Couldn't it be that at some point in the past (where the user kimon even did not exist) the adm entry looked like this?: adm:x:4:logcheck: When the user kimon then was added he would have been appended directly behind the colon. regards kimon