New User: Administration - Best practices for security, disaster recovery, maintenance and upgrades

Transcription

1 New User: Administration - Best practices for security, disaster recovery, maintenance and upgrades Security Considerations: Windows SQL Server Sage Fund Accounting The implementation of Sage Fund accounting incorporates components from Windows, SQL Server and Application security. Windows Security: When the Sage Fund Accounting Server Installation is complete, a folder is created on the server that contains shared information and Workstation setup files. This information is installed to C:\MIP SHARE by default. This folder must be shared with those users that will be using the software. To facilitate management of the permissions on this share, it is recommended that a group account called Accounting or something similar be created and permissions granted to the group account rather than individual user accounts. By doing so, adding and removing permissions can be controlled through membership in the group. SQL Server Security: During a new SQL Server installation, the default system administrator account ( sa ) is created. It is required that a password be provided by the administrator/installer. Important! The System Administrator, ( sa ) account should always have a secure password on any production SQL Server maintained and guarded by the network administrators. When the Sage Fund Accounting Server installation is complete, a user account is created on the SQL Server called NpsAdmin. This is the SQL Server login that the Sage Fund Accounting application uses for operating on the SQL Server. NPSAdmin operates under the context of the System Administrator server role, meaning that it has implied access to all databases and objects. NOTE: This account should never be deleted and its password should never be changed. Doing either will cause the Sage Fund Accounting application to stop functioning. Page 1 of 20

2 Sage Fund Accounting Application Security: The Application has two types of security, System and Organization. The following sections will help you determine in which database menu selections are stored. System Security System Security refers to security stored in the NPSSQLSYS database, which is installed with the Application. Therefore, you will have one system database for all organizations you create. This also means that system security changes, like setting up a user, will only have to be done once, and then it is available in multiple organizations. System Security rights are independent of the organization that the user is logged into. System rights stay with the user irrespective of the organization they are logged into. ID Select an existing user from the drop-down list. Set Up Menus Box This box displays the Administration menus. The Accounting and Payroll are not available. Double click on an item (or single-click on the plus (+) sign next to the item) to expand the outline. When an item has been expanded, the plus (+) sign becomes a minus (-) sign. To collapse an item, simply double-click its name, or single-click the minus sign. To the right of each item, the Application displays the letters V, E, D, A, and P. These letters indicate which rights the user has for that particular menu selection. They appear black if all of the sub-levels are assigned, and gray if only some of the sub-levels are assigned. The letters do not appear at all if none of the sub-levels are assigned. The rights are abbreviated as outlined below. Rights Highlight a menu selection in the Set Up Menus box, and then select the check boxes to grant the user various rights. View Existing Records (V) Allows you to open and review a previously entered item. Edit Existing Records (E) - Allows you to change information for a previously entered item. Delete Existing Records (D) - Allows you to delete a previously entered item, thus removing it from the database. Add New Records (A) Allows you to enter new items Process Records (P) Allows you to perform a process. Page 2 of 20

3 Description The Application displays a description of each menu selection, as it is highlighted. Copy System Security Copy System Security button will make a copy of the system security rights for the selected user to a different user. Copy From User ID Select the existing user ID to copy. Copy To User ID Enter an existing ID for the user that will have the same security settings as the Copy From User ID Organization Security Organization Security refers to security stored in the organization database. This database is created when you create an organization (File> New Organization). Therefore, you will have one organization database for each organization created. This also means that Organization Security changes must be made in each organization. Use this Organization Security form (Administration> Security> Set Up Organization Menus) to set up security rights for a user or a group in the active organizations. This form allows you to set up rights specific to the opened organization in Administration, Accounting and Payroll. You can also grant SafeKey rights. A user has no rights in an organization until you open the organization and assign the rights on this form. Page 3 of 20

