Approve all existing users en-masse to facilitate enabling "must approve users"

That should, in theory do the trick, as always try on a backup first.