Best tool for remote users who lock themselves out of their Windows laptop?

Of course the question is: in your case, do they still have internet access without being able to logon.
If yes, some remote control software will do, like remote desktop. If no, there is only the way to give them access to another local account that you setup already with a strong password.

One option is you can log into VPN via PPTP and that way you are on the network.  So you could reset the password.  I've used this in the past but I'm not fond of PPTP and not sure if these pre-logon with PPTP is even available in Vista or Win7.  

Yes McKnife - we could put another account on the machine and just hand out that password as needed - when we run into this situation.  

Yeah until we moved to AD we just had a local system administration group, if a user forgot their password you can still connect to their PC via VNC etc then login using the sysadmin username/password and reset the users local account.

Not the ideal situation for you as it would mean changing your pc/laptop images but maybe something to keep in mind for future.

Here:
http://www.symantec.com/norton/symantec-pcanywhere
 

I think andoss has the best Idea. He's right not ideal, but neither is the situation.

So Dameware/pcAnywhere are good ideas except that...a user that's locked out of their system is not going to be able to determine their own IP address.  (e.g. via whatismyipaddress.com).  And second Dameware is a security hole.  Is there anything out there where you could have your laptops - a service that "phones in" to a server in your DMZ.  And then you could control them centrally if needed?

arixsin: Does logmein allow you to access your users systems without knowing the user's IP address and without their being able to get to their own GUI?  It sounds like that's the case but just verifying.

I looked into this solution.  This definitely does what we're looking for.  Thanks.

Weird, I don't think Logmein would help at all. They need access to the internet browser, sooo that won't work.

VNC, however, you can connect to them and see the login screen. But hey, what the heck do I know?

again, Logmein Will NOT let you connect to the user without getting to the gui. Unless you preinstall it on the computer, in which case I think VNC+VPN is better.

I like control, so that's prolly where my opinion is coming from.

My understanding is logmein Pro is an agent that phones home to logmein servers.  So that even if the user forgets their password the logmein service will allow me to the laptop.  So they say.

Logmein Pro is most certainly not free though as described. While VNC is if you only need to support Windows clients.

You would also still need some form of admin account on the local machine to be able to reset user passwords anyway.

To use VNC the user would have to tell us their IP address and they'd have to open their firewall home firewall.  If they're locked out of their system - these are non-starters.  LogmeinPro is like $40 to $50 per laptop per year depending on how many you cover.  

Having an admin account on the users machine is OK.  We just don't want to have to tell the user what the admin user password is.