I have the password question and answer policy enabled on my DNN instance (7.4.0).  I recently had a user who forgot the answer to their password question.  There are therefore not able to login as they don't remember their password nor do they remember their password question's answer to reset the password.

I see no way to reset the user's password answer through the interface.  I also looked through the DNN core code, specifically the user controller code, and saw no public methods which would allow me to create a utility to programmaticlly reset the user's password question's answer.  All of the public methods required some piece of the missing information (password or answer) to reset the other piece.

So this means if a user forgets both their password and answer their account is totally hosed and they have to create an new account.  Am I missing something here, or does anyone else know of a way to to correct this issue?

I'm sorry however that does not appear to be the case.  When I login as a super user, I select a user in the user roles and management module, go to the "Manage Password" tab, and a message states: Your configuration requires the user to enter a Question and Answer for the Password reminder. When this setting is applied Administrators are unable to change a user's password, so the feature has been disabled for this website.

When the password question and answer policy is enabled, I see no way as an administrator nor as a developer to reset either the password or the password question's answer.  Again, the problem here is that if the user has forgotten both their password and answer there appears to way to rescue the account.

this is not an oversight, simply the way that Microsofts API works i.e. if question and answer is enabled then it is required, as an admin will not know the Q&A we simply don't offer the option. Whilst it would be possible to "hack" a solution (as Sebastians script does), we're wary of adding too many "hacks" to membership as we hope to move to a more modern membership system (asp.net identity) and each hack add's more complexity to that move

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US