alternative, and SMS or email codes as weaker options. This hierarchy helps select a method; it is not a guarantee that any factor prevents every form of account compromise. If a system cannot yet support phishing-resistant authentication, deploy its strongest available method, document the exposure, and prioritize migration rather than describing push approval or OTP as phishing-resistant.
Scope the requirement to the accounts that can cause the most damage
- Require MFA for every helpdesk identity that can reset passwords, reset or register authentication factors, access customer or employee records, change group membership, or administer an identity provider.
- Apply the same or stronger requirement to emergency, break-glass, and delegated-support accounts. Keep emergency credentials separate from normal agent accounts and monitor their use.
- Prevent shared accounts. Individual identities make approvals, session termination, and post-incident review attributable to one person.
- Enroll at least one approved spare authenticator through a controlled process, while ensuring that possession of a spare does not bypass identity verification during a recovery request.
Make recovery and factor replacement resistant to social engineering
Treat a reset request as an authentication flow
NIST warns: “The weak point in many authentication mechanisms is the process followed when a subscriber loses control of one or more authenticators and needs to replace them.” A caller who sounds convincing, knows internal terminology, or supplies a password has not necessarily proved control of the account.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not accept caller ID, a manager’s name, knowledge of internal facts, urgency, or possession of a password as sufficient proof on its own. Use a registered, independent channel or an approved identity-verification workflow. The verification route must not depend on the same factor the requester claims to have lost.
Use this controlled workflow for password resets and MFA changes
- Classify the request. Record whether it is a password reset, lost-authenticator recovery, new-factor registration, account unlock, or a combination. Factor replacement deserves higher scrutiny than an ordinary unlock.
- Pause normal service assumptions. Do not let an agent bypass verification because the requester is locked out, traveling, under deadline, or referred by a senior employee.
- Use an approved independent proof. Verify through a registered channel or the organization’s documented identity-proofing process. A channel controlled by the requester during the call is not independent merely because it is different from the helpdesk phone line.
- Keep one factor from authorizing another. A password alone must not authorize registration of a new MFA factor. Do not use a single compromised factor to obtain its replacement.
- Escalate privileged cases. Require a second approver or a designated security workflow for identities that can administer accounts, alter authentication policy, or access sensitive records.
- Record the decision. Capture the requester identity, verification method, agent, approver, reason, time, factors affected, and any exception. Logs should show who approved the change, not merely that a ticket was closed.
- Notify through a known channel. Tell the account owner that a password or factor changed using contact information already on file, not an address or number supplied during the request. Include a way to report an unauthorized change.
- Limit the recovery result. Issue the minimum access needed to restore the account. If policy allows a temporary credential or factor, impose its documented restrictions and require normal enrollment afterward.
- Review for active sessions. When a credential or factor is changed, terminate relevant application sessions and revoke applicable access and refresh tokens rather than assuming the change did so automatically.
- Close only after confirmation. Confirm that the legitimate user can authenticate through the approved method, and preserve the record for later investigation.
Train agents to resist pressure
Agents should stop and escalate when a requester asks to bypass checks, register a new factor immediately, disclose an OTP, approve repeated prompts, or keep the request secret from the account owner. Role-play should include authority pressure, urgency, plausible internal details, and claims that a normal channel is unavailable. NIST recommends periodic training so subscribers and staff can recognize attempted compromise and know how to report it.
Protect authenticated sessions and tokens
Issue and end session secrets deliberately
Session secrets should be issued in response to successful authentication, protected while in transit and at rest, and invalidated when the user logs out. NIST recommends that session secrets be at least 64 bits and that applications enforce both inactivity and overall timeouts appropriate to their assurance level, role, endpoint, and risk. Those timeout values are policy decisions for the organization; NIST’s technical guidance does not supply one universal duration for every helpdesk system.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchProvide a visible logout or “sign out all sessions” capability where the platform supports it. Verify that it actually invalidates relying-party sessions and does not merely remove a browser-side reference. Include access tokens and refresh tokens in revocation testing because they can outlive the original authentication session.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set secure cookie and storage controls
- Serve session cookies only over HTTPS by setting the secure transport requirement.
