What is the QuickBooks QBDataServiceUser and Do I Need It?

Occasionally I’ll get a query from a security-conscious client who says that they have found a user account that mysteriously appears, called QBDataServiceUser (often with a number appended to the name). They want to know why it shows up and what they should do about it.

Starting with the 2006 release of QuickBooks (in the US edition, later in non US editions), Intuit changed the database system to use a SQL based system called SQL Anywhere, from Sybase.  This is an embedded database system that developers can use to manage their database, limiting direct access (for security reasons) to the program that uses it. The QBDataServiceUser is related to the management of the database.

Why Does This Account Exist?

With QuickBooks you can run the software in two “modes” – single user or multiple user. If you select multiple user then QuickBooks will create a new Windows user account and start a separate copy of the database manager as a Windows service.

Essentially, the QBDataServiceUser account is created to manage the separate database manager service and allow it to provide services to any user that logs in to this Windows system. You should only find it on a workstation or server that is hosting the database – and it is important that only one computer is acting as the host.

It is not unusual to have a user account set up in Windows by a software system, to be used to manage a database product or a service of some sort. Microsoft will do this, setting up an ASP.NET user account in certain situations. By creating this limited user account (more on that later) the service can be available to all Windows users without providing administrative access to your computer.

Looking at my system configuration, on a system that has just QuickBooks 2010 installed, you can see that there is a QuickBooks database “service” running. This is the multiuser database manager.

You may see multiple user accounts if you have been upgrading your copy of QuickBooks periodically. For example, the following is a screen shot from one of my test systems that has QuickBooks 2006, 2007 and 2008 installed:

The user with no number at the end is for QuickBooks 2006, the 17 is for 2007, and so forth. QuickBooks 2010 and Enterprise 10 use QBDataServiceUser20.

Can I Get Rid Of This Account?

Well, yes, you can, but normally you shouldn’t. If this computer is the “host” for your QuickBooks database you must have this user account and service running to provide multi user access to the QuickBooks company file. You can delete the account, but the next time you start multi user access on this computer QuickBooks will set the account up again.

You may also notice, as I’ve shown above, that you have multiple user accounts set up. Also, since this user account must have a folder in your Documents and Settings folder, you may see multiple QBDataServiceUser folders. Why?

If you have installed upgrades to QuickBooks over the years there could be a user account and folder for each upgrade you installed. If you uninstall an older copy of QuickBooks that you no longer need, QuickBooks should remove the unneeded user accounts. However, it most likely won’t delete the folder for the account in your Documents and Settings folder.  Microsoft Windows does not provide a simple way for the program to clean up these user folders.

You can safely delete these left over folders after you have uninstalled. Don’t uninstall the folders that are currently being used.

In some cases you may find additional folders, if you install, uninstall and reinstall the same edition multiple times. You may see folders like QBDataServiceUser.001  and QBDataServiceUser.002, for example. In this case you can delete the lowest numbered folders, leaving the highest numbered one in place.

Is This Account A Security Risk?

This is the usual question that people have when they notice these user accounts. The simplest answer is that this is a normal practice for services like this in Microsoft Windows, and there is no security risk having them there. They are set up as “limited user” accounts that generally have very limited permissions. They can’t be used by another individual or program to log in to your machine.

When rebooting Windows and logging in you won’t see this user account listed in the login screen normally. These are “hidden” accounts that you normally see. This is helpful. Also, it is important to note that this account does not have administrative privileges.

You can see them in your Windows Control panel. The accounts are set up with a password, and we aren’t provided with that password.

If for some reason you have a computer system administrator that doesn’t want this kind of user account set up on a company file server, the only real solution you have is to set up a separate file server just to manage QuickBooks data. That would keep it separate from your main company server – which often is a good idea in any case.