Thanks for bringing this point up, Sunil. I feel like a git not having thought of this when I knew the new account was created and sitting there which explains it all. Being the [overly] cautious person that I am, rather than going to the extreme of deleting the account I disabled it via Control Panel | Administrative Tools | Computer Management | Computer Management (Local) | Local Users and Groups | Users | ASPNET user account | right-click and go down to Properties | General tab | check the "Account is Disabled" box | Apply. Voila! PS: Yeah, yeah, just deleting the account is much quicker but I wanted safer.