4 SafeKey rights allow a user to access Accounting and Payroll tables for the active organization. This access is read-only. Therefore data cannot be changed. With these rights, the user may access the Accounting and Payroll data using Access, Excel, Word, etc. If a user is selected, that is part of a group, and the Display All Rights check box is selected, the Set Up Menus box includes both the user s individual and group rights, referred to as cumulative rights. Cumulative rights are all security rights assigned to a group and to an individual user. ID Select a user or group in which to assign organization rights. If User is selected in the type box, the drop- down contains a list of existing users in the active organization If Group is selected in the type box; the drop-down list contains a list of existing groups for the active organization. Display All Rights - Select this check box to display all rights at the same time. When this option is selected, none of the Rights check boxes are available. If User is the type and this check box is selected, the Application displays the users individual rights and the rights of any groups they belong to. If Group is the type, this check box is not available, but the Rights check boxes are available. Set Up Menus Box - This box displays the Administration, Accounting, Payroll, and SafeKey menus. To the right of each item, the Application displays the letters V, E, D, A, and P. These letters indicate which rights the user has for a particular menu selection. The letters appear black if all the sub-levels are assigned, and gray if only some of the sub-levels are assigned. The letters do not appear at all if none of the sub-levels are assigned. Rights Highlight a menu selection in the Set Up Menus box, and then select the check boxes to grant the user various rights. View Existing Records (V) Allows you to open and review a previously entered item. Edit Existing Records (E) - Allows you to change information for a previously entered item. Delete Existing Records (D) - Allows you to delete a previously entered item, thus removing it from the database. Add New Records (A) Allows you to enter new items Process Records (P) Allows you to perform a process. Page 4 of 20

5 Description - the Application displays a description of each menu selection, as it is highlighted. Group Assignments the Application displays group names for the group in which the user is a member, if appropriate. Tips To remove all rights for a user, select each menu item and then deselect all check boxes, or delete the user with Security> Maintain Users. Some rights depend on other rights; the Application automatically selects or deselects options. For example, if you select the Edit check box, the Application selects the View check box too. Be sure to limit the right to set up security to appropriate users. Otherwise, a user can gain unauthorized access to change personal security rights. You can assign rights to a main menu to give the user rights to all of those menus selections. For example, if you select Reports and assign rights, those rights are applied to all available menu selections in the Reports menu. A user or group cannot be added using this form. Use Security> Maintain Users or Maintain Groups to add a new user or group. In order for security changes to take effect, close the active organization and then reopen. Page 5 of 20

6 Advanced Security Set Up Account Level Segments You may use Set Up Account Level Segments (Administration>Security>Set Up Account Level Segments) to activate account level security and to specific segments for the active organization. If the Activate Account Level Security check box is selected, choose the Segments and to Allow Access or Deny Access for the open organization. If the Activate Account Level Security check box is not selected, the account level security feature is inactive for the organization. Consequently, all users have access to all accounts. Activate Account Level Security You can select this check box to turn on account level security for the activate organization. If you are using this feature and then decide to turn it off, the Application will retain all security set up depending on how you respond to a system message. Account level security is addressed by the Application at three levels. To apply security at the: Organization Level select Activate Account Level Security on the Set Up Account Level Segments form. Segment Level select the segments. User Level Select Enable Account Level Security on the Security> Set Up Account Level Security form. Account Level security will not be active unless you select Enable Account Level Security (Security> Set Up Account Level Security>User or Group) and at least one segment, Segments The Application displays all segments for the active organization. After you have selected the Activate Account Level Security check box, choose the segments requiring account level security. You will select segments to grant or deny to specific users and groups (if appropriate) as selected at Security> Set Up Account Level Security. Segments that you do not select here are filtered out and do not display on the Security> Set Up Account Level Security form. Options: Allow Access, Deny Access Select either of these option buttons depending which option is desired. If the majority of users and groups will be granted access to accounts, select the Allow Access option button. If the majority will be denied access to accounts, select the Deny Access option button. Page 6 of 20

7 The option will reduce the number of accounts that you will need to select on Security> Set Up Account Level Security. For example, if the active organization contains a segment named Fund, and Fund and Allow Access are selected, then Security> Set Up Account Level Security will display only accounts for the Fund segment. You will be ready to grant access to the available Fund accounts. Alternatively, if Deny Access is selected, the form will still display Fund accounts but you will deny access to the applicable accounts. Print Disclaimer on Report Select this check box to print the disclaimer on the bottom of every report that will have account level security applied to it. Account Level Security is enforced on most reports (all except list reports). The disclaimer is: Disclaimer: This report can be affected by Account Level Security. Security Application If you make changes to Set Up Account Level Segments, the changes are applied immediately to reports. However, your changes will not be applied to other forms (e.g. transaction entry or Set Up Account Level Security) until the user interface entry form is closed and reopened. Page 7 of 20

