diff --git a/examples/CI-Eng-Sample/08_auth_group_df.qli b/examples/CI-Eng-Sample/08_auth_group_df.qli
index eb0c8c0..66e58a1 100644
--- a/examples/CI-Eng-Sample/08_auth_group_df.qli
+++ b/examples/CI-Eng-Sample/08_auth_group_df.qli
@@ -4,10 +4,19 @@ ENGLISH
 @VERSION
 1.03.00
 
-! CI-Eng-Sample read-only authorization group (IM 36K10C10-01EN 2.4), CI Server R1.03.00
+! CI-Eng-Sample authorization groups (IM 36K10C10-01EN 2.4), CI Server R1.03.00:
+! CIENG_VIEWER read-only; CIENG_OPERATOR for the demo user CIENG (08b_user_df.qli)
 ! Actions are NAME values from AUTH_ACTION_DF.
 @FIELDS
 NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4
 
 @AUTH_GROUP_DF
 "CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"
+
+! CIENG_OPERATOR: the actions of the factory group OPERATOR (R1.03.00) plus EXECUTE_GENERAL_COMMANDS,
+! needed for the server-side command of the live-data button Start (feed\cieng_feed_start.cmd).
+@FIELDS
+NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4,ACTION_NAME_5,ACTION_NAME_6,ACTION_NAME_7,ACTION_NAME_8,ACTION_NAME_9,ACTION_NAME_10,ACTION_NAME_11,ACTION_NAME_12,ACTION_NAME_13,ACTION_NAME_14,ACTION_NAME_15,ACTION_NAME_16,ACTION_NAME_17,ACTION_NAME_18,ACTION_NAME_19,ACTION_NAME_20,ACTION_NAME_21,ACTION_NAME_22,ACTION_NAME_23,ACTION_NAME_24,ACTION_NAME_25,ACTION_NAME_26,ACTION_NAME_27,ACTION_NAME_28,ACTION_NAME_29,ACTION_NAME_30,ACTION_NAME_31,ACTION_NAME_32,ACTION_NAME_33,ACTION_NAME_34,ACTION_NAME_35,ACTION_NAME_36,ACTION_NAME_37,ACTION_NAME_38,ACTION_NAME_39,ACTION_NAME_40,ACTION_NAME_41,ACTION_NAME_42,ACTION_NAME_43,ACTION_NAME_44,ACTION_NAME_45,ACTION_NAME_46,ACTION_NAME_47,ACTION_NAME_48,ACTION_NAME_49,ACTION_NAME_50,ACTION_NAME_51,ACTION_NAME_52,ACTION_NAME_53,ACTION_NAME_54,ACTION_NAME_55,ACTION_NAME_56,ACTION_NAME_57,ACTION_NAME_58,ACTION_NAME_59,ACTION_NAME_60,ACTION_NAME_61,ACTION_NAME_62,ACTION_NAME_63,ACTION_NAME_64,ACTION_NAME_65,ACTION_NAME_66,ACTION_NAME_67,ACTION_NAME_68,ACTION_NAME_69,ACTION_NAME_70,ACTION_NAME_71,ACTION_NAME_72,ACTION_NAME_73,ACTION_NAME_74,ACTION_NAME_75
+
+@AUTH_GROUP_DF
+"CIENG_OPERATOR","CI-Eng-Sample operator (OPERATOR + server commands)","ALARM_ACK_READ","ALARM_AOI_READ","ALARM_ASA_READ","ALARM_CHRONO_READ","ALARM_CURRENT_ACK","ALARM_CURRENT_READ","ALARM_DISPLAY_READ","ALARM_FO_READ","ALARM_FU_READ","ALARM_GROUP_READ","ALARM_NOT_DEST_READ","ALARM_NOT_USR_READ","AUDIT_EVENT_CLAS_READ","AUDIT_SELGRP_READ","AUDIT_TRAIL_READ","AUTH_ACTION_READ","AUTH_GROUP_READ","CLASS_ATTR_VAL_READ","CLASS_INCLUDED_READ","CLASS_READ","CLASS_SIGNALS_READ","DISPLAY_READ","EXTERNAL_ALARM_READ","FOLDER_READ","HIS_GROUP_FORCE_ROLLOVER","HIS_GROUP_READ","HIS_UNITS_READ","INSTALL_BLOCK_UNBLOCK","INSTALL_READ","ITEM_ACK_ALARM","ITEM_HISTORY_READ","ITEM_HIS_READ","ITEM_MODIFY_APPLICATION_FLAG","ITEM_MODIFY_BLOCKED_VALUE","ITEM_MODIFY_DEADBAND","ITEM_MODIFY_HISTORY","ITEM_MODIFY_LIMIT_HIGH","ITEM_MODIFY_LIMIT_HIGH_HIGH","ITEM_MODIFY_LIMIT_LOW","ITEM_MODIFY_LIMIT_LOW_LOW","ITEM_MODIFY_QUALITY_CODE","ITEM_MODIFY_STATUS","ITEM_MODIFY_STRING_VALUE","ITEM_MODIFY_VALUE","ITEM_READ","ITEM_READ_ALARM_TYPE","NODE_HOST_READ","NODE_LOCAL_READ","OBJECT_READ","OBJECT_SIGNALS_READ","OPC_GROUP_READ","REPORT_CANCEL","REPORT_DELETE_GENERATED_REPORT","REPORT_GENERATE_ADHOC","REPORT_MAINTAIN_LOGBOOK","REPORT_PRINT","REPORT_READ","REPORT_READ_GENERATED_REPORT","SCAN_TYPE_READ","SCHEME_READ","SECTION_BLOCK_UNBLOCK","SECTION_READ","SEQUENCE_READ","STATION_ON_OFF_SCAN","STATION_READ","STATUS_READ","SUB_ITEM_READ","SYMBOL_READ","SYS_LOG_READ","TRIGGER_GROUP_READ","UAC_METHOD_MODIFY","UAC_METHOD_READ","UNIT_BLOCK_UNBLOCK","UNIT_READ","EXECUTE_GENERAL_COMMANDS"
diff --git a/examples/CI-Eng-Sample/08b_user_df.qli b/examples/CI-Eng-Sample/08b_user_df.qli
new file mode 100644
index 0000000..ff930ff
--- /dev/null
+++ b/examples/CI-Eng-Sample/08b_user_df.qli
@@ -0,0 +1,15 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample demo user CIENG (IM 36K10C10-01EN 2.5), CI Server R1.03.00: group CIENG_OPERATOR,
+! logs on to layout CIENG_Operator with display CIENG_Overview (Operator Interface and web).
+! Empty password: PASSWORD "" must be given explicitly (tested 2026-10-06: without the field the
+! user has no password set and every logon fails with DSS-E-UNK_USER).
+@FIELDS
+NAME,DESCRIPTION,AUTH_GROUP,PROCESS_AREAS,LOGOFF_TIMEOUT,LAYOUT,INITIAL_DISPLAY,PASSWORD
+
+@USER_DF
+"CIENG","CI-Eng-Sample demo user (no password)","CIENG_OPERATOR","1-999",0,"CIENG_Operator","CIENG_Overview",""
diff --git a/examples/CI-Eng-Sample/85_remove_auth_group_df.qli b/examples/CI-Eng-Sample/85_remove_auth_group_df.qli
index 1ad82be..3e82566 100644
--- a/examples/CI-Eng-Sample/85_remove_auth_group_df.qli
+++ b/examples/CI-Eng-Sample/85_remove_auth_group_df.qli
@@ -4,9 +4,14 @@ ENGLISH
 @VERSION
 1.03.00
 
