Just goes to show that controls don't matter if they don't actually control the problem. The fact that you would have "controls" that create user profiles with default passwords tells me somebody missed the point of the control in the first place. Joe
From: rob@xxxxxxxxx We have controls - extensive controls. Full workflow Notes based database that part of the work flow is that it has to go through a controller for approval, etc. Still doesn't mean that the user ever actually uses the profile.