User Approval

How can I have an open registration but approve all registered users first?

You need to make use of the ACL feature, the registernotify setting and the defaultgroup setting.

For example to deny any access to anonymous users, read access to registered users and write permissions to approved users configure your ACLs like this:

*   @ALL     0
*   @users   1
*   @members 4

Newly registered users will be placed in the default group user and a notification will be sent to the admin (configured via registernotify). To approve a user the admin then goes to the usermanager and adds the new user to the members group.