iDrive tip: Advanced Security vs Standard Security

Today’s tip compares Advanced Security and Standard Security in Dynamics GP Versions 8 and 9.  This does not apply in Dynamics GP Version 10, since security is managed very differently – by tasks and roles – in that version.

In GP 8 or 9, you can choose to manage security by using Standard Security or by using Advanced Security.  The two tools provide different user interfaces, but they accomplish the same tasks; Advanced Security does not extend the GP security model in any way.  Standard Security uses separate dialog boxes that let you control security for a single user or for a user class. Standard Security uses a third dialog box to set access to SmartList favorites. To change security for a dialog box, you must know the exact name of the dialog box and the exact name of the series to which the dialog box belongs. To set security for modified, alternate, or modified alternate windows, you must change views.

Advanced Security provides an explorer-style interface that lets you control different types of security at the same time in the same dialog box, including security for multiple users, companies, and classes and Smartlist security.  Advanced Security provides multiple views that include the By Menu view. The By Menu view lets you set security by using the navigation model. Additionally, changes at upper levels of the tree are automatically rolled down to child resources. You can access modified, alternate, or alternate modified resources by clicking the dictionary that you want to use. And you can do this without changing views.

So why choose Advanced Security instead of Standard Security?

Advanced Security enables security to be set up for multiple users, companies, and classes at the same time. When class changes are made, Advanced Security does not overwrite user-level changes.
Advanced Security lets you set security based on the navigation model.
Advanced Security has a By Alternate, Modified, and Custom view that displays security only for customized resources to make it easier to control access to customizations. When security is granted back to resources, Advanced Security gives you the option to automatically select alternate and modified resources if they exist.
Advanced Security lets you quickly show the resources to which the selected user and company have access. At the same time, Advanced Security lets you show which other users in the company have access to the selected resource.
Advanced Security lets you copy security settings to other companies or users.
Advanced Security lets you roll down class security settings to selected users of a class by using the option to overwrite user-level changes. You can do this by clicking to select the Revert First option.
Advanced Security can roll up a user’s security settings to a class.
Advanced Security can change user security settings back to their initial state.
Advanced Security can verify security settings to make sure that they are valid and that all customizations that are pointed to actually exist.
Advanced Security can export and import security settings between systems or for backup purposes by using .xml files.
Advanced Security can selectively print the security settings for a user and company or for a class.

Here’s a bit more info about Advanced Security:
Q: What is the difference between the views in Advanced Security?
A: The views in Advanced Security let you see the different areas of the system for which security can be controlled. The By Menu, By Dictionary and By Alternate, Custom and Modified views all derive their displays from the same data. A change that you make when you are in any one of these views will be reflected when you are in any one of the other views.

The By Menu view is based on the navigation model of Microsoft Great Plains and of Microsoft Dynamics GP. The By Menu view is a good view to use when you change security, because you cannot easily deny access to system resources or to lookups by mistake.
The By Dictionary view shows all resources in the system. In this view, system resources are sorted by dictionary, by type, and by series. The By Dictionary view can be used to fine-tune security for resources that are not in the navigation model.
The By Alternate, Modified and Custom view shows only the resources that have been customized. Following is a list of resources that can be customized:

• Alternate forms and reports. These resources are created by a developer.

Note In this view, an alternate window will appear under the dictionary for which the window exists instead of under the original dictionary.

• Modified forms and reports. These resources are created by an end user.

• Custom reports. These resources are created by an end user.

Q: Where do I find my alternate and modified windows and reports?
A: Alternate and modified windows are displayed under the original window in the tree structure. To find them, find the original window in the By Menu or By Dictionary view, and then expand the window to display the dictionaries in which the window exists. You can then select which version you want to use. Another way to view alternate and modified windows and reports is to change the view by clicking the down arrow and then clicking By Alternate, Modified and Custom.

Note If a product has no windows of its own and it only has alternate windows or reports, the product will not be displayed in the By Dictionary view.

Q: How do the “Grant Security: All Alternate windows and reports” and “Grant Security: All Modified windows and reports” options work?
A: These options are enabled when access is being granted back to a resource after the access was denied. If there is a single alternate window or report, it will be chosen instead of the original dictionary if the Alternate option is chosen. If there is more than one alternate window or report, Advanced Security keeps to the original version. After Advanced Security chooses a dictionary, a modified version of the window or report is chosen if there is a modified version of the window or report and if the Modified option is chosen.

