Quickbooks Permissions issue

[DaiShan]

Ok, We've got a Server 2003 AD set up and all of our users are given plain jane user accounts to do their daily work, however Quickbooks requires power user or higher acount privileges to run. They suggest that I make my users local power users or local admins, but that pretty much entirely defeats the purpose of having user accounts (we don't want users to be able to install whatever they like) When I run the program as a local administrator (using run as) it works fine, however I obviously don't want to give out local administrator account information to our users. I know this is probably something easy that I'm forgetting about, so hopefully one of you guys can point me in the right direction! Thanks in advance.

 

[stash]

Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

 

[Robor]

I'm guessing that stash is right. I'll bet if you allow regular users to write to the \Program Files\Quickbooks directory and/or the registry value it's updating the regular users will work fine. I know where I used to work we had Quickbooks users with regular accounts but we had the database stored on a server.

 

[DaiShan]

Originally posted by: stash
Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

Thanks for the tip, that's actually what I ended up doing and I found the registry values that were being updated. I gave the appropriate permissions to the users group to access these values, and also gave permissions to the QB directory which seems to have alleviated the problem. Intuit apparently has a program that will make the required registry changes automatically, but it didn't work properly on our setup so I had to do it manually. Although I find it more than a little ridiculous that enterprise software is not ready for the enterprise out of the box...

/edit, in order to make this post useful to people in the future, here are the specific changes that I made:

I gave permissions Set Value and Create Subkey to the users group on the following registry entries (start -> run -> regedit) then right click on the following keys in the registry go to permissions select users, and grant the above permissions.

HKLM\Software\Classes\.qpg
HKLM\Software\Classes\CLSID\{E53C85D6-E6D9-4BCF-A632-72062A99AA7F}
HKLM\Software\Classes\QuickBooks.CoLocator.1

Additionally I granted permissions on HKLM\Software\Intuit, I'm not really sure if this is needed or not.

I then gave read/write/delete permissions to the users group on my quickbooks install directory (c:\program files\intuit\quickbooks for me, may be different for you)

This seems to have resolved the issue.

 

[loup garou]

Originally posted by: DaiShan

Originally posted by: stash
Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

Thanks for the tip, that's actually what I ended up doing and I found the registry values that were being updated. I gave the appropriate permissions to the users group to access these values, and also gave permissions to the QB directory which seems to have alleviated the problem. Intuit apparently has a program that will make the required registry changes automatically, but it didn't work properly on our setup so I had to do it manually. Although I find it more than a little ridiculous that enterprise software is not ready for the enterprise out of the box...

You think that's bad...are you using Quickbooks 2006? Have you tried hosting the company file on a fileserver yet? Oh boy...

 

[dawks]

Originally posted by: DaiShan

Originally posted by: stash
Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

Thanks for the tip, that's actually what I ended up doing and I found the registry values that were being updated. I gave the appropriate permissions to the users group to access these values, and also gave permissions to the QB directory which seems to have alleviated the problem. Intuit apparently has a program that will make the required registry changes automatically, but it didn't work properly on our setup so I had to do it manually. Although I find it more than a little ridiculous that enterprise software is not ready for the enterprise out of the box...

/edit, in order to make this post useful to people in the future, here are the specific changes that I made:

I gave permissions Set Value and Create Subkey to the users group on the following registry entries (start -> run -> regedit) then right click on the following keys in the registry go to permissions select users, and grant the above permissions.

HKLM\Software\Classes\.qpg
HKLM\Software\Classes\CLSID\{E53C85D6-E6D9-4BCF-A632-72062A99AA7F}
HKLM\Software\Classes\QuickBooks.CoLocator.1

Additionally I granted permissions on HKLM\Software\Intuit, I'm not really sure if this is needed or not.

I then gave read/write/delete permissions to the users group on my quickbooks install directory (c:\program files\intuit\quickbooks for me, may be different for you)

This seems to have resolved the issue.

Thank you very much! I need something similar to this. While its not a big deal for our home computer, I don't need/want my pops having Admin access, but because he needs Quickbooks for his business, I had to give it to him.

Thanks to stash also, I did not realized you can give permissions to registry keys. Thats new to me!

Learn something new everyday!

 

[MadRat]

Security was added into the registry when they jumped to 32 bit.

 

[DaiShan]

Originally posted by: loup garou

Originally posted by: DaiShan

Originally posted by: stash
Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

Thanks for the tip, that's actually what I ended up doing and I found the registry values that were being updated. I gave the appropriate permissions to the users group to access these values, and also gave permissions to the QB directory which seems to have alleviated the problem. Intuit apparently has a program that will make the required registry changes automatically, but it didn't work properly on our setup so I had to do it manually. Although I find it more than a little ridiculous that enterprise software is not ready for the enterprise out of the box...

You think that's bad...are you using Quickbooks 2006? Have you tried hosting the company file on a fileserver yet? Oh boy...

This is 2006 and it is currently on a file server, however Intuit apparently recommends installing Quickbooks itself on the server and selecting the option that others will connect to this PC for the data. If you just place the .qbw on the file server and share it out Intuit claims there will be a severe performance hit. I personally have not tried this as QB is already on our production servers, and I need to maintain current functionality as the companies split. Specifically what issues were you running in to? (so that others can avoid any potential pitfalls)

 

[gsellis]

OK, now here is how you do it with a cmdline.

1) Run MMC and add the Security Templates control.
2) Create a new template such as QuickBooks and use the Registry explorer section to add the key.
3) As you add the key, it will prompt for the security and you can add Users to have Full Control to the keys you add.
4) Save the template!

