A vendor loaded Tom's new PC with Mint Cinnamon. It powers up without authentication to a default user account. How do we disable that?

The details:

It was set up with one temporary admin user, named “user”, with password “password.”

So we set up the “tom” account, with admin status, and then made “user” an ordinary user with its permissions turned off, and a serious password.

We ran fine as “tom”, but when we shut down and restarted, it came right up as “user” without authentication.

We can log out of the “user” session and we get the login dialog so we can get to the “tom” account.

We could remove “user,” but I thought it might hang up looking for that account.

I did some web searching and they referred to two config files to be adjusted, but one didn’t exist and the other had only one line which wasn’t relevant to the issue.

Any suggestions?

Thanks,
Victor