A system comprising: a processor; and a computer-readable storage media storing instructions that, when executed by the processor, cause the system to automatically manage a reset operation for a managed device by: determining that the managed device does not include a hardware authenticator for re-enrollment of the managed device on a network after reset of the managed device; upon determining that the managed device does not include the hardware authenticator, generating a one-time password for use by the managed device in re-enrollment of the managed device in the network following the reset operation; issuing the one-time password to the managed device, wherein issuing the one-time password to the managed device further comprises instructing the managed device to install the one-time password in a persistent storage area such that the one-time password persists through the reset operation; receiving an authentication request from the managed device following the reset operation, the authentication request including a post-reset password; and validating the post-reset password against the issued one-time password to confirm re-enrollment of the managed device in the network. a processor; and a computer-readable storage media storing instructions that, when executed by the processor, cause the system to automatically manage a reset operation for a managed device by: determining that the managed device does not include a hardware authenticator for re-enrollment of the managed device on a network after reset of the managed device; upon determining that the managed device does not include the hardware authenticator, generating a one-time password for use by the managed device in re-enrollment of the managed device in the network following the reset operation; issuing the one-time password to the managed device, wherein issuing the one-time password to the managed device further comprises instructing the managed device to install the one-time password in a persistent storage area such that the one-time password persists through the reset operation; receiving an authentication request from the managed device following the reset operation, the authentication request including a post-reset password; and validating the post-reset password against the issued one-time password to confirm re-enrollment of the managed device in the network. determining that the managed device does not include a hardware authenticator for re-enrollment of the managed device on a network after reset of the managed device; upon determining that the managed device does not include the hardware authenticator, generating a one-time password for use by the managed device in re-enrollment of the managed device in the network following the reset operation; issuing the one-time password to the managed device, wherein issuing the one-time password to the managed device further comprises instructing the managed device to install the one-time password in a persistent storage area such that the one-time password persists through the reset operation; receiving an authentication request from the managed device following the reset operation, the authentication request including a post-reset password; and validating the post-reset password against the issued one-time password to confirm re-enrollment of the managed device in the network.