diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java
index 546b0e574a..52e6e5ba13 100644
--- a/core/src/main/java/hudson/PluginManager.java
+++ b/core/src/main/java/hudson/PluginManager.java
@@ -1193,7 +1193,6 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
                     }
 			updateCenter.persistInstallStatus();
                     jenkins.setInstallState(InstallState.INITIAL_PLUGINS_INSTALLING.getNextState());
-                    InstallUtil.saveLastExecVersion();
                 }
             }.start();
         }
diff --git a/core/src/main/java/jenkins/install/InstallUtil.java b/core/src/main/java/jenkins/install/InstallUtil.java
index 21adcfd83a..35e8cb95c6 100644
--- a/core/src/main/java/jenkins/install/InstallUtil.java
+++ b/core/src/main/java/jenkins/install/InstallUtil.java
@@ -45,6 +45,9 @@ import com.thoughtworks.xstream.XStream;
 import hudson.Functions;
 import hudson.model.UpdateCenter.DownloadJob.InstallationStatus;
 import hudson.model.UpdateCenter.DownloadJob.Installing;
+import hudson.security.AuthorizationStrategy;
+import hudson.security.FullControlOnceLoggedInAuthorizationStrategy;
+import hudson.security.HudsonPrivateSecurityRealm;
 import hudson.security.SecurityRealm;
 import hudson.model.UpdateCenter.InstallationJob;
 import hudson.model.UpdateCenter.UpdateCenterJob;
@@ -99,8 +102,8 @@ public class InstallUtil {
             // Edge case: used Jenkins 1 but did not save the system config page,
             // the version is not persisted and returns 1.0, so try to check if
             // they actually did anything
-            if (!Jenkins.getInstance().getItemMap().isEmpty()
-                    || Jenkins.getInstance().getSecurityRealm() != SecurityRealm.NO_AUTHENTICATION) {
+            Jenkins j = Jenkins.getInstance();
+            if (!j.getItemMap().isEmpty() || !mayBeJenkins2SecurityDefaults(j)) {
                 return InstallState.UPGRADE;
             }
             return InstallState.NEW;
@@ -119,6 +122,29 @@ public class InstallUtil {
         }
     }
 
+    /**
+     * This could be an upgrade, detect a non-default security realm for the stupid case
+     * where someone installed 1.x and did not save global config or create any items...
+     */
+    private static boolean mayBeJenkins2SecurityDefaults(Jenkins j) {
+        if(j.getSecurityRealm() == SecurityRealm.NO_AUTHENTICATION) { // called before security set up first
+            return true;
+        }
+        if(j.getSecurityRealm() instanceof HudsonPrivateSecurityRealm) { // might be called after a restart, setup isn't complete
+            HudsonPrivateSecurityRealm securityRealm = (HudsonPrivateSecurityRealm)j.getSecurityRealm();
+            if(securityRealm.getAllUsers().size() == 1 && securityRealm.getUser(SetupWizard.initialSetupAdminUserName) != null) {
+                AuthorizationStrategy authStrategy = j.getAuthorizationStrategy();
+                if(authStrategy instanceof FullControlOnceLoggedInAuthorizationStrategy) {
+                    // must have been using 2.0+ to set this, as it wasn't present in 1.x and the default is true, to _allow_ anon read
+                    if(!((FullControlOnceLoggedInAuthorizationStrategy)authStrategy).isAllowAnonymousRead()) {
+                        return true;
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
     /**
      * Save the current Jenkins instance version as the last executed version.
      * <p>
diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java
index 795823f2fa..c3366221b6 100644
--- a/core/src/main/java/jenkins/install/SetupWizard.java
+++ b/core/src/main/java/jenkins/install/SetupWizard.java
@@ -32,7 +32,6 @@ import hudson.security.SecurityRealm;
 import hudson.security.csrf.DefaultCrumbIssuer;
 import hudson.util.HttpResponses;
 import hudson.util.PluginServletFilter;
-import hudson.util.VersionNumber;
 import jenkins.model.Jenkins;
 import jenkins.security.s2m.AdminWhitelistRule;
 
@@ -55,6 +54,12 @@ public class SetupWizard {
 
     public SetupWizard(Jenkins j) throws IOException, InterruptedException {
         this.jenkins = j;
+
+        // this was determined to be a new install, don't run the update wizard here
+        UpgradeWizard uw = jenkins.getInjector().getInstance(UpgradeWizard.class);
+        if (uw!=null)
+            uw.setCurrentLevel(Jenkins.getVersion());
+        
         // Create an admin user by default with a 
         // difficult password
         FilePath iapf = getInitialAdminPasswordFile();
@@ -157,6 +162,13 @@ public class SetupWizard {
                     admin = null;
                 }
                 
+                // Success! Delete the temporary password file:
+                try {
+                    getInitialAdminPasswordFile().delete();
+                } catch (InterruptedException e) {
+                    throw new IOException(e);
+                }
+                
                 j.setInstallState(InstallState.CREATE_ADMIN_USER.getNextState());
                 
                 // ... and then login
@@ -188,10 +200,6 @@ public class SetupWizard {
         // Also, clean up the setup wizard if it's completed
         jenkins.setSetupWizard(null);
 
-        UpgradeWizard uw = jenkins.getInjector().getInstance(UpgradeWizard.class);
-        if (uw!=null)
-            uw.setCurrentLevel(new VersionNumber("2.0"));
-
         return HttpResponses.okJSON();
     }
     
diff --git a/core/src/main/resources/jenkins/model/Jenkins/login.jelly b/core/src/main/resources/jenkins/model/Jenkins/login.jelly
index 0b91f418b7..29d9192eda 100644
--- a/core/src/main/resources/jenkins/model/Jenkins/login.jelly
+++ b/core/src/main/resources/jenkins/model/Jenkins/login.jelly
@@ -25,7 +25,7 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:choose>
-  <j:when test="${it.setupWizard.useGeneratedPassword()}">
+  <j:when test="${it.setupWizard != null and it.setupWizard.useGeneratedPassword()}">
     <st:include it="${it.setupWizard}" page="authenticate-security-token"/>
   </j:when>
   <j:otherwise>
diff --git a/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly b/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
index 64f0ec4a7d..d17d3eaff6 100644
--- a/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
+++ b/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
@@ -27,7 +27,7 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:choose>
     <j:new var="h" className="hudson.Functions" />
-    <j:when test="${app.setupWizard.useGeneratedPassword()}">
+    <j:when test="${app.setupWizard != null and app.setupWizard.useGeneratedPassword()}">
       <j:set var="error" value="true"/>
       <st:include it="${app.setupWizard}" page="authenticate-security-token"/>
     </j:when>