diff --git a/UnitTest/Bootstrap.Admin/Api/ApiTest.cs b/UnitTest/Bootstrap.Admin/Api/ApiTest.cs
index b8ab9f2c..184c38eb 100644
--- a/UnitTest/Bootstrap.Admin/Api/ApiTest.cs
+++ b/UnitTest/Bootstrap.Admin/Api/ApiTest.cs
@@ -12,7 +12,7 @@ namespace Bootstrap.Admin.Api
             factory.ClientOptions.BaseAddress = new System.Uri($"http://localhost/api/{controller}/");
             Client = factory.CreateClient();
 
-            if (login) factory.LoginAsync(Client).GetAwaiter();
+            if (login) factory.LoginAsync(Client).GetAwaiter().GetResult();
         }
     }
 }
diff --git a/UnitTest/Bootstrap.Admin/Api/UsersTest.cs b/UnitTest/Bootstrap.Admin/Api/UsersTest.cs
new file mode 100644
index 00000000..ab233f16
--- /dev/null
+++ b/UnitTest/Bootstrap.Admin/Api/UsersTest.cs
@@ -0,0 +1,113 @@
+using Bootstrap.DataAccess;
+using Longbow.Web.Mvc;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http;
+using Xunit;
+
+namespace Bootstrap.Admin.Api
+{
+    public class UsersTest : ApiTest
+    {
+        private BAWebHost _factory;
+
+        public UsersTest(BAWebHost factory) : base(factory, "Users", true)
+        {
+            _factory = factory;
+        }
+
+        [Fact]
+        public async void Option_Ok()
+        {
+            var req = new HttpRequestMessage(HttpMethod.Options, "");
+            var resp = await Client.SendAsync(req);
+        }
+
+        [Fact]
+        public async void Get_Ok()
+        {
+            // 菜单 系统菜单 系统使用条件
+            var query = "?sort=DisplayName&order=asc&offset=0&limit=20&name=Admin&displayName=Administrator&_=1547628247338";
+            var qd = await Client.GetAsJsonAsync<QueryData<object>>(query);
+            Assert.Single(qd.rows);
+        }
+
+        [Fact]
+        public async void PostAndDelete_Ok()
+        {
+            var user = new User();
+            user.Delete(user.Retrieves().Where(usr => usr.UserName == "UnitTest-Delete").Select(usr => usr.Id));
+
+            var nusr = new User { UserName = "UnitTest-Delete", Password = "1", DisplayName = "DisplayName", ApprovedBy = "System", ApprovedTime = DateTime.Now, Description = "Desc", Icon = "default.jpg" };
+            var resp = await Client.PostAsJsonAsync<User, bool>("", nusr);
+            Assert.True(resp);
+
+            nusr.Id = user.Retrieves().First(u => u.UserName == nusr.UserName).Id;
+            resp = await Client.PostAsJsonAsync<User, bool>("", nusr);
+            Assert.True(resp);
+
+            var ids = user.Retrieves().Where(d => d.UserName == nusr.UserName).Select(d => d.Id);
+            Assert.True(await Client.DeleteAsJsonAsync<IEnumerable<string>, bool>("", ids));
+        }
+
+        [Fact]
+        public async void PostById_Ok()
+        {
+            var rid = new Role().Retrieves().Where(r => r.RoleName == "Administrators").First().Id;
+
+            var ret = await Client.PostAsJsonAsync<string, IEnumerable<object>>($"{rid}?type=role", string.Empty);
+            Assert.NotNull(ret);
+
+            var gid = new Group().Retrieves().Where(r => r.GroupName == "Admin").First().Id;
+            ret = await Client.PostAsJsonAsync<string, IEnumerable<object>>($"{gid}?type=group", string.Empty);
+            Assert.NotNull(ret);
+        }
+
+        [Fact]
+        public async void PutById_Ok()
+        {
+            var ids = new User().Retrieves().Where(u => u.UserName == "Admin").Select(u => u.Id);
+            var gid = new Group().Retrieves().Where(r => r.GroupName == "Admin").First().Id;
+            var ret = await Client.PutAsJsonAsync<IEnumerable<string>, bool>($"{gid}?type=group", ids);
+            Assert.True(ret);
+
+            var rid = new Role().Retrieves().Where(r => r.RoleName == "Administrators").First().Id;
+            ret = await Client.PutAsJsonAsync<IEnumerable<string>, bool>($"{rid}?type=role", ids);
+            Assert.True(ret);
+        }
+
+        [Fact]
+        public async void Put_Ok()
+        {
+            var usr = new User { UserName = "UnitTest-Change", Password = "1", DisplayName = "DisplayName", ApprovedBy = "System", ApprovedTime = DateTime.Now, Description = "Desc", Icon = "default.jpg" };
+            usr.Delete(usr.Retrieves().Where(u => u.UserName == usr.UserName).Select(u => u.Id));
+            Assert.True(usr.Save(usr));
+
+            // change theme
+            usr.UserStatus = UserStates.ChangeTheme;
+            var resp = await Client.PutAsJsonAsync<User, bool>("", usr);
+            Assert.False(resp);
+
+            // Login as new user
+            await _factory.LoginAsync(Client, "UnitTest-Change", "1");
+            resp = await Client.PutAsJsonAsync<User, bool>("", usr);
+            Assert.True(resp);
+
+            // change password
+            usr.UserStatus = UserStates.ChangePassword;
+            usr.NewPassword = "1";
+            usr.Password = "1";
+            resp = await Client.PutAsJsonAsync<User, bool>("", usr);
+            Assert.True(resp);
+
+            // change displayname
+            usr.UserStatus = UserStates.ChangeDisplayName;
+            resp = await Client.PutAsJsonAsync<User, bool>("", usr);
+            Assert.True(resp);
+
+            // delete 
+            usr.Delete(new string[] { usr.Id });
+        }
+    }
+}
diff --git a/UnitTest/Bootstrap.Admin/BAWebHost.cs b/UnitTest/Bootstrap.Admin/BAWebHost.cs
index 0b00b610..a7436530 100644
--- a/UnitTest/Bootstrap.Admin/BAWebHost.cs
+++ b/UnitTest/Bootstrap.Admin/BAWebHost.cs
@@ -19,10 +19,10 @@ namespace Bootstrap.Admin
             TestHelper.CopyLicense();
         }
 