Q: How can I select classes in Advanced Security?
A: By default, the list in the lower-right section of the Advanced Security dialog box shows only users only. You can change the view by clicking View and then clicking Users and Classes or Classes Only. The default view can be changed in the Advanced Security Options window.

Q: How can I speed up changes by User Class?
A: When you change the security settings by User Class, you are not required to select a company. The changes that you made for the User Class are automatically applied to all the companies of all the users who are assigned to that Class. The performance can be improved while you make the changes by clicking to clear the Display class changes on affected users check box in the Advanced Security Options window. If you do this, you will not see the changes that you made for the Classes as you make them. However, the changes will still be applied if you click OK or Apply. The time to apply the changes will still be the same. However, the changes are not applied to the users while you make the changes to the Class.

Q: How can I use Advanced Security to quickly give access to customizations?
A: To use Advanced Security to quickly give access to customizations, follow these steps:

1. In the Advanced Security Options dialog box, click All alternate windows and reports and All modified windows and reports in the Grant Security section.
2. In the Default Resource View box, click By Alternate, Custom and Modified.
3. Remove access to the resources that are shown in the view, and then grant access back. Removing access and then granting access back grants access to the customizations where they exist.

Note You must look for situations where more than one alternate window or report exists. In these situations, you may want to manually select a resource to use.

Q: Can I hide menu items to which a user does not have access?
A: In Microsoft Great Plains 8.0 and in Microsoft Dynamics GP 9.0, users do not see menu items to which they do not have access.
Note Make sure that security is active for all companies within Microsoft Great Plains and Microsoft Dynamics GP. To verify this, click Tools, point to Setup, point to Company, and then click Company. Make sure that the Security option is selected.

Q: Why do I lose access to my customizations when I click Revert?
A: The Revert option is designed to restore the security to the state in which it was when a user was first created. The Revert option grants access to the unmodified version for all resources except for advanced lookups. Advanced lookups are automatically selected from the Smartlist dictionary. In other words, access to alternate or modified versions of forms and reports is removed, and access to the original is granted back.

Q: What does the Revert Security First option do?
A: The Copy, Rollup, and Rolldown features of Advanced Security include the Revert security first option. If this option is selected, the target entity is granted access to the unmodified version for all resources before the copying occurs. When the copy process starts, only non-default security is copied. A resource that has non-default security is granted access unless you specifically deny access. If you grant access to the original resource, no record is stored in the table for that resource. Therefore, if Revert security first is selected, the target entity grants access back to all resources, and then the denied security and alternate or modified security are applied. This process duplicates the source security.

If Revert Security first is not selected, all the security for the target entity is maintained, and all the denied security and alternate or modified security from the source entity is overwritten. This process actually combines the security records for the target with the records for the source. Remember that the process combines only the non-default security. Therefore, if access is granted to one entity but is denied to another, the result is denied.

Note Default security is used to grant access to the original resource. Non-default security is used when access has been denied or access has been granted to a modified, alternate, or modified alternate version of a resource.

Q: What are some tips and tricks for setting up security within Advanced Security?
A: Following are some tips and tricks for setting up security within Advanced Security:

To reset security to give a user access to all resources, revert the user.
To give access to custom resources, use the By Alternate, Custom and Modified view.
To remove access to sections of the navigation menus in Microsoft Great Plains 8.0 and in Microsoft Dynamics GP 9.0, use the By Menu view.
To fine-tune access to windows that are not directly on the menus, use the By Dictionary view.

Note In Microsoft Great Plains 8.0 and in Microsoft Dynamics GP 9.0, users do not see the menu items to which they do not have visual access.
Note Make sure that security is active for all companies within Microsoft Great Plains and Microsoft Dynamics GP. To verify that this is the case, click Tools, point to Setup, point to Company, and then click Company. The Security option should be selected.

The Knowledgebase, accessible to you on CustomerSource, has a great article that discusses all of the above aspects of security management plus many more.  It’s Article 894705.

Hope this security overview was helpful.  Please let us know if you have any questions.