- Use the narrowest practical domain and path scope so a cookie is not exposed to unrelated applications.
- Set HttpOnly where practical to reduce exposure to scripts running in the browser.
- Do not place session secrets in exposed browser storage such as HTML5 Local Storage.
- Protect session material from intermediaries and application logs. A token copied into a ticket, URL, analytics field, or troubleshooting screenshot becomes another credential to contain.
Consider device-bound sessions
Bearer tokens work for whoever possesses them. NIST describes emerging device-bound session credentials, including the Device Bound Session Credentials specification, as a way to require cryptographic proof of possession instead of accepting possession of a copied session secret alone. In NIST’s words: “Some technologies (e.g., the emerging device bound session credentials specification [DBSC]) mitigate the risk of theft of session secrets by using cryptographic protocols that prove the possession of a session secret rather than using them as bearer tokens.”
Device binding can reduce the value of a copied token, but it does not remove the need for inactivity and overall lifetime limits, secure logout, revocation, and recovery controls. Confirm support in the identity provider, browser, and helpdesk application before making it a dependency.
Detect suspicious use without treating one signal as proof
Collect useful session signals
| Signal | What it can reveal | How to use it safely |
|---|---|---|
| Timing and velocity | Impossible travel, rapid actions, or an unusual burst of resets | Raise risk or require reauthentication; do not reject solely because a legitimate shift change can create a burst |
| Device and browser characteristics | A new or materially different client using an established session | Compare with known devices and require an approved challenge when risk is high |
| Geography | Unexpected country, region, or network location | Use as a risk indicator; account for VPNs, travel, and distributed support teams |
| IP characteristics | Hosting, anonymization, reputation, or network changes associated with abuse | Combine with identity and session context rather than treating an IP address as identity |
| Administrative actions | Unexpected factor registration, password reset, privilege change, or token creation | Alert the security or support team and retain enough audit detail to reconstruct the event |
NIST recommends session monitoring using timing, device or browser characteristics, geography, and IP address. These are risk signals, not definitive proof of fraud. A privacy risk assessment should cover what is collected, how long it is retained, who can access it, and how false positives are handled.
Make alerts actionable
A useful alert identifies the account, session or token, action, timestamp, client and network context, and the person or system that can contain it. Route high-risk events to a staffed queue rather than an unattended mailbox. Give agents a documented decision path: reauthenticate, terminate the affected session, revoke applicable tokens, notify the account owner, or escalate to security.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Contain a suspected takeover in the right order
- Restrict access. Disable or limit the account when active abuse is likely. Preserve the evidence needed for investigation before deleting records.
- Revoke active sessions and tokens. Terminate relying-party sessions and revoke access and refresh tokens associated with the account, device, or application. Do not rely solely on a password change.
- Re-establish identity through a trusted process. Use the approved recovery workflow, not the same phone call, email thread, or factor that may be compromised.
- Reset credentials and rebind factors. After identity is established, issue new credentials and register new authenticators under the same controls used for an initial enrollment.
- Review recent actions. Look for unauthorized password or factor changes, privilege grants, data access, ticket edits, exports, and new sessions. Preserve timestamps and actors.
- Notify the right parties. Inform the account owner, security team, and other stakeholders required by policy. Explain which sessions or factors were revoked and how the legitimate user can regain access.
- Close the recovery loop. Document the root cause, the control that failed, and the change that will prevent recurrence. Test revocation and notification rather than assuming the platform performed them.
