How can i force all users to change their password the next time they login?

[webuser99]

My forum DB was recently compromised, and I am worried that the attacker may have copied the DB to his harddrive, and can get all my users passwords.

How can I force all users to change their password the next time they login?

Please let me know asap, whether it's a plugin or whatever.

I would like something relatively easy to do, but please be descriptive.

Thank you very very much, I am awaiting a response before i put my forum back online.

Webuser99

[Phornixx]

I don't really know if that hack exists but you can force them to read a thread, just search for that, I think that if the users want their accounts will change their passwords.

[blind-eddie]

Go to you Admincp/Usergroups/Usergroup Manager, click on desired Usergroup.
In the very first section, you will see the line that reads,

Password Expiry
(If you specify a number of days here, users will be required to change their password when this amount of time elapsed since they last changed)

Change that number to a very low number, If you have one set there.
Send a mass email to all members informing them of site related items.
Not the issue at hand.
This will get them to your site & see the pop up that tells them that their password is now expired.

Monitor your site a day or so, then up the number you set in the Password Expiry to what ever you wish.

Note, this will need to be done to all usergroups with site privileges.

[ssslippy]

Remember passwords are encoded in the database I dont believe its possidble to recode the password.

[Dismounted]

Originally Posted by ssslippy

Remember passwords are encoded in the database I dont believe its possidble to recode the password.

It's actually called "hashing" - because it is one way only. And yes, all passwords in the database are encrypted and cannot be quickly or easily changed back into plain text. In fact, a decent password would probably take years to find.

The attacker could have just replaced the password hash - that would allow him access.