-! Remove the CI-Eng-Sample authorization group (remove its users first)
+! Remove the CI-Eng-Sample user and authorization groups (the user first: a group with users
+! cannot be removed)
 @FIELDS
 NAME
 
+@USER_DF
+"CIENG"
+
 @AUTH_GROUP_DF
+"CIENG_OPERATOR"
 "CIENG_VIEWER"
diff --git a/examples/CI-Eng-Sample/load.cmd b/examples/CI-Eng-Sample/load.cmd
index 11bb469..a2fc680 100644
--- a/examples/CI-Eng-Sample/load.cmd
+++ b/examples/CI-Eng-Sample/load.cmd
@@ -17,8 +17,10 @@ rem Processing: trigger group, class (compiled on load via COMPILE = 1), object
 dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo
 dssqld -i 06_class_df.qli -l 06_class_df.qlo
 dssqld -i 07_object_df.qli -l 07_object_df.qlo
-rem Authorization: read-only group (no users are created by the sample)
+rem Authorization: groups CIENG_VIEWER (read-only) and CIENG_OPERATOR (demo user)
 dssqld -i 08_auth_group_df.qli -l 08_auth_group_df.qlo
+rem Demo user CIENG (no password; logs on to the CIENG_Operator layout)
+dssqld -i 08b_user_df.qli -l 08b_user_df.qlo
 rem Equipment: Modbus loopback line, station, scan type, points, connected items.
 rem The station needs the Modbus slave mirror (equipment\eqpciengslv_start.cmd, see README).
 dssqld -i 09_modbus_line_df.qli -l 09_modbus_line_df.qlo
diff --git a/examples/CI-Eng-Sample/remove.cmd b/examples/CI-Eng-Sample/remove.cmd
index 3fd02aa..39a097b 100644
--- a/examples/CI-Eng-Sample/remove.cmd
+++ b/examples/CI-Eng-Sample/remove.cmd
@@ -1,6 +1,9 @@
 @echo off
 rem Remove CI-Eng-Sample from a CI Server R1.03 TEST system (also deletes its history).
 rem Run in an elevated prompt while CI Server is running; call this script by full path.
+rem Log out every CIENG session first (Operator Interface and web): an authorization group cannot
+rem be removed while a session of its user is open (DSSP-E-NODEL ... in dataset USER_VAL); a retry in that
+rem state stopped the DSSSDA03 process (DUR-F-BAD_SIZE) on R1.03.00 and needed a CI Server restart.
 rem Order: audit report + selection group, reports, printer, OPC UA, Modbus, auth group, object, class, trigger group, storage links, stop + delete storage groups, items, sections (children first).
 rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the
 rem group first gets a stop time one minute ahead; the script waits until it has passed.