There's an open bug for changing sulogin to handle multiple accounts with uid 0. Wouldn't it also be useful to change it to check roles as well (for strict policy)? Bill