Give users ability to create new users

(0) Share

Report

Posted on by Srinivas Paluri

285

Hi,

I have a user who is set up as a power user in GP and also as a sysadmin on the SQL Server. The user has the ability to create new companies but does not have the ability to create new user or modify user security. When the user goes to Admininstration and clicks on "User", GP is prompting for the system password which is basically asking for the "sa" password. It does not work when the user supplies his password. I don't know what permissions I need to grant the user so that he can access GP security without using the "sa" password. Could someone please help me? Your reply is greatly appreciated.

Thanks.

*This post is locked for comments

I have the same question (0)

All responses (6)

Answers (2)

Suggested answer

Frank Hamelly | MVP... 46,619 Super User 2025 Season 2 on at

Like (0)

Report

Re: Give users ability to create new users

The reason 'sa' rights are required is because a new user account is added to SQL when you add a user to GP. You need to provide SQL admin rights to the User you want to perform 'sa' type setup.

Was this reply helpful? Yes No
Verified answer

Community Member on at

Like (0)

Report

Re: Give users ability to create new users

Granting the user SYSADMIN role should work, the SYSTEM Password is not the SA password, both are two different security measures.

Everything under SYSTEM menu will request a system password unless you have specified otherwise in Tools>> Setup>> System>> System Password.

Was this reply helpful? Yes No
Verified answer

John Lowther 5,122 on at

Like (0)

Report

Re: Give users ability to create new users

Mohammad is dead-on!
To rephrase:
The System password is use by GP as a way to keep "Power Users" out of the main System Setup Items. They can do just about everything else except change items under the System Menu.

Also, the System password and the SA password are to different things and should NEVER (in my opinion) be the same. The SA password gives a users COMPLETE access the the SQL server. You really want to keep that limited to as few people as possible. At my company only two people know the SA password and as a backup (incase the two of us go to lunch and get hit by a car) we keep it written down on a piece of paper in an envelope inside a bank safety deposit box that the company owns. (Note: the two of us tape the envelope and sign across the seal so we can tell if anyone has opened it.)

From reading your post about the rights that you have given your user it seems that you only need one or two more steps. These are:
1) If the SA password and the System Password are the same change one of them ASAP! (This is my opinion and you can ignore it if you so wish.)
2) The only things really left for you to get your user to be able to create new users as you wish is to give them the GP System password, and they should be able to create new users just like you want. However, keep in mind that once they have the GP System password there are several other things under the System menu that they will also be able to get to.

till later,

Was this reply helpful? Yes No
Srinivas Paluri 285 on at

Like (0)

Report

Re: Give users ability to create new users

Thanks a lot guys!!! Right now my "SA" password is same as the system password. I will follow your suggestion and change the system password to something else. But my only worry is, will it mess up some services or create any problems doing so?

Thanks.

Was this reply helpful? Yes No
Victoria Yudin 22,768 on at

Like (0)

Report

Re: Give users ability to create new users

Out of the box there is nothing that uses the Dynamics GP system password automatically, it's simply an additional safeguard to get into 'sensitive' setup windows where you might want an additional level of security. So unless you have a customization that has that password hard-coded (which would be pretty unusual in my experience), changing the password would not cause any issues.

Was this reply helpful? Yes No
Perry Smith - CRi 1,692 on at

Like (0)

Report

Re: Give users ability to create new users

Another item to consider is if you have a user in the SYSADMIN Server Role, they have all of the rights as the sa account. To further secure your system you might want to change the user to the SECURITYADMIN Server role, and add the user to the db_accessadmin and db_securityadmin database roles in each GP database (including the DYNAMICS db)

Perry Smith

Was this reply helpful? Yes No