8 Set Up Account Level Security This form is only available if Activate Account Level Security and at least one segment was selected on the Security> Set Up Account Level Security form. You may use Set Up Account Level Security (Security>Set Up Account Level Security) to grant or deny a user or group access to accounts. Select a type (user or group), and then a user or group ID. The ID is determined when the user or group was created (Security> Maintain Users or Maintain Groups). Type Select a type of user or group. ID Select the user or group to assign account codes. This ID was assigned when the user or group was created (Security> Maintain Users or Maintain Groups). Enable Account Level Security Select this check box to activate account level security to accounts for the selected user. If you want to set up account level security, but do not want to apply it immediately, do not check this box. This check box is only available if User is selected in the type box. Display All Accounts Select this check box to view both user and group accounts for each user. The group ID appears in the Groups column of the Selected Items box. This check box is only available if User is selected in the type box. Allow/Deny Access To Accounts This title changes depending on what option was selected previously in Security? Set Up Account Level Segments. Available account codes are being filtered according to the segments selected on that form. If the title is Allow Access to Accounts, the user or group is granted access to account codes moved to the Selected Items box. If the title is Deny Access to Accounts, the user or group is restricted from account codes in the Selected Items box. This entire group box is disabled if the Display All Accounts check box is selected. Page 8 of 20

9 Tips Even is Account Level Security is set up for a group, and the user ID is assigned to that group, Account Level Security will not work for the user until the Enable Account Level Security check box is selected, with or without codes selected, as part of the set up of Set Up Account Level Security. To print the data entered in Set Up Account Level Segments or Set Up Account Level Security, use Reports>Lists>Account Level Security. When you make changes to Set Up Account Level Segments or Set Up Account Level Security, you must close and reopen to see the changes on any transaction entry forms or on the Set Up Account Level Security form. The Application applies the changes immediately on any reports. If your System Administrator makes administrative-type changes (e.g. to users or Chart of Account codes), all users Account Level Security is updated, regardless of whether or not the System Administrator s change directly affects them. Therefore, your users may experience slower performance and may need to close and reopen the form they are currently using. Copy Account Level Security The Copy Account Level Security button will make a copy of the account level security rights for the selected existing user or group ID to a different existing user or group ID. You can copy between a User ID and a Group ID and vice versa. You may not copy to a new ID. Copy From ID Select an existing user or group ID to copy. Copy To ID Select an existing user or group ID to copy to. Page 9 of 20

10 Utilizing Account Level Security Account Level Security is enforced on most reports (except list reports) and in areas of transaction entry. Some of the Application wide processes that Account Level security is not enforced on include: Posting (Activities>Manage Sessions) Copy/reverse sessions (Activities>Manage Sessions) Payroll functions Budget worksheet creation and transfer (Activities>Create Budget) Maintain forms except Chart of Accounts Codes Select A/P invoices to pay (Activities>Check Writing>Select AP Invoices to Pay) Void checks (Activities>Check Writing>Void Checks) Process allocations (Activities>Process Allocations) Process fixed assets (Activities>Process Fixed Assets) Process A/R billing groups (Activities>Process AR Billing Groups) Reconcile cash accounts (Activities>Reconcile Cash Accounts) When printing reports with Account Level Security enabled, your reports may contain incomplete information. The content of reports is limited to the segments the User can report on. Reports The Application provides numerous report selections so you can create custom reports that satisfy the reporting needs in your organization. This reporting gives you the flexibility you need, from specifying which columns appear, to sorting and totaling the information presented. You control the output so you get just the reports you want. Security List Use this report to obtain a list of users and their security rights. It lists all menu selections that the user has rights to for the open Organization. User Information List Use this report to obtain a list of users and other data that is set up with Security> Maintain User. Group Information List Use this report to obtain a list of groups and other data that was set up using Security> Maintain Groups. Security List - Use this report to obtain a list of users and their security rights that you set up using the User>Set Up Security menu item. Page 10 of 20

