[Douglas Hart]

Can anyone help me answer a question that my auditors are asking

DO you know how GP handles encryption of passwords

Any help is greatly appreciated

Thanks

Doug

——————————
Douglas Hart
Dynamics Administrator
Forex Capital Markets
New York City NY
——————————

[Tom Monfre]

Hi Doug,

When a new user is setup or an existing user changes their password, GP uses the Server Name in the ODBC connector as a key element of the encrypted password.  This is why you have to change everyone’s password when you setup a new server for GP.  The actual encryption method is not published by Microsoft but I know this is the variable factor per user.

——————————
Tom Monfre
Batteries Plus Bulbs, LLC
Hartland WI
————————————————————————-

[Rob Klaproth]

GP encrypts the users password when it is saved to SQL.   The user can not use their GP login for any other purposes.  If the user tries to login to SQL management studio or other tools they will get an invalid password message as only the GP application can decrypt the password once it is saved.  

In addition a salt hash is added to the password with the name of the GP server so when you move to a new server all passwords must be reset.   

This encryption insures additional security beyond what SQL does and prevents users from accessing the database outside of the application.   This allows you to maintain all security controls inside of GP and not have to deal with anything directly in SQL except when customizations or 3rd party products get installed.   

Sent from my iPhone

——Original Message——

Can anyone help me answer a question that my auditors are asking

DO you know how GP handles encryption of passwords

Any help is greatly appreciated

Thanks

Doug

——————————
Douglas Hart
Dynamics Administrator
Forex Capital Markets
New York City NY
——————————

[David Musgrave]

Have a read of the blog post I wrote on the topic:

https://blogs.msdn.microsoft.com/developingfordynamicsgp/2008/10/01/why-does-microsoft-dynamics-gp-encrypt-passwords/

David

——————————
David Musgrave MVP, GPUG All-Star

Managing Director
Winthrop Development Consultants

Perth, Western Australia

http://www.winthropdc.com
————————————————————————-