A few weeks ago I embarked on a series of posts on SQL scripts I use when restoring Dynamics AX databases from one environment to another. We have covered a variety of topics including various configuration and setting changes to Dynamics AX. This post will be the last in the set of “data cleanup scripts” designed to help scrub your data for use in a development or testing environment.
Disabling users.
Quite often companies or partners will require access to development environments to be restricted to a very select group of users that are aware of what to test and are also careful enough to work methodically in the correct environments (i.e. not trying to to real work in the wrong environment or test work in production). To ensure all of the above one could follow a few paths.
- Only provide a shortcut/configuration to users who require it.
- Color code your environments so that they immediately recognizable.
- Add a startup message to your AX environment to warn users what environment they are logged into.
All of these solutions do not physically stop users from accessing the alternate environment. So if you need an additional security mechanism, simply disable the users either manually in AX after doing a restore or disable then along with the SQL scripts we have been building up over the past few weeks.
To disable users in AX navigate to “System Administration -> Common -> Users -> Users. Double click on the user in question, click “edit”, uncheck the “enabled” button.
The accomplish the same in a SQL script you can do the following. I have parameterised the SQL for easier reuse or adjustment.
--List of users separated by | to keep enabled, while disabling all others
Declare @ENABLE_USERS NVarchar(max) = '|Admin|TIM|'
update userinfo set userinfo.enable=0 where CharIndex('|'+ cast(ID as varchar) + '|' , @ENABLE_USERS) = 0
--List of users separated by | to disable, while keeping all the rest enabled all others
Declare @DISABLE_USERS NVarchar(max) = '|BOB|JANE|'
update userinfo set userinfo.enable=0 where CharIndex('|'+ cast(ID as varchar) + '|' , @DISABLE_USERS) > 0
Note 1: Parameterising a list can be tricky in TSQL, so the above trick is what i found easiest.
Note 2: You will need to decide whether the list of users provided is inclusive (i.e. provide the list of all the users you WANT to disable) or exclusive (i.e. disable all users except for a small subset). I have provided both options, but would recommend the exclusive approach as it is more likely to give you safely give you what you expect.
I hope this assists you and will be useful in your management of your AX environments. Keep an eye out for new posts in this series!
View Previous – AX DB Restore Scripts #7 – Setting Email Templates and User Email Addresses
We have a need to add accounts that are not currently in production. Ideally since these are test accounts they would be imported from a CSV file. Ideally we would then be able to apply security roles such as Admin or specific business roles. Thanks for the great series of posts and let me know if this is something you have explored in the past.
-Ryan
Hi Ryan. I haven’t managed to script this yet. However one option would be to make use of “Active Directory Groups” in AX. Basically you could do the following
1. Create an Active directory user group e.g. “TestUsers” and add all the relevant users to it in AX.
2. In production create a user of type AD Group in AX with the alias used above. Assign the relevant security roles to this group
3. Disable this Group user in Production.
4. After doing a restore to Test/Dev enable this group.
The result will be that any user in this AD group will be auto-created in AX Test/Dev when they try to access it.
I hope this helps
We have a need to add accounts that are not currently in production. Ideally since these are test accounts they would be imported from a CSV file. Ideally we would then be able to apply security roles such as Admin or specific business roles. Thanks for the great series of posts and let me know if this is something you have explored in the past.
-Ryan
Thank-you very much we will give that a try. I had not considered that and it sounds like a great idea! Great to have your expertise.
-Ryan