anchor.diff:               || cfg.group == "wheel"
                || elem "wheel" cfg.extraGroups)
               &&
  -            ((cfg.hashedPassword != null && cfg.hashedPassword != "!")
  +            (cfg.hashedPassword != null
                || cfg.password != null
                || cfg.passwordFile != null
                || cfg.openssh.authorizedKeys.keys != []
  
positive.code:       '';
      };
  
      # FIXME: obsolete - will remove.
      security.initialRootPassword = mkOption {
        type = types.str;
        default = "!";
        example = "";
        visible = false;
      };
  
    };
  
  
  
negative.code:   imports = [
      (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ])
      (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ])
      (mkChangedOptionModule
        [ "security" "initialRootPassword" ]
        [ "users" "users" "root" "initialHashedPassword" ]
        (cfg: if cfg.security.initialHashedPassword == "!"
              then null
              else cfg.security.initialHashedPassword))
    ];
  
    ###### interface
  