diff --git a/pkg/keystone/models/users.go b/pkg/keystone/models/users.go
index 7eb0ee90ac..e6bd2fefda 100644
--- a/pkg/keystone/models/users.go
+++ b/pkg/keystone/models/users.go
@@ -20,10 +20,9 @@ import (
 	"fmt"
 	"time"
 
-	"yunion.io/x/pkg/errors"
-
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/tristate"
 	"yunion.io/x/sqlchemy"
 
@@ -87,6 +86,7 @@ type SUser struct {
 
 	IsSystemAccount tristate.TriState `nullable:"false" default:"false" list:"domain" update:"domain" create:"domain_optional"`
 
+	// deprecated
 	DefaultProjectId string `width:"64" charset:"ascii" nullable:"true"`
 
 	AllowWebConsole tristate.TriState `nullable:"false" default:"true" list:"domain" update:"domain" create:"domain_optional"`
@@ -202,6 +202,9 @@ func (manager *SUserManager) initSysUser() error {
 	usr.Name = api.SystemAdminUser
 	usr.DomainId = api.DEFAULT_DOMAIN_ID
 	usr.Enabled = tristate.True
+	usr.IsSystemAccount = tristate.False
+	usr.AllowWebConsole = tristate.False
+	usr.EnableMfa = tristate.False
 	usr.Description = "Boostrap system default admin user"
 	usr.SetModelManager(manager, &usr)
 
@@ -300,7 +303,7 @@ func localUserVerifyPassword(user *api.SUserExtended, passwd string) error {
 		return nil
 	}
 	//}
-	return fmt.Errorf("invalid password")
+	return fmt.Errorf("invalid password for %s", user.Name)
 }
 
 func (manager *SUserManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {