We use the, something you have and something you know approach.

Example:
===============
User forgets password.
User establishes an SSL (version 3) connection to the helpdesk server.
Helpdesk server asks end user for his badge ID # (something he/she has) and Social Security # (something he/she knows)
If all info matches, the password is reset to whatever the user sets it to and a log entry is made.
Logs are reviewed daily by the AD Admin who follows up via phone to ensure validity.

We also have a secret answer to a question the end user has supplied as a third method of validation.

Hope this helps out.