When the user forgets the password, the server manager can only change one new set of password since server manager will never know the user's password.