I've checked in a patch to setup that moves the mkgroup/mkpasswd stuff into /etc/postinstall/*.sh, and added support to /etc/profile to run - once - any script found as /etc/postinstall/*.sh. I also only do the mkgroup/mkpasswd stuff if the install happens on NT.