diff -Nru casper-1.372/debian/changelog casper-1.373/debian/changelog
--- casper-1.372/debian/changelog	2016-04-07 20:28:05.000000000 -0600
+++ casper-1.373/debian/changelog	2016-04-17 05:25:06.000000000 -0600
@@ -1,3 +1,13 @@
+casper (1.373) xenial; urgency=medium
+
+  * scripts/casper-bottom/25adduser:
+    - Inject a systemd unit that will call passwd -d to ensure that the
+      AccountsService properties (particulary PasswordMode) are correctly
+      set for the live session user. This will be ignored on persistent 
+      USB's (LP: #1561302)
+
+ -- Tim Lunn <tim@feathertop.org>  Wed, 13 Apr 2016 14:02:44 +1000
+
 casper (1.372) xenial; urgency=medium
 
   * ubiquity-hooks/30accessibility:
diff -Nru casper-1.372/scripts/casper-bottom/25adduser casper-1.373/scripts/casper-bottom/25adduser
--- casper-1.372/scripts/casper-bottom/25adduser	2015-11-23 00:29:14.000000000 -0700
+++ casper-1.373/scripts/casper-bottom/25adduser	2016-04-17 05:24:56.000000000 -0600
@@ -100,6 +100,22 @@
 #GDM
 if [ -d /root/etc/gdm3 ]; then
     sed -i '/^[UG]ID_MIN/s/\<1000$/ 999/' /root/etc/login.defs
+
+    #inject a systemd unit to update AccountsService properties during boot
+    if [ -z "${PERSISTENT}" ]; then
+        cat > /root/lib/systemd/system/passwd-del.service << EOF
+[Unit]
+Description=Run passwd -d to ensure AccountsService properties are set correctly
+After=accounts-daemon.service
+Before=display-manager.service
+
+[Service]
+ExecStart=-/usr/bin/dbus-run-session passwd -d $USERNAME
+Type=oneshot
+EOF
+        ln -s /root/lib/systemd/system/passwd-del.service \
+              /root/etc/systemd/system/display-manager.service.wants/
+    fi
 fi
 
 # Kubuntu