Options Manager -- Forgotten Password Utility

This option is set from the Profiles tab of the Options Manager interface.

One of the most common administrative tasks in running a message board is dealing with members who forget their password. Discus Pro provides a "Forgotten Password Utility" that allows members to reset their password to something new without troubling the moderator. If you do not enable this utility, or you are using freeware Discus, the only way for a user to reset their password is to request that a moderator do it.

Overview of password reset procedure

In Discus Pro, a user who has forgotten their password initiates the password recovery procedure by clicking on the "Click here to restore access" link on a log-in screen. They are then prompted to enter their username and/or e-mail address (in hopes that they remember one of these items). When their account is located, they are prompted for a new password for their account.

A confirmation message is then sent to the e-mail address on record, confirming the desire to change the password. This message contains a link back to the discussion board, which when clicked will activate the password and let the user continue using the board with their new password. An "activation key" is also provided to let users activate their new passwords manually in the event that their e-mail reader does not support clickable links.

Forgotten Password Utility options

Enable forgotten password utility: If you want to use the forgotten password utility, you must check this box. Checking this box automatically places a link to the forgotten password utility on most user interface log-in screens. If you are reading this documentation, presumably you wish to use this utility, in which case you must check this box.

Allow accounts awaiting e-mail activation to use utility: This is mainly useful when combined with the user self-registration system. An "account awaiting e-mail activation" will typically be a new member who has registered with your system but has not yet activated their account by clicking their activation key. This could also be an account that you have suspended with e-mail verification, perhaps because all of a sudden all e-mail messages to their address started bouncing. There is really no harm to enabling this option, and most administrators do for the convenience of their users.

Hide e-mail address when user chooses new password: By default, when a user's account has been found, their username and e-mail address are shown as they type in a new password. If you do not want the e-mail address to be shown on this screen, check this box. This box does give a higher degree of security to your users.

Hide username when user chooses new password: By default, when a user's account has been found, their username and e-mail address are shown as they type in a new password. If you do not want the username to be shown on this screen, check this box. Hiding the username really does not accomplish much, so it is recommended that you leave this box unchecked.

Require e-mail address to be entered to use utility: By default, a user can locate their account by typing in either their username or their e-mail address. If you check this box, the user must enter their e-mail address to use the utility. To maximize the likelihood that the user will succeed in resetting their password without bothering you, leave this box unchecked. To maximize security in using this utility, check this box.

Require new password to be entered at time of activation: In the event that a malicious person would go into the password reset utility and enter a new password for username, the person whose account would be affected by the change will receive the e-mail verification notice. The option to require re-entry of the password exists for those users that do not read instructions but blindly click on any link in an e-mail message. It is a bit more inconvenient for your users to reset their password if you enable this option, but it does insulate you from those who do not read the instructions (and then blame you for their subsequent problems).

Require username to be entered to use utility: By default, a user can locate their account by typing in either their username or their e-mail address. If you check this box, the user must enter their username to use the utility. As a user who has forgotten their password typically has forgotten their username too, this box should be left unchecked to maximize the likelihood that the user will succeed in resetting their password without bothering you.