Deleting 'sa' account in Dynamics GP

(0) Share

Report

Posted on by Community Member

Hi All,

Due to some auditing reason, our customer do not want 'sa' account in GP. Can we just delete the 'sa' account and use DYNSA account? I have DYNSA account with 'sysadmin' role assigned in SQL Server and i can perform most of the major activities in GP.

I found that the below actions are required 'sa' account in some blog.
1. Upgrading 3rd party application
2. PSTL

Since i have assigned the 'sysadmin' role to DYNSA account, i can use PSTL without any issue and it didn't check for 'sa' .

For upgrading 3rd party application, is 'sa' account required? Is it hardcoded somewhere in the 3rd party applications? Can't we use DYNSA account for the same?

Thanks,
Anvar

*This post is locked for comments

I have the same question (0)

All responses (5)

Answers (1)

Community Member on at

Like (2)

Report

To my mind, you could grant DYNSA the same access as sa, however you are just replacing one user with another of equal rights...the actual user ID isn't the issue, its the rights that user has? Just change the sa password and make sure only the system administrator has it. Then use DYNSA for all admin tasks within GP.

Was this reply helpful? Yes No
Tim Wappat 5,711 on at

Like (1)

Report

I suspect some 3rd party products may make an assumption that sa is the user with database rights to change tables and permissions. They may have it written in the code that sa must be used for installs/upgrades/admin tasks, rather than embracing the GP security model.

I expect that is what the blog post you mention might be referring to. Perhaps this is less common over time.

Tim.

Was this reply helpful? Yes No
Verified answer

Beat Bucher GP Gee... 28,058 Moderator on at

Like (1)

Report

Tim & Ian are correct..

You can't just 'remove' the 'sa' account from a GP setup.. for one, you just move the issue about security to the DYNSA user, which is probably not the goal, and for two, the 'sa' user is hardcoded in some 3rd-party apps when it comes to setup the application in GP.. i.e. the PSTL library (from Microsoft) requires to use the 'sa' user to perform the setup and some of the functions.. there is chances that some of the apps will stop working if the 'sa' user is deleted from the SQL server.

You could make it inactive, so to re-assure the auditors that no one is going to use it accidnetaly, but still can re-activate the account when in need of.

Was this reply helpful? Yes No
Suggested answer

Sureshn07 702 on at

Like (1)

Report

Hi Anvar,

First of all, User "sa" is a SQL User and "DYNSA" is a GP User. By default, when installing GP, the SQL User "sa" gets Power User privileges in GP, (there is no way to restrict this). This "sa" user you cannot delete from GP. Also, for performing certain tasks in GP, "sa" user login is required.

For your auditing purpose, to make sure no one accesses GP with "sa" user, you have to find some other way which your SQL Server Admin suggests.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

If the 'sa' login will be deleted in SQL while we deleting 'sa' user from GP application, then definitely we should not do this since SQL server may contain any other DB apart from GP. So, we should deal with DYNSA user for most of the tasks. For any 3^rd party upgrade and initial setup installation, I assume 'sa' is required.

Note: For PSTL, i had gone through the log script in GP. There is no need of 'sa' account. Any user with 'sysadmin' role assigned in SQL is fine.

Thank you all for your valuable input on this :-)

Thanks,

Anvar

Was this reply helpful? Yes No