diff --git a/typo3/sysext/core/Classes/Hooks/BackendUserPasswordCheck.php b/typo3/sysext/core/Classes/Hooks/BackendUserPasswordCheck.php
new file mode 100644
index 000000000000..5758724e3ff2
--- /dev/null
+++ b/typo3/sysext/core/Classes/Hooks/BackendUserPasswordCheck.php
@@ -0,0 +1,67 @@
+<?php
+declare(strict_types = 1);
+
+namespace TYPO3\CMS\Core\Hooks;
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+use TYPO3\CMS\Core\Crypto\Random;
+use TYPO3\CMS\Core\DataHandling\DataHandler;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+use TYPO3\CMS\Core\Utility\MathUtility;
+
+/**
+ * DataHandler hook to ensure that a be_user always has a username + password set if newly-created.
+ *
+ * @internal This class is a hook implementation and is not part of the TYPO3 Core API.
+ */
+class BackendUserPasswordCheck
+{
+    /**
+     * @var Random
+     */
+    protected $random;
+
+    public function __construct()
+    {
+        $this->random = GeneralUtility::makeInstance(Random::class);
+    }
+
+    /**
+     * @param array $incomingFieldArray
+     * @param string $table
+     * @param string $id
+     * @param DataHandler $dataHandler
+     */
+    public function processDatamap_preProcessFieldArray(&$incomingFieldArray, $table, $id, DataHandler $dataHandler)
+    {
+        // Not within be_users
+        if ($table !== 'be_users') {
+            return;
+        }
+        // Existing record, nothing to change
+        if (MathUtility::canBeInterpretedAsInteger($id)) {
+            return;
+        }
+        if ($dataHandler->isImporting) {
+            return;
+        }
+        if (!isset($incomingFieldArray['password']) || (string)$incomingFieldArray['password'] === '') {
+            $incomingFieldArray['password'] = GeneralUtility::hmac($id, $this->random->generateRandomBytes(20));
+        }
+        if (!isset($incomingFieldArray['username']) || (string)$incomingFieldArray['username'] === '') {
+            $incomingFieldArray['username'] = 'autogenerated-' . GeneralUtility::shortMD5($id);
+        }
+    }
+}
diff --git a/typo3/sysext/core/Configuration/TCA/be_users.php b/typo3/sysext/core/Configuration/TCA/be_users.php
index 36c35b145048..b38c44982f64 100644
--- a/typo3/sysext/core/Configuration/TCA/be_users.php
+++ b/typo3/sysext/core/Configuration/TCA/be_users.php
@@ -188,6 +188,7 @@
                         'invertStateDisplay' => true
                     ],
                 ],
+                'default' => 1,
             ]
         ],
         'disableIPlock' => [
@@ -381,7 +382,7 @@
     'types' => [
         '0' => ['showitem' => '
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:general,
-                admin, username, password, avatar, usergroup, realName, email, lang, lastlogin,
+                disable, admin, username, password, avatar, usergroup, realName, email, lang, lastlogin,
             --div--;LLL:EXT:core/Resources/Private/Language/locallang_tca.xlf:be_users.tabs.rights,
                 userMods, allowed_languages,
             --div--;LLL:EXT:core/Resources/Private/Language/locallang_tca.xlf:be_users.tabs.mounts_and_workspaces,
@@ -389,18 +390,18 @@
             --div--;LLL:EXT:core/Resources/Private/Language/locallang_tca.xlf:be_users.tabs.options,
                 lockToDomain, disableIPlock, TSconfig,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:access,
-                disable,--palette--;;timeRestriction,
+                --palette--;;timeRestriction,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:notes,
                 description,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:extended,
         '],
         '1' => ['showitem' => '
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:general,
-                admin, username, password, avatar, usergroup, realName, email, lang, lastlogin,
+                disable, admin, username, password, avatar, usergroup, realName, email, lang, lastlogin,
             --div--;LLL:EXT:core/Resources/Private/Language/locallang_tca.xlf:be_users.tabs.options,
                 disableIPlock, TSconfig, db_mountpoints, options, file_mountpoints,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:access,
-                disable,--palette--;;timeRestriction,
+                --palette--;;timeRestriction,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:notes,
                 description,
             --div--;LLL:EXT:core/Resources/Private/Language/Form/locallang_tabs.xlf:extended,
diff --git a/typo3/sysext/core/ext_localconf.php b/typo3/sysext/core/ext_localconf.php
index 48a66b18616a..86fe8c220321 100644
--- a/typo3/sysext/core/ext_localconf.php
+++ b/typo3/sysext/core/ext_localconf.php
@@ -23,6 +23,7 @@
 
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['processDatamapClass'][] = \TYPO3\CMS\Core\Resource\Security\FileMetadataPermissionsAspect::class;
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['processDatamapClass'][] = \TYPO3\CMS\Core\Hooks\BackendUserGroupIntegrityCheck::class;
+$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['processDatamapClass'][] = \TYPO3\CMS\Core\Hooks\BackendUserPasswordCheck::class;
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['typo3/alt_doc.php']['makeEditForm_accessCheck'][] = \TYPO3\CMS\Core\Resource\Security\FileMetadataPermissionsAspect::class . '->isAllowedToShowEditForm';
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tceforms_inline.php']['checkAccess'][] = \TYPO3\CMS\Core\Resource\Security\FileMetadataPermissionsAspect::class . '->isAllowedToShowEditForm';
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tcemain.php']['checkModifyAccessList'][] = \TYPO3\CMS\Core\Resource\Security\FileMetadataPermissionsAspect::class;