diff --git a/planetstack/core/models/user.py b/planetstack/core/models/user.py
index 62e5b91..9d0c2ec 100644
--- a/planetstack/core/models/user.py
+++ b/planetstack/core/models/user.py
@@ -156,7 +156,7 @@
     deployment = models.ForeignKey(Deployment)
     kuser_id = models.CharField(null=True, blank=True, max_length=200, help_text="Keystone user id")
 
-    def __unicode__(self):  return u'%s %s %s' % (self.user, self.deployment.name)
+    def __unicode__(self):  return u'%s %s' % (self.user, self.deployment.name)
 
     @staticmethod
     def select_by_user(user):
diff --git a/planetstack/observer/steps/sync_slice_deployments.py b/planetstack/observer/steps/sync_slice_deployments.py
index 0f92796..8c0374d 100644
--- a/planetstack/observer/steps/sync_slice_deployments.py
+++ b/planetstack/observer/steps/sync_slice_deployments.py
@@ -7,6 +7,7 @@
 from observer.openstacksyncstep import OpenStackSyncStep
 from core.models.site import SiteDeployments
 from core.models.slice import Slice, SliceDeployments
+from core.models.user import UserDeployments
 from util.logger import Logger, logging
 
 logger = Logger(level=logging.INFO)
@@ -63,37 +64,42 @@
             slice_deployment.tenant_id = tenant.id
 
             # XXX give caller an admin role at the tenant they've created
-            driver.add_user_role(slice_deployment.slice.creator.kuser_id, tenant.id, 'admin')
+            deployment_users = UserDeployments.objects.filter(user=slice_deployment.slice.creator,
+                                                             deployment=slice_deployment.deployment)            
+            if not deployment_users or not deployment_users[0].kuser_id:
+                logger.info("slice createor %s has not accout at deployment %s" % (slice_deployment.slice.creator, slice_deployment.deployment.name)
+            else:
+                driver.add_user_role(slice_deployment.slice.creator.kuser_id, tenant.id, 'admin')
 
-            # refresh credentials using this tenant
-            client_driver = self.driver.client_driver(tenant=tenant.name, 
-                                                      deployment=slice_deployment.deployment.name)
+                # refresh credentials using this tenant
+                client_driver = self.driver.client_driver(tenant=tenant.name, 
+                                                          deployment=slice_deployment.deployment.name)
 
-            # create network
-            network = client_driver.create_network(slice.name)
-            slice_deployment.network_id = network['id']
+                # create network
+                network = client_driver.create_network(slice.name)
+                slice_deployment.network_id = network['id']
 
-            # create router
-            router = client_driver.create_router(slice.name)
-            slice_deployment.router_id = router['id']
+                # create router
+                router = client_driver.create_router(slice.name)
+                slice_deployment.router_id = router['id']
 
-            # create subnet for slice's private network
-            next_subnet = self.get_next_subnet(deployment=slice_deployment.deployment.name)
-            cidr = str(next_subnet.cidr)
-            ip_version = next_subnet.version
-            start = str(next_subnet[2])
-            end = str(next_subnet[-2]) 
-            subnet = client_driver.create_subnet(name=slice.name,
-                                               network_id = network['id'],
-                                               cidr_ip = cidr,
-                                               ip_version = ip_version,
-                                               start = start,
-                                               end = end)
-            slice_deployment.subnet_id = subnet['id']
-            # add subnet as interface to slice's router
-            client_driver.add_router_interface(router['id'], subnet['id'])
-            # add external route
-            client_driver.add_external_route(subnet)
+                # create subnet for slice's private network
+                next_subnet = self.get_next_subnet(deployment=slice_deployment.deployment.name)
+                cidr = str(next_subnet.cidr)
+                ip_version = next_subnet.version
+                start = str(next_subnet[2])
+                end = str(next_subnet[-2]) 
+                subnet = client_driver.create_subnet(name=slice.name,
+                                                   network_id = network['id'],
+                                                   cidr_ip = cidr,
+                                                   ip_version = ip_version,
+                                                   start = start,
+                                                   end = end)
+                slice_deployment.subnet_id = subnet['id']
+                # add subnet as interface to slice's router
+                client_driver.add_router_interface(router['id'], subnet['id'])
+                # add external route
+                client_driver.add_external_route(subnet)
 
 
         if slice_deployment.id and slice_deployment.tenant_id:
diff --git a/planetstack/observer/steps/sync_user_deployments.py b/planetstack/observer/steps/sync_user_deployments.py
index e7454b8..25f5e02 100644
--- a/planetstack/observer/steps/sync_user_deployments.py
+++ b/planetstack/observer/steps/sync_user_deployments.py
@@ -1,10 +1,11 @@
 import os
 import base64
+import hashlib
 from collections import defaultdict
 from django.db.models import F, Q
 from planetstack.config import Config
 from observer.openstacksyncstep import OpenStackSyncStep
-from core.models.site import SiteDeployments
+from core.models.site import SiteDeployments, Deployment
 from core.models.user import User, UserDeployments
 from util.logger import Logger, logging
 
@@ -17,18 +18,25 @@
     def fetch_pending(self):
         # user deployments are not visible to users. We must ensure
         # user are deployed at all deploymets available to their sites.
-        site_deployments = SiteDeployment.objects.all()
+
+        deployments = Deployment.objects.all()
+        site_deployments = SiteDeployments.objects.all()
         site_deploy_lookup = defaultdict(list)
         for site_deployment in site_deployments:
             site_deploy_lookup[site_deployment.site].append(site_deployment.deployment)
         
-        user_deployments = UserDeployment.objects.all()
+        user_deployments = UserDeployments.objects.all()
         user_deploy_lookup = defaultdict(list)
         for user_deployment in user_deployments:
             user_deploy_lookup[user_deployment.user].append(user_deployment.deployment)
         
         for user in User.objects.all():
-            expected_deployments = site_deploy_lookup[user.site]
+            if user.is_admin:
+                # admins should have an account at all deployments
+                expected_deployments = deployments
+            else:
+                # normal users should have an account at their site's deployments
+                expected_deployments = site_deploy_lookup[user.site]
             for expected_deployment in expected_deployments:
                 if expected_deployment not in user_deploy_lookup[user]:
                     ud = UserDeployments(user=user, deployment=expected_deployment)
@@ -38,7 +46,7 @@
         return UserDeployments.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
 
     def sync_record(self, user_deployment):
-        logger.info("sync'ing user deployment %s" % user_deployment.name)
+        logger.info("sync'ing user %s at deployment %s" % (user_deployment.user, user_deployment.deployment.name))
         name = user_deployment.user.email[:user_deployment.user.email.find('@')]
         user_fields = {'name': name,
                        'email': user_deployment.user.email,
@@ -46,7 +54,7 @@
                        'enabled': True}    
         driver = self.driver.admin_driver(deployment=user_deployment.deployment.name)
         if not user_deployment.kuser_id:
-            keystone_user = self.driver.create_user(**user_fields)
+            keystone_user = driver.create_user(**user_fields)
             user_deployment.kuser_id = keystone_user.id
         else:
             driver.update_user(user_deployment.kuser_id, user_fields)
@@ -67,7 +75,7 @@
                     driver.delete_user_role(user_deployment.kuser_id, tenant_id, 'admin')
 
         if user_deployment.user.public_key:
-            user_driver = self.driver.client_driver(caller=user, tenant=user.site.login_base, 
+            user_driver = driver.client_driver(caller=user, tenant=user.site.login_base, 
                                                     deployment=user_deployment.deployment.name)
             key_fields =  {'name': user_deployment.user.keyname,
                            'public_key': user_deployment.user.public_key}