First run — set the owner password now. Nobody can get in until you do.
Sessions expire after 24 hours of inactivity. Failed attempts are written to the audit log.