I had LAUNCHSPLUNK=0 originally, expecting that it wouldn't start the first time. So it appears that the UF runs the first time no matter what. I had seen something in the docs that suggested so, but wanted to get confirmation before I add the additional commands to change the password. Maybe user-seed.conf only works for *nix installations?
From the initial installation it looks to have read this file:
04-24-2012 16:20:52.722 -0700 WARN AuthenticationManagerSplunk - Failed to remove file 'C:\Program Files\SplunkUniversalForwarder\etc\system\default\user-seed.conf' errno=Access is denied.
There are no log messages for user-seed.conf on the subsequent start.
Does this file have to be placed before the installation occurs? I would expect that the installation would overwrite the file.