We're running Great Plains and just converted to 9 from 7.5 which included a
conversion of SqlServer 2000 to 2005. I'm having an issue with users in that
2005 now encrypts and we imported the users and they periodically get a
message that the account is locked out. I have to go into Management studio
and unlock, then run to Great Plains and reset the password. It seems
awfully complicated, has anyone else had this issue?

What I wanted to know is what rights/priviledges/credentials/shoe size a
user has to have to connect through management studio. On 2000, I could
connect to Great Plains AND to SS with my regular username (petel) instead
of sa. I wanted to do that on 2005.

Hi Pete,
From your description, I understand that:
You encountered the periodically account lock issue on your SQL Server 2005
after your SQL Server 2000 users were imported to the SQL Server 2005. You
wanted to know what rights/priviledges/credentials a user has to have to
connect through SQL Server Management Studio. You could connect to your
GP9.0 and SQL Server with your regular user name instead of sa.
If I have misunderstood, please let me know.

I would like to know how you perform the importation of users. I think that
the users you said here means logins of SQL Server, right?
I recommend that you transfer your logins and passwords between your SQL
Server 2000 and 2005 by this article:
How to transfer logins and passwords between instances of SQL Server
http://support.microsoft.com/kb/246133/en-us

Also, you can create new SQL Server logins in SSMS (SQL Server Management
Studio) via:
1. Log on your SQL Server 2005 with a sysadmin account.
2. Expand the Security folder, right click the logins folder, click New
Login..., input the login name that you want to create, select SQL Server
authentication, and input password; if you want the new created login is a
sysadmin, you can assign the sysadmin role at the Server Roles option;
otherwise switch to the User Mapping, assign the login account with
appropriate permissions on your selected databases.
3. After create the login, you can log on your SQL Server 2005 with it.

If you have any other questions or concerns, please feel free to let me
know. It is my pleasure to be of assistance.

Charles Wang
Microsoft Online Community Support

======================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================

Hi,

I am interested in this issue. Would you mind letting me know the result of
the suggestions? If you need further assistance, feel free to let me know.
I will be more than happy to be of assistance.

Have a great day!

Charles Wang
Microsoft Online Community Support

Charles Wang had asked me to respond..
        I am interested in this issue. Would you mind letting me know the
result of
        the suggestions?

Well, it turned out to be simpler than that. In the user setup in Great
Plains under Setup/System/User, there's a box for "Enforce password policy".
I was confused because I ONLY thought that this had to pertain to password
policy, not Account Threshold/Lockout policy. If this is unchecked in Great
Plains, you have three tries or the APPLICATION throws you out, but doesn't
lock the account at the database level. If this is checked, then it uses the
Active Directory settings for Account lockout and timeout threshold settings
and would lock the signon at the database.

What is kinda hard to believe (from Knowledgebase article 922456):
Q14: Why do I receive the following error message when I log on to Microsoft
Dynamics GP?
This user account has been locked out. Contact your system administrator for
assistance.
A14: This problem occurs because the number of times that you tried to log
on to Microsoft Dynamics GP exceeds the requirement of the Account Lockup
Threshold domain policy.

Q15: How do I unlock a user if the user is locked out of the system?
A15: To unlock the user, use one of the following methods.

Method 1 . To unlock the user, wait until the account lockout duration time
has passed.


And this from the same document:
Q5: How do the Account Lockup Threshold and the Account Lockup Duration
domain policies relate to Microsoft Dynamics GP?
A5: The Account Lockup Threshold policy specifies the number of times that a
user can type an incorrect password before the user is locked out of the
system. The Account Lockup Duration policy specifies how long a user is
locked out of the system after the user types an incorrect password.

Notes . Microsoft Dynamics GP sends the user's password to SQL Server four
times to try to log on to Microsoft Dynamics GP. Therefore, if you want the
user to be locked out after three times, you must set the requirement of the
Account Lockup Threshold policy to 12



What this means is:
1. If you use Active Directory to control network access, you have to change
your setting FOR THE WHOLE NETWORK even if the "whole network" doesn't use
Great Plains. It's either that or REMOVE THE SERVER FROM THE DOMAIN.
2. Don't use the advanced security features in Great Plains/SqlServer2005
because it's not well implemented.

Sorry, Charles for being rather blunt, but that's how it turns out.

Hi Pete,
Thank you very much for your updating and response.

I can understand your issue now. It is most likely a product issue of GP.
Per my experiences, I have not found any issue regarding this on SQL Server
2005.

For now, I am afraid that you may be not able to use the advanced security
features in your GP. I recommend that you give Microsoft feedback on this
issue:
Submit Your Feedback and Suggestions about Microsoft Dynamics and Related
Business Products
http://www.microsoft.com/dynamics/community/product_suggestions.mspx

Please feel free to let me know if you have any other questions or
concerns. It is my pleasure to be of assistance.

Charles Wang
Microsoft Online Community Support

======================================================
When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================

View results of Dynamic SQL in Management Studio
SQL 2005 Management Studio can't edit text rows with > 4000 charac
backup again
SQL 2205, Profiler and Deadlocks
Utility for Table Schemas