Compare session-control implementations before deployment
Two systems can both advertise “session timeout” while providing very different protection. Evaluate each implementation against the following questions.
| Control area | Questions to ask | Evidence to require |
|---|---|---|
| Timeouts | Are inactivity and overall limits enforced server-side for every relying party and role? | Configuration and a test showing an idle and a maximum-lifetime session are rejected |
| Revocation | Can administrators terminate all relevant sessions and revoke access and refresh tokens? | A documented procedure and a completed revocation test |
| Cookie protection | Are HTTPS-only transport, minimum practical scope, and HttpOnly used where practical? | Application configuration and an inspection of issued cookies |
| Storage | Can session secrets appear in browser storage, URLs, logs, or support tickets? | Code or configuration review and a redacted logging test |
| Device binding | Does the platform support cryptographic proof of possession, and what happens on device replacement? | Compatibility documentation and a recovery test |
| Detection | Are timing, client, geography, and IP signals visible to responders? | An alert sample containing enough context for a containment decision |
Build an operating model for helpdesk staff
Administrator checklist
- Inventory every account and role that can reset credentials, alter factors, access records, or change privileges.
- Assign an owner for MFA policy, recovery policy, session policy, alerting, and incident response.
- Test phishing-resistant enrollment, spare-authenticator handling, logout, “terminate all sessions,” token revocation, and factor replacement in a non-production or controlled account.
- Set documented timeout and retention decisions by role and risk, and record the policy owner and review date.
- Ensure audit logs identify the agent, approver, account, factor, session or token, action, and time.
- Run periodic exercises that begin with a convincing recovery call and end with session and token containment.
Agent checklist
- Classify the request before changing anything.
- Use only the approved independent verification path.
- Never disclose or request an OTP for the purpose of proving identity, and never approve a factor change from a password alone.
- Stop when the requester pressures you to bypass a check, keep a change secret, or use an unregistered channel.
- Record the verification method and approver, and send the required notification through a known channel.
- Escalate suspected compromise immediately so sessions and tokens can be revoked while evidence is still available.
Common failure modes and fixes
“We have MFA, so session hijacking is solved.”
MFA protects the authentication event; it does not automatically invalidate a stolen cookie or refresh token. Add secure cookie handling, storage restrictions, timeouts, monitoring, and a tested revocation path.
“The caller knew the employee’s password.”
A password is one factor and may already be compromised. It cannot, by itself, authorize replacement of another factor or prove that the caller controls the employee’s registered recovery channel.
“We changed the password, but the attacker remained active.”
The application may have accepted an access or refresh token that outlived the authentication session. Terminate relying-party sessions and revoke applicable tokens as part of the incident procedure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“We block every unfamiliar IP address.”
IP and geography are imperfect signals. VPNs, travel, mobile networks, and distributed teams create legitimate changes. Combine network context with timing, device, browser, and administrative-action signals, then require reauthentication or human review when risk warrants it.
“Our push approval is phishing-resistant.”
Number matching can reduce accidental approvals and is an improvement over an unconfirmed push, but it is not the same as verifier-bound cryptographic authentication. Use WebAuthn/FIDO2 or an equivalent organization-supported cryptographic method where possible, and describe fallback methods accurately.
Governance, privacy, and scope
NIST SP 800-63B-4, published in July 2025, is U.S. federal technical guidance that can inform other organizations; it is not automatically a legal requirement for every employer or service. Adapt verification procedures, timeout values, notification rules, retention, and privacy controls to the identity provider, threat model, contractual duties, and applicable law.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Document the rationale for each control and review it when the helpdesk platform, browser support, workforce pattern, or recovery channel changes. Measure implementation rather than claiming an unsupported reduction percentage: track coverage of phishing-resistant methods, completion of recovery-verification records, successful session and token revocation tests, alert handling time, and recurring causes of escalated requests.
NIST also specifies that an out-of-band authentication secret must be completed within 10 minutes in the defined flow. That is a technical requirement for the specified authenticator process, not a universal timeout for helpdesk sessions. Keep such qualifications attached to the control where staff will use them.
A practical decision rule
When deciding whether a helpdesk request or session is safe, ask three questions in order: Did the person prove control of an approved identity factor through an independent path? Could an existing session or token still be active? Do the observed device, timing, geography, and network signals fit the expected use? A “no” or an unexplained risk signal should trigger the documented escalation and containment process, not an improvised exception.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
