If you are concerned about performance in your DotNetNuke websites like I am, here is a quick and easy performance enhancement.
Recent versions of DotNetNuke have added a check to warn you if you are using "admin" or "host" as a username.
This check happens on every page request, and is not needed IMO.

To remove this warning, simply delete the following lines of code from Default.aspx.vb

            'check if running with known account defaults
            Dim messageText As String = ""
            If Request.IsAuthenticated = True And String.IsNullOrEmpty(Request.QueryString("runningDefault")) = False Then
                Dim userInfo As UserInfo = HttpContext.Current.Items("UserInfo")
                'only show message to default users
                If (userInfo.Username.ToLower = "admin") OrElse (userInfo.Username.ToLower = "host") Then
                    messageText = RenderDefaultsWarning()
                    Dim messageTitle As String = Services.Localization.Localization.GetString("InsecureDefaults.Title", Services.Localization.Localization.GlobalResourceFile)
                    UI.Skins.Skin.AddPageMessage(CType(ctlSkin, DotNetNuke.UI.Skins.Skin), messageTitle.ToString, messageText.ToString, Skins.Controls.ModuleMessage.ModuleMessageType.RedError)
                End If
            End If

As per the forum guidelines for this Announcement, I have created a post for discussion on this topic at the following link.
Performance Tip - Remove default user check on every request

John,

Can you please log this as an anhancement in Gemini?

Thanks,

actually, its coded like that so the performance impact would be minimal. The check for default username/passwords is only done during the login sequence and not on every page request, and appends the querystring parameter so it can be picked up with a check in default.aspx. The check has minimal overhead, as it's only determining if a querystring exists and the user is authenticated - in real terms the performance is miniscule. We could add a host level setting to determine if this code is executed, but it would actually take longer to access this host level variable, than it would do to do the check, so any such logic would be disengenuos IMO.

I will amend the logic to use "AndAlso" rather than "And", so the second check is never performed for unauthenticated sessions.

Cathal