Once you have completed the software installation, and have created alternative users to be members of the Administrators group so they can function as “the Administrator”, there is no problem with not having the username “Administrator” in Windchill or in your LDAP. I would not delete the user Administrator from the ThingWorx database, because it is your “backdoor” to get in if you ever have the need. Keep it in the Administrators group and in a license group, and if you ever need to, you can reconfigure for Fixed Authentication and use Administrator to login to ThingWorx. That is because, in Fixed Authentication, the Directory Store for authentication is the ThingWorx database and it doesn’t matter what you may have in Windchill, Active Directory, or any other LDAP data store. That’s handy, for example, for the case where your other admin users get inactivated, deleted, disconnected from the network, or somehow won’t function anymore. If you accept that risk (I would not) there is nothing else you would lose by making Administrator unusable. It was only critical during the install process, because “Administrator” is hard wired in the code for installation and is your only user until you can create new users and make some of them admins.
A different concern that you should consider is that Windchill Authentication is not supported with Windchill on SSO (the configuration using Shibboleth as the Service Provider for Windchill). The Windchill SSO configuration interferes with the Windchill Authentication code in Windchill. The recommended (and only) alternative is to configure Navigate for SSO using ThingWorx as the Service Provider for Navigate. The two SSO configurations can co-exist and do not interact or interfere with each other in any way.
