diff --git a/auth/mnet/auth.php b/auth/mnet/auth.php
index 2b5d765075e..9ce3089ba13 100644
--- a/auth/mnet/auth.php
+++ b/auth/mnet/auth.php
@@ -262,9 +262,11 @@ class auth_plugin_mnet extends auth_plugin_base {
         // add the remote user to the database if necessary, and if allowed
         // TODO: refactor into a separate function
         if (empty($localuser) || ! $localuser->id) {
+            /*
             if (empty($this->config->auto_add_remote_users)) {
                 print_error('nolocaluser', 'mnet');
-            }
+            } See MDL-21327   for why this is commented out
+            */
             $remoteuser->mnethostid = $remotehost->id;
             $remoteuser->firstaccess = time(); // First time user in this server, grab it here
 
@@ -676,13 +678,15 @@ class auth_plugin_mnet extends auth_plugin_base {
         if (!isset ($config->rpc_negotiation_timeout)) {
             $config->rpc_negotiation_timeout = '30';
         }
+        /*
         if (!isset ($config->auto_add_remote_users)) {
             $config->auto_add_remote_users = '0';
-        }
+        } See MDL-21327   for why this is commented out
+        set_config('auto_add_remote_users',   $config->auto_add_remote_users,   'auth/mnet');
+        */
 
         // save settings
         set_config('rpc_negotiation_timeout', $config->rpc_negotiation_timeout, 'auth/mnet');
-        set_config('auto_add_remote_users',   $config->auto_add_remote_users,   'auth/mnet');
 
         return true;
     }
diff --git a/auth/mnet/config.html b/auth/mnet/config.html
index bd08e32f668..5fc988b01f3 100644
--- a/auth/mnet/config.html
+++ b/auth/mnet/config.html
@@ -4,9 +4,12 @@ global $OUTPUT;
 if (!isset($config->rpc_negotiation_timeout)) {
     $config->rpc_negotiation_timeout = '30';
 }
+/*
+ See MDL-21327   for why this is commented out
 if (!isset ($config->auto_add_remote_users)) {
     $config->auto_add_remote_users = '0';
 }
+*/
 
 $yesno = array(get_string('no'), get_string('yes'));
 
@@ -39,6 +42,8 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
     </td>
 </tr>
 
+<?php /*
+ See MDL-21327   for why this is commented out
 <tr valign="top" class="required">
     <td align="right"><?php print_string('auto_add_remote_users', 'auth_mnet'); ?>: </td>
     <td>
@@ -56,6 +61,7 @@ if (empty($CFG->mnet_dispatcher_mode) || $CFG->mnet_dispatcher_mode !== 'strict'
         ?>
     </td>
 </tr>
+*/ ?>
 <tr valign="top" class="required">
     <td colspan="3"><?php print_string('auth_mnet_roamin', 'auth_mnet'); ?>: </td>
 </tr>
diff --git a/enrol/mnet/enrol.php b/enrol/mnet/enrol.php
index 0b79d1fde3e..66f479f7bcf 100644
--- a/enrol/mnet/enrol.php
+++ b/enrol/mnet/enrol.php
@@ -300,9 +300,10 @@ class enrolment_plugin_mnet {
 
         if ($userrecord == false) {
             $userrecord = mnet_strip_user((object)$user, mnet_fields_to_import($remoteclient));
-            // TODO maybe check a setting here to see whether
-            // we allow the remote site to create users
-            // see MDL-21327
+            /* there used to be a setting in auth/mnet called auto_create_users
+             * which we should have been checking here (but weren't).
+             * this setting has now been removed. See MDL-21327
+             */
             $userrecord->mnethostid = $remoteclient->id;
 
             //TODO - username required to use PARAM_USERNAME before inserting into user table (MDL-16919)