# must\_approve\_users on an existing forum

**URL:** https://meta.discourse.org/t/must-approve-users-on-an-existing-forum/39233
**Category:** Feature
**Created:** [8 Fevereiro , 2016 18:46 UTC](https://meta.discourse.org/t/must-approve-users-on-an-existing-forum/39233 "2016-02-08T18:46:06Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [8 Fevereiro , 2016 18:46 UTC](https://meta.discourse.org/t/must-approve-users-on-an-existing-forum/39233/1 "2016-02-08T18:46:06Z")

</div>

Continuing the discussion from [Going live tomorrow - need help](https://meta.discourse.org/t/going-live-tomorrow-need-help/39185):

> [@gokeeffe](#):
>
> So would like to know what exactly the warning message below means…this is in Settings \> Login
> 
> Staff must approve all new user accounts before they are allowed to access the site. WARNING: enabling this for a live site will revoke access for existing non-staff users!

I was thinking about this. Currently, enabling `must_approve_users` does two things:

- make sure that every user must have approved = true
- having all new users go through the manual approval process

This indeed causes existing users to be unable to login, since they never have been approved.

I was thinking about a good solution for this and first I considered approving all users that exist at the moment the setting is enabled, but that would cause all users in an existing approval queue to be approved when the setting is toggled off and on.

Instead, I think the right way to implement this is to make it mean 'all users must be approved **manually’**.  
I.e., during the time the setting is disabled, all users should be approved **automatically** and have (approved = true, approved\_by = System) upon email validation.

This would yield the same functionality but solve the issue that it is impossible to just turn this setting on without intervention in the database or using the API.

---

<div class="post-metadata">

### Author: ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [14 Fevereiro , 2016 12:58 UTC](https://meta.discourse.org/t/must-approve-users-on-an-existing-forum/39233/6 "2016-02-14T12:58:29Z")

</div>

@codinghorror, @sam do you have an opinion about this?
