I use rootpw --iscrypted with my kickstart installs in graphical mode all the time. Here is the first section of my kickstart file:
# Start of snip install url --url http://centosmirror/ lang en_US.UTF-8 langsupport --default=en_US.UTF-8 en_US.UTF-8 keyboard us xconfig --resolution 1600x1200 --depth 24 --startxonboot -- defaultdesktop gnome network --device=eth0 --bootproto=dhcp --hostname myhost rootpw --iscrypted ********************************** firewall --enabled --trust=eth0 --port=22:tcp --port=80:tcp selinux --disabled authconfig --enableshadow --enablemd5 --enablenis -- nisdomain=mydomain --nisserver=nisname timezone America/New_York bootloader --location=mbr --append="rhgb quiet" clearpart --all --drives=sda --initlabel part /boot --fstype ext3 --size=100 --ondisk=sda part pv.2 --size=0 --grow --ondisk=sda volgroup VolGroup00 --pesize=32768 pv.2 logvol swap --fstype swap --name=LogVol00 --vgname=VolGroup00 -- size=1000 --grow --maxsize=3000 logvol / --fstype ext3 --name=LogVol01 --vgname=VolGroup00 -- size=1024 --grow --maxsize=40000 logvol /scratch --fstype ext3 --name=LogVol02 --vgname=VolGroup00 -- size=1024 --grow shutdown # End of snip
Hope this helps, Alfred