User List Rules

By definition, a user with a Status of Active has a Security record and can login. If the user does not have a Security record you can add on including assigning a password and one or more Security Groups. This will toggle their account to Active and they can immediately log in. You can either tell the user their password, or have them click the Recover Password link on the Login page. There is no built-in method for you to email the user their password once a Security record has been set.
Other rules:

If you remove a user's Security record, they will toggle from Active to Inactive.
If you delete a user from the User List, they will be deleted from Security as a result and cannot login.
If you modify the User ID in the User List, it will update that field in Security Framework. The other fields (name, dates, etc.) are not in Security Framework.
Export a list of users by clicking the "Excel" icon.

ACTIVE - A normal user who can login. By definition, a user with a Status of Active has a Security record with a password and assigned to one or more Security Groups.
INACTIVE - User does not have a Security record and cannot login. User was either added manually or their existing Security record was deleted.
PENDING - User does not have a Security record and cannot login. They have started the registration process but not clicked the "confirmation link" in the email sent to them to confirm their registration. You can manually enter a Security record, or wait for them to confirm, or toggle them to Invite to send a reminder.
INVITE - User does not have a Security record and cannot login. Typically, these users were added manually and then toggled to Invite. Or they were Pending and toggled to Invite. You can send an "invitation" to all users with a status of Invite in the Send Email to User module. You can only send an invite to user who do not have a Security record. If the user was Pending, they will have entered their own password at registration. If the user was originally not Pending, they will not have a password set, so the Invite process will generate a new password for them, and include it in the invitation email.
LOCKED - A user who has been locked (cannot login) for an indefinite period of time. You can click Unlock to return them to Active status.