-        public async Task<string> LoginAsync(HttpClient client)
+        public async Task<string> LoginAsync(HttpClient client, string userName = "Admin", string password = "123789")
         {
-            var r = client.GetAsync("/Account/Login").GetAwaiter().GetResult();
-            var view = r.Content.ReadAsStringAsync().GetAwaiter().GetResult();
+            var r = await client.GetAsync("/Account/Logout");
+            var view = await r.Content.ReadAsStringAsync();
             var tokenTag = "<input name=\"__RequestVerificationToken\" type=\"hidden\" value=\"";
             var index = view.IndexOf(tokenTag);
             view = view.Substring(index + tokenTag.Length);
@@ -30,11 +30,11 @@ namespace Bootstrap.Admin
             var antiToken = view.Substring(0, index);
 
             var content = new MultipartFormDataContent();
-            content.Add(new StringContent("Admin"), "userName");
-            content.Add(new StringContent("123789"), "password");
+            content.Add(new StringContent(userName), "userName");
+            content.Add(new StringContent(password), "password");
             content.Add(new StringContent("true"), "remember");
             content.Add(new StringContent(antiToken), "__RequestVerificationToken");
-            var resp = client.PostAsync("/Account/Login", content).GetAwaiter().GetResult();
+            var resp = await client.PostAsync("/Account/Login", content);
             return await resp.Content.ReadAsStringAsync();
         }
     }
diff --git a/UnitTest/Bootstrap.Admin/Controllers/ControllerTest.cs b/UnitTest/Bootstrap.Admin/Controllers/ControllerTest.cs
index 359ec469..f3de6ad0 100644
--- a/UnitTest/Bootstrap.Admin/Controllers/ControllerTest.cs
+++ b/UnitTest/Bootstrap.Admin/Controllers/ControllerTest.cs
@@ -12,7 +12,7 @@ namespace Bootstrap.Admin.Controllers
             factory.ClientOptions.BaseAddress = new System.Uri($"http://localhost/{controller}/");
             Client = factory.CreateClient();
 
-            if (login) factory.LoginAsync(Client).GetAwaiter();
+            if (login) factory.LoginAsync(Client).GetAwaiter().GetResult();
         }
     }
 }
diff --git a/UnitTest/Bootstrap.DataAccess/UsersTest.cs b/UnitTest/Bootstrap.DataAccess/UsersTest.cs
index 2536c298..98129979 100644
--- a/UnitTest/Bootstrap.DataAccess/UsersTest.cs
+++ b/UnitTest/Bootstrap.DataAccess/UsersTest.cs
@@ -89,7 +89,9 @@ namespace Bootstrap.DataAccess
         public void SaveUser_Ok()
         {
             var u = new User();
+            u.Delete(u.Retrieves().Where(usr => usr.UserName == "UnitTest").Select(usr => usr.Id));
             Assert.True(u.Save(new User { UserName = "UnitTest", DisplayName = "DisplayName", ApprovedBy = "System", ApprovedTime = DateTime.Now, Description = "Desc", Icon = "default.jpg" }));
+            u.Delete(u.Retrieves().Where(usr => usr.UserName == "UnitTest").Select(usr => usr.Id));
         }
 
         [Fact]