11 Account Level Security List Use this report to print a list of users and groups and their account level security settings. Account level security was set up and activated using the Security>Set Up Account Level Segments and Set Up>Account Level Security forms. Application of Account Level Security The Application applies Account Level Security to all reports except list reports. Account Level Security is also applied to all transactions. The items listed below are not subject to Account Level Security: File Menu items Maintain Menu: Vendors Customers Charge codes Billing codes Allocation codes Custom depreciation codes Asset types Designation codes Assets Address codes Item codes Chart of Account codes Distribution codes Offset Account Assignments Closing Account Assignments Account Code Combinations Activities Menu: Check Writing>Select A/P Invoices to Pay Check Writing>Pay Selected A/P Invoices Check Writing>Void Checks Purchase Order Writing Process A/R Billing Groups Manage Sessions Reconcile Cash Accounts Create Budget Close Fiscal Year Produce Vendor 1099 s Process Allocations Process Fixed Assets Payroll & Administration Page 11 of 20

12 Disaster Recovery: MIP DATA - What is it, where is it? MIP data is stored in a SQL Server database. The location can vary from system to system due to the flexibility of SQL Server, but the default installation location is: C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA Data files exist in pairs with an mdf, and ldf extension. It is important when installing/upgrading to consider the location of the SQL databases to allow for growth, and backups. Page 12 of 20

13 MIP Tools: Backup/Restore MIP has a built in backup utility that allows users with proper security permissions, to backup their database at any moment. All users with administrative rights are asked each time they exit the software if they want to backup the database. What this utility does is to create a file with an nps extension that is a backup of the company database. The tool will allow the selection of the NPSQLSYS database, and any other company databases from a dropdown list, to be backed up. The backup will use the default location of : C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Backup unless the ellipse is clicked, and a different location is browsed to. There is also a Restore utility that is used to restore a backup created from within the MIP software. The menu is available as seen below: NOTE: The built-in Backup/Restore tools in no way substitute for, or replace the network backup managed by the IT staff of the organization. Page 13 of 20

14 Data Integrity Checks: DI checks can be run within the Administration module using the following menu options: The list will vary based on the modules you are licensed for. The procedure is to click the three check button to select all, then click start. NOTE: All users must be out of the system to perform the DI Checks. Page 14 of 20

15 Data Consolidation (Purge): Information to be found in Sage KB article: It is recommended to discuss with JMT consultant or Sage. IMPORTANT NOTES: Consolidate Transaction History replaces old detailed transactions which contained audit-trail information with new consolidated transactions which have none of that audit trail information. If you consolidate on a monthly basis, you may not get as much of a reduction in the size of your database as you might expect because, for example, an account with a single transaction in it for a month will have that single transaction replaced with another monthly consolidated transaction. However, if you consolidate the same database on a Yearly basis you would see more reduction in size as the same account that had a single transaction in each of 12 months would see those 12 transactions replaced by a single yearly consolidated transaction. Network Backup: Network backup practices vary among organizations, but there are some basic premises to be discussed that will allow you to select the strategy that best fits your organization. The questions you want to ask are: - What are our expectations for data restoration if required? (How far back can we go?) - Frequency/Schedule (How often do we back up? When?) - Onsite vs - Offsite Open a dialogue with IT, and document the procedures! Upgrades: SAGE AUTO UPDATE Sage Auto Update was released with v11.0 of Sage Fund Accounting. The Auto Update tool enables users to keep their Sage products up to date with the latest releases and updates. Sage Auto Update recognizes the Sage products you have locally installed and lists the updates available for those products. If you have a current Sage Business Care Plan for a product, you can download and install the updates available. In Sage Auto Update, the Configuration window allows you to adjust various settings: Schedule for when and how often Sage Auto Update checks for updates Timeout values for update checks and downloading updates Location where downloaded updates are stored Global and product-specific actions to perform, such as Notify, Download, or Download & Install. Proxy server settings and credentials notifications so you can be notified when an update is available, downloaded, or installed Page 15 of 20

