1

I am running a private Drupal 7 site where all user accounts are created by admins and managers. I need to ensure that all users have access to the email account that their accounts were created with.

What is the best way to do the following:

  • Create a user account with an automatically generated password, and notify the new user of their password via email.

  • After a 4 week period, a new password must be generated for the user and set as their active password automatically. The user needs to be notified of their newly updated password via email, and the newly generated password must be used to access the site until it is reset again.

Are there any Drupal 7 modules that can help achieve this?

Any suggestions on building a custom module that can help resolve this?

Improve this question
4
  • 2
    Hate to be "that guy"...but if you're planning to send the password out over email, you'll never be ensuring anything. Far too easy to intercept
    – Clive ♦
    Jan 21, 2016 at 15:58
  • In many jurisdictions your plan is outright illegal. In some others, if you mail users' passwords you can't keep them responsible for anything they do - but they can hold you responsible for actions made using their accounts. What you plan to do is to give away their passwords on regular basis. You will be giving it to mailserver admins (both your and theirs), and potentially to anyone in the same open WiFi at coffe point your clients are. Not to mention anyone who can take a look at their screen over their shoulder. Are you damn sure that's what you want to do?
    – Mołot
    Jan 21, 2016 at 16:16
  • I don't mind "that guy" when he makes a lot of sense. What if its a one time login link instead of the actual password? The user is required to change their password imminently after log in through the link.
    – user1732920
    Jan 21, 2016 at 18:50
  • @user1732920 one-time login link is usually legal. But aren't you afraid it'll be a nuisance for your users?
    – Mołot
    Jan 22, 2016 at 10:19

2 Answers 2

Reset to default
4

This issue was talked about during the great Drupalgeddon. Because no such bulk reset tool existed for a site.

Here is a recently created tool to perform this task. Other such tools have existed since Drupalgeddon.

Mass Password Reset Module

This module allows users with "Administer users" permission to reset all user accounts and notify all users

Details

The module will reset the passwords of all users except the administrative superuser id 1. You can optionally reset the administrative superuser id 1. Once passwords have been reset, users will optionally receive emails using the Drupal password recovery email. The password recovery email content can be edited at the account settings configuration page.

Use Cases

You have a large number of user accounts pre-created and want to send password recovery emails to all users during a site launch. You need to quickly change all passwords on a site for security reasons.

Improve this answer
2

You can use the Force Password Change module too. Read the description:

This module allows administrators to force users, by role, individual user, or newly created user, to change their password on their next page load or login, and/or expire their passwords after a period of time.

Improve this answer
1
  • Interesting module suggestion, didn't know about this one yet (there are only 17K module, right?). Any idea how to "notify" the user(s) with this module (as in the question)? Or maybe something you could do in combintion with the Rules module somehow?
    – Pierre.Vriens
    May 2, 2016 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.