Question refinement
This is a pretty tricky question, especially the "... no login at all ..." part of it. IMO you have to allow at least somebody with some specific role to perform a login ... If you don't, then even an admin (or user/1
) cannot login. Which also implies you can't just deny access to the login URL for everybody (how else would an admin perform a login?).
Proposed solution
Below is a solution to "kick everybody (except admins) out right after login, but only after you send such user an appropriate eMail".
Here is the rule (in Rules import format) that should answer your question:
{ "rules_redirect_to_logout_except_for_role_id3" : {
"LABEL" : "Redirect to logout except for role ID3",
"PLUGIN" : "reaction rule",
"ACTIVE" : false,
"OWNER" : "rules",
"REQUIRES" : [ "rules" ],
"ON" : { "user_login" : [] },
"IF" : [
{ "NOT user_has_role" : { "account" : [ "account" ], "roles" : { "value" : { "3" : "3" } } } }
],
"DO" : [
{ "mail" : {
"to" : "[account:mail]",
"subject" : "No login allowed",
"message" : "You just completed a login to [site:name], located at [site:url].\r\n\r\nHowever, at this time we do not allow any login ...\r\n\r\nThanks anyway for validating some of your account data, such as your eMail ID.",
"language" : [ "" ]
}
},
{ "redirect" : { "url" : "user\/logout" } }
]
}
}
The rule will be triggered (Rules Condition) right after login was completed. For any user who does not have the role that matches "role id = 3
" (= Rules Condition), aka for any user who is not an administrator, it will perform these Rules Actions (in the order specified):
- Send an appropriate eMail to the user that completed the login (since the user is logged in, you have the user's eMail Id available as part of the user's account info).
- Redirect to the page
user/logout
(= force the user to be logged out again).
If you have the Rules UI enabled, you can just import the above rule and adapt the value (=3) of the role id to fit your needs. With that you solved your question.
Obviously, you'd have to adapt the eMail subject and content to fit your needs. Possibly you may also want to use some other (or additional) role IDs that you want to allow to login anyhow.
With the above approach, all what's left to do to fully answer your question, is to create an inventory (a view?) of all users and check their last login date. Those accounts that were created X hours/days ago but for which no login was completed ever, are the fake users you're looking for (because the eMail ID they entered during registration was invalid, or such users didn't really want to get registered so they never confirmed their registration request via an appropriate, temporary, login).
Note: by default the rule is disabled (so don't forget to enable it also).
Visitors, but administrator approval is required
option on/admin/config/people/accounts
page work for you?