The template will be an inf file (QuickBooks.inf) and usually in the default dir of windows\security\template. What you will see is something like this:

[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Registry Keys]
"MACHINE\SOFTWARE\Classes\.qpg ",0,"DAR(A;CI;KA;;;BA)(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KA;;;BU)"

To run it, you need to do this (vb script format - the sRun is the commandline you need chr(34) is a quote):

' Apply security template
sRun = "cmd /c secedit /configure /DB " & Chr(34) & "c:\windows\security\template\quickbooks.sdb" & Chr(34) & " /CFG & chr(34) & "c:\windows\security\template\quickbooks.inf" & chr(34) & " /verbose"
nRtn = WshShell.Run(sRun, 1, True)

cmdline would be
cmd /c secedit /configure /DB "c:\windows\security\template\quickbooks.sdb" /CFG "c:\windows\security\template\quickbooks.inf" /verbose

You can run secedit on any of the XP machines with the inf you created in the Security Templates MMC control. Now it is portable and can be part of you installation kit.

Edit - the smiley above is because there is a : followed by a P in the string

 

[DaiShan]

Wow, great post gsellis!

 

[loup garou]

Originally posted by: DaiShan

Originally posted by: loup garou

Originally posted by: DaiShan

Originally posted by: stash
Use regmon and filemon to figure out what is causing Quickbooks to require admin access. Usually it just needs write permissions to a specific file system or registry location. Once you make the change, regular users will be able to run it, while maintaining the security of the system and network.

Thanks for the tip, that's actually what I ended up doing and I found the registry values that were being updated. I gave the appropriate permissions to the users group to access these values, and also gave permissions to the QB directory which seems to have alleviated the problem. Intuit apparently has a program that will make the required registry changes automatically, but it didn't work properly on our setup so I had to do it manually. Although I find it more than a little ridiculous that enterprise software is not ready for the enterprise out of the box...

You think that's bad...are you using Quickbooks 2006? Have you tried hosting the company file on a fileserver yet? Oh boy...

This is 2006 and it is currently on a file server, however Intuit apparently recommends installing Quickbooks itself on the server and selecting the option that others will connect to this PC for the data. If you just place the .qbw on the file server and share it out Intuit claims there will be a severe performance hit. I personally have not tried this as QB is already on our production servers, and I need to maintain current functionality as the companies split. Specifically what issues were you running in to? (so that others can avoid any potential pitfalls)

If you don't install the full product on the server hosting the company file (I'm ok with just the db services, even if they are based off of SQLAnywhere, but why do I have to install the entire client product???), the file is never really hosted off of the server. The documentation states that if you run in this "alternative" mode, the client PC that opens it hosts the file to others who subsequently open it. Bad form. Not to mention this totally shuns those who were formerly hosting their company file on non-MS servers or NAS devices. It just leaves a bad taste in my mouth.

Also in the realm of various gripes, I've experienced various permission errors while installing and printer troubles...I have to edit one of the ini files every time an update is performed to re-enable collating so one PC can print 3-copy checks on a LJ 1100, and the user still has to trick the program into printing correctly.

Oh, and performance sure seems a lot slower than the older version they had been running (I believe 2002?).

I have to say, this is one of the worst "upgrades" I've ever seen to a product line. I've encouraged my other clients to stick with their older versions of QB and some have switched to PeachTree, which I am relatively unfamiliar with but seems to have its own quirks.

 

[DaiShan]

I definitely feel your pain. I just spent the past 3 hours wrangling with moving our data files to the new server and applying updates, the whole thing was just a huge mess, it's working now but I just don't understand why Enterprise software was not developed with the Enterprise in mind...

 

[RebateMonger]

People I trust who are both IT experts and accounting software experts have recommended that their clients SKIP Quickbooks 2006 completely. They've issued at least six revisions of Quickbooks 2006 to end problems such as wiping out Servers and Computers and data loss. Last I heard, QB2006 had wiped out at least 1000 customer's comptuers, trashing the Registry.

An update to Quickbooks 2006 R4 wiped out a client's brand new SBS 2003 Server that it was installed on. The client was doing a Quicken update while on the phone with Intuit, when the Server rebooted itself. He spent an entire day with Quickbooks and Dell support trying to fix the trashed Registry, before asking me to re-install SBS from a backup.

 

[dawks]

Originally posted by: RebateMonger
People I trust who are both IT experts and accounting software experts have recommended that their clients SKIP Quickbooks 2006 completely. They've issued at least six revisions of Quickbooks 2006 to end problems such as wiping out Servers and Computers and data loss. Last I heard, QB2006 had wiped out at least 1000 customer's comptuers, trashing the Registry.

An update to Quickbooks 2006 R4 wiped out a client's brand new SBS 2003 Server that it was installed on. The client was doing a Quicken update while on the phone with Intuit, when the Server rebooted itself. He spent an entire day with Quickbooks and Dell support trying to fix the trashed Registry, before asking me to re-install SBS from a backup.

What do you suggest as an alternative?

Is Microsoft Small Business Accounting any good? Other then a 25 Employee limit for payroll..

 

[DaiShan]

FWIW: I was mistaken, we have version 6, not 2006. I've had some weird issues with it, but nothing as bad as what I'm hearing about 2006. One major thing that I have a problem with: Everytime the server is rebooted, or any changes are made to the quickbooks files that run on the server (updates), I have to manually open the data file on the server and then close Quickbooks. If I don't do this none of my users are able to get on. Intuit calls this a "feature" rather than a bug. I personally call it a load of crap since I'm much too busy to do this very often. I in herited this system from my client's last sys admin, so I don't know how often I'll have to do this. I'm hoping not very.

 

[Brazen]

I like gnucash.