It sounds like this is targeted at machines that are attached to Active Directory, in which case the fallback is the same as before (you call a help desk/sysadm

It sounds like this is targeted at machines that are attached to Active Directory, in which case the fallback is the same as before (you call a help desk/sysadmin, and they "reset your password" aka verify your identity and give you a new security key).