Mass pass change or require pass change on login
 

Hi there,

Recently my users passwords were compromised by a plaintext phisher that was put into the login files.

How can I
a) change everyones password and email them the new one
or (probably easier)
b) require them to change their password when they log in

Thanks

Set a password expiry, maybe?

What should I set it at?

Just thought of a flaw in the password expiry theory:

The person who planted the phisher still has nearly everyone who logged in in the past few days's passwords, and if I set a password expiry, he can just come on and change their passwords before they do.