It seems no one knows the details of the introduced security. Is it possible to get answers from Sage developers?

Hi Serob, 

Thank you for reaching out about this. I've forwarded our Sage 300 escalations and developer team your comments here on this post. Will update you with any news.

Warm Regards, 
Erzsi

Hi Serob, 

Update that the team advised that this is most likely an issue with the Password Policy Settings, we have this article available with the suggested resolution below. If you need anything further, please reach out to the support team directly for assistance. Thanks!
__

Resolution

Thanks for the answer. Actually, in my settings the minimum password age was already 0. I have changed the Maximum password age also to 0 hoping that the passwords of Sage 300 users will not expire anymore.

Did you receive any update related to this issue. I noticed it when l was testing . I am planning to upgrade to Sage 300 v2023 SP3 .  Now am skeptical of doing this change because l still don't have a solution to this problem. 

I cannot update the setting to 0 days because this is not a standalone server and it will be against our Password Policy. Please assist with this issue. I thought SP3 is addressing security issues but its making it worse.

I cannot change this policy as it is managed by our GPO. Changing this will affect the wide organization security policy. Any better recommendations to resolve this issue ? 

My issue is that l cannot change any password for any user or so or any user cannot change password after installing PU3. Any solution to this issue besides setting the security minimum password to 0 ?

Hello SEROB,

A couple of notes to address this issue.. for one.. the upcoming PU4 release will bring back the option in Administrative Services - Users "Password Never Expires".. I would suggest when it is released, that you download and install it.. 

For now, moving the system date back is not the best option.. instead open Local Security Policy - Account Policies - Password Policy and increase the "Maximum Password Age" setting.. the next time you attempt to log in with the Admin password, it will allow you to change your password.. 

Regards,

David C.

Sage 300 Support

Very good decision. Actually there should be given a chance to decide how much is security is needed for each particular case.

Hi David, 

Thanks for responding. I have resorted not to go ahead with PU3, it seems to have many issues e.g. also some 3rd party products might not fully work or function as expected. I will wait for PU4 and see if it will address all these issues for now l will stop at UP1 since UP2 was not officially launched as well.

Apparently on the SQL instance there are ##sage300_LOGIN_ users. Find the admin user / properties / disable 'enforce password policy'. This will explicitly set it to for the user rather than machine wide.

Thanks for this . It was helpful. However, for the Admin password it still does not work