Lockouts are not a failure of 2FA - they are a normal Tuesday. A phone is replaced, a number changes, a password is forgotten. Every lockout in this system has a safe admin-side recovery. Here is each one, honestly, including the single password nobody can reset for you.
The worst response to a lockout is panic: switching 2FA off for the whole office because one person cannot sign in. Resist it. Each piece of this system - the TSplus enrolment, the Tally.NET password, the Tally company user password - has its own recovery path, and they are different paths. Work out which lock the person is stuck at before touching anything.
This is the common one, and TSplus documents it directly. In the two factor authentication administration application:
The old enrolment stops working from the reset. Verify the person first - in person, or on a number you already know - because a reset hands the next login a fresh enrolment, whoever performs it.
If the user receives codes by SMS and they stop coming, do not reset blindly. Select the user and click Edit: check the phone number on the record (a changed SIM or a typing error is the usual cause) and correct it, or switch the delivery method to EMAIL or the app. Remember SMS delivery runs through a Twilio account - if codes fail for everyone at once, the problem is that sending account or balance, not Tally and not the users' phones.
For Tally's own remote access, the recovery is self-service: at the Login As Remote Tally.NET User screen, press F5 - Reset Password. The new password is sent to the registered e-mail address. Two consequences follow. First, the user must still control that mailbox. Second, if they do not, the account administrator has to fix the ID from the Tally account side - there is no way around the mailbox, by design.
Inside TallyPrime, passwords are never displayed to anyone - not even the administrator. What the administrator can do: sign in as the Owner/Admin, open Alt+K → Users and Passwords, select the user and set a new password. Hand it over privately and let the user change it (the password policy can permit users to change their own password). Any tool or person claiming to "show" you the existing Tally password is not describing how Tally works.
Be honest with yourself about the hard case: if the company Administrator (Owner) password itself is lost and no other admin-level user exists, TallyPrime gives you no self-service reset. Recovery then needs help from Tally Solutions or an authorised Tally partner. Prevention is the real fix: the owner keeps the administrator credentials recorded in a proper password safe, and at least the owner plus one trusted senior hold admin-level access, so a single forgotten password never becomes a company emergency. The same warning applies double to a TallyVault password - lose that and the company data stays locked, with no recovery route at all.
Three habits keep lockouts boring:
The setup video is the other half of this page - watch it so the recovery steps here match the system you actually built.
▶️ Watch Full VideoNo. Enrolment reset is an administrator action in the two factor administration application (Manage Users, then Reset). The user's part starts at the next login, when the fresh QR code appears for their new phone.
No. The reset clears the user's authentication settings, so the old entry no longer produces acceptable codes. The new QR enrolment on the new phone replaces it.
Add the user again under Manage Users in the 2FA administration application. They will go through the same first-login QR enrolment as a new user. If the person had left the company, though, treat the mistake as a warning and re-check your leaver list instead of re-adding them.