16 Configuring Sage Auto Update on a Server: Update Settings Select Configuration>Update to choose when the service will check for updates. You can also specify how long the service is allowed to be inactive before timing out when checking for updates and/or downloading. Download Settings Select Configuration>Download to specify where you would like the service to save downloaded files and/or to set download actions. Proxy Settings If you would like Sage Auto Update to use a proxy server, select Use Proxy Server. To configure the proxy settings, click Configure Proxy Settings and enter the Proxy Server Address. You can also click Configure Proxy Credentials to enter a user name, domain, and password for the proxy server. Notification Setup on a Server Notification only To configure Sage Auto Update to send notifications when updates are available, use the following steps: 1. Open Sage Auto Update. 2. Click Notification in the Navigation Pane. 3. Complete the SMTP configuration form with server, port, and information. Note: Select Enable SMTP over Transport Layer Security (STARTTLS) if you want securely send notifications using Secure Sockets Layer (SSL). The SMTP sessiousing an unencrypted channel. If you check this box, the client sends a STARTTLS comthe server to change to secure communication using SSL. Note: Select Use Custom Credentials to specify credentials to use to connect to the Sserver. 4. Under Notification Type, list the addresses of the persons who should receive a notification in the Updates Available field. Notification with download To configure Sage Auto Update so that available updates are automatically downloaded to your server, use the following steps: 1. Open Sage Auto Update. 2. Click Notification in the Navigation Pane. 3. Complete the SMTP configuration form with server, port, and information. Note: Select Enable SMTP over Transport Layer Security (STARTTLS) if you want to securely send notifications using Secure Sockets Layer (SSL). The SMTP session starts using an unencrypted channel. Page 16 of 20

17 If you check this box, the client sends a STARTTLS command to the server to change to secure communication using SSL. Note: Select Use Custom Credentials to specify credentials to use to connect to the SMTP server. 4. Under Notification Type, list the addresses of the persons who should receive notification in the Updates Downloaded field. Notification with download and installation To configure Sage Auto Update so that available updates are automatically downloaded and installed to your server, use the following steps: 1. Open Sage Auto Update. 2. Click Notification in the Navigation Pane. 3. Complete the SMTP configuration form with server, port, and information. Note: Select Enable SMTP over Transport Layer Security (STARTTLS) if you want to securely send notifications using Secure Sockets Layer (SSL). The SMTP session starts using an unencrypted channel. If you check this box, the client sends a STARTTLS command to the server to change to secure communication using SSL. Note: Select Use Custom Credentials to specify credentials to use to connect to the SMTP server. 4. Under Notification Type, list the addresses of the persons who should receive notification in the Updates Installed field. Sage auto update on the client/workstation are similar. Note: It is recommended that you do not configure notifications on your workstation. If you would like to configure your settings, you should include an IT technician or person with access to the server because the configuration should solely reside on the server. Note: In some cases, updates for the server component may be disabled on the client computer to prevent you from downloading and installing on the wrong computer. Downloading Updates You must be on version 11.0 and higher to see the Sage Auto Update Console. Once installed, the Sage Auto Update Console can be found in two places: 1. The Sage AU console was installed on all Sage Fund Accounting servers and workstations with your v11.0 upgrade. You should see a small disc and yellow arrow icon running in your system tray or under Start>Programs>Sage>Sage Auto Update Console. Click the icon, wait for about 15 seconds for the console and service to authenticate and launch. Page 17 of 20

18 2. You can also locate Sage Auto Update under Windows Start>All Programs>Sage>Auto Update>Sage Auto Update Console. Make sure that you launch the application as administrator. It shouldn t take longer than a minute to see the console. Click Manage Updates; if there is nothing listed under Available Updates, click the Check for Updates button. The system will verify the installed version on your server and check if there is anything newer. When the update displays, it will show critical information such as version of the update, your current version, and description: Page 18 of 20

19 Once you see the available update, click Configuration and then Download to confirm where the update is going to download. It is suggested that you keep the default location, C:\Sage Auto Update, where C represents drive on your server. Next you can download the update. Click Manage Updates, then select the product line and click Download Only. The download will then begin. Depending on the speed of your computer and your network, this may take anywhere from 15 minutes to an hour to download the files. You will see a bar at the bottom of the screen showing the progress of the download. Page 19 of 20

20 When the download is complete, you will receive the confirmation and you can proceed to install. Page 20 of 20