Security enabled then user created? That's the order of operations...