GP Password Changes Due to the Upgrade

(0) Share

Report

Posted on by Community Member

Hello:

Over this past weekend, I successfully upgraded our environment from GP 2010 to GP 2013 R2.

We did not move our SQL databases to a new SQL instance. So, why are GP user passwords no longer valid, after the upgrade?

Also, after changing all of the GP passwords for my users, GP would not let them change their passwords in the User Preferences window until I unchecked the "Enforce Password Policy" checkbox in User Setup. Why is that?

Finally, for a handful of users, GP would not let me uncheck the "Enforce Password Policy" checkbox in User Setup. GP, instead, displayed a message saying that this violated domain policy and that I need to check with our A/D administrator. What sort of domain policy would cause this?

Thank you, so much!

John

*This post is locked for comments

All responses (3)

Answers (1)

Community Member on at

Like (0)

Report

RE: GP Password Changes Due to the Upgrade

Thanks, All!

John
Verified answer

Beat Bucher GP Gee... 28,058 Moderator on at

Like (1)

Report

RE: GP Password Changes Due to the Upgrade

Hi John,

You mentioned that you didn't move your GP to a new SQL instance.. .but the have you kept the same ODBC connection to your server from the GP clients ? any changes in the server name in the ODBC connection will disrupt the actual password encryption... the GP pwd is stored in the database tables with an encryption based on the server name that's in the ODBC connection of the GP client...

I solved this problem by using a canonical ALIAS in the DNS... so even after moving the SQL databases to a new server instance, the name remains the same and points to the new system in the DNS. No changes in the ODBC entry.

As for the password lock, this is due to the AD policy that you enforced for some of your users in GP.. if the enforced policy is enabled, than SQL server security will align on the domain AD GPO for pwd policies regarding the strength, complexity and expiration of the password.

You can decide to not use this option, but than your users will never get forced to change their password.

Another way to handle this outside of the SQL security / Domain policy, would be to use the Rockton Software GP Toolbox, as it includes a password manager that allows you to do pretty much the same thing.

As for the password reset to all users, GP Powers Tools (aka SDT) would allow you to globally reset all the user's password in GP and set a new password for everyone, then force them to change it at the next login. This saved me during our last upgrade, as for some strange reasons the trick with the ODBC server Alias didn't worked for some users (not all, some had no issues).
Suggested answer

Bill Campbell 12 on at

Like (0)

Report

RE: GP Password Changes Due to the Upgrade

All the issues you describe here have to do with the AD Policy on the complexity of the Password used by the GP users.

In the past almost no GP user I know of used a complex password. However, almost all users have a complex SQL login. Not that this is wrong, but this is where the two are at odds.

So, between the rules of the complexity of the AD login and the changes to the SQL rules, almost all of the passwords would fail.

Sorry to say that while I don't like it - I get it and have worked around it with our clients.

Best to unmark the Enforce policy until you and your staff understand the AD Policy and have reviewed the requirement in SQL Server for password complexity

Hope this helps.