Hi all, Thanks for the input! In summary: Stephan suggested an rpm triggering early in the chain (on filesystem) that drops the login.defs. While this would be a cleaner solution, I already had the shadow-utils package out and rebuilding to understand what it was doing, so took the easy route of just changing the values in it. (still had to invoke the overhead of making my own custom install repo, which at least was educational). This worked. Chris asked I I was sure the %pre won't work? Yes. Tried it. One alternate way to make it work would be to not have kickstart do any partitioning, formatting etc, and do all of that manually in %pre, followed by dropping login.defs afterwards. But, one big reason to use kickstarter is to use its tools to do that rather than scripting it manually. But, that is an alternate route. Many good suggestions and scripts for fixing the IDs globally once and for all. Given that I'm simply adding a few new student workstations as sl7 clients to a larger sl6 cluster, I'll wait till updating the servers to make this move. I agree though this is the right longterm solution. Thanks again! Alec -- Alec Habig University of Minnesota Duluth Dept. of Physics and Astronomy [log in to unmask] http://neutrino.d.umn.edu/~habig/