While investigating Intuit Quickbooks Desktop 2024 for Mac/Windows I discovered that Intuit requires Desktop users to create an Intuit Account online and it requires the user to login to this account every time they open a local company file. There are some settings that can be adjusted that seem to extend the time between logins to a maximum of 7 days. That being said this doesn't solve the overall problem with this implementation. That problem being this is a major security risk if Intuit online accounts database were compromised and being that more secure environments/companies have been hacked in recent years its only a matter of time before this very thing could happen.
Before I continue lets cover some background information. According to intuit the reason this was implemented in 8/20/2020 is as follows:
Quote1. An extra layer of security and protection
2. Access to edit and modify your information through a single account (same UserID and password) for every Intuit product you choose to use
3. Access to added features and benefits for Payroll, Payments, Time tracking and more, which may require an extra layer of security
Upon closer inspection the real reason for this forced account login is to sync and attach online accounts to local company files in case you forget the administrator password so you can login to your online account and unlock the company file. This isn't about security and protection though. This is about intuit controlling local company files as if they were online by using the intuit account login credentials, which they store and have control over. Furthermore the account services that run with Quickbooks Desktop 2021-2024 for both Windows and Mac phone home to 8 different domains on a regular basis sending encrypted traffic. Anyhow I digress on this matter and point to the main reason I decided to dive into this problem and
that is no online account SHOULD BE REQUIRED to use locally installed software with locally stored files. Also I am confident there are many individuals out there wanting to bypass this sign in and just access their local company or individual files without having to give intuit access to them and without having to create and sign into an intuit account. As I am about to demonstrate if intuit wanted this to be about security I wouldn't have so easily bypassed the online account login request.
I hope that those looking to bypass this find this information helpful. There are 2 workarounds for this problem.
Kindly note: This solution also works with Quickbooks Desktop 2021, 2022 and 2023 for both Mac and Windows. 1. You can choose to install Quickbooks desktop software on a computer that has no internet connection. Upon not finding an internet connection Quickbooks will throw up an error and allow you to open the company file without logging into an Intuit Account. Now in my opinion this solution is not ideal and few will likely find it useful for the simple reason that being online and having internet access is probably necessary at some point and unplugging or disabling the internet is a rather annoying method to fix this problem.
2. Blocking the Intuit Domains used by Quickbooks. This can be done either using pihole at the network level, or by using the hostfile on Windows or Mac to block them at the device level. The following domains must be blocked:
plugin.intuitcdn.net
csp.intuit.com
spcentitlement.intuit.com
fpp.intuit.com
assets.intuitcdn.net
deviceintel-identityra.api.intuit.com
accounts.intuit.com
uxfabric.intuitcdn.a.intuit.com*Note: Blocking these domains will prevent you from accessing intuit website to download software or individual patches. It should be noted that using the "Check for Quickbook Updates" from the Quickbooks Menu still functions. The reason this way of updating still works is because it uses a different domain altogether that we haven't blocked. For those curious that domain is "http-download.intuit.com"
Once blocked when you open Quickbooks 2024 You will be see the following screen.
intuit.JPG
Upon hitting okay the company file will open.
Lets jump into how to block this for those who are not familiar with pihole or windows hosts file. For pihole that will require setting up a pihole on the network and forwarding traffic to the device where intuit domains are blocked. You can learn more about setting up pihole here (https://pi-hole.net/). You can either run it from docker or any supported operating system. My personal favorite is using a Raspberry Pi as a dedicated pihole device. Its affordable, energy efficient and has more than enough processing power to handle DNS requests for an entire home network. I am not going to go into detail on how to set this up as those guides already exist. However it is the more advance way of blocking domains.
As for the windows hosts file, on Windows 10 and 11 machines you can find the hosts file located in directory
C:\Windows\System32\drivers\etcLaunch Notepad as an administrator, then select File, Open and navigate to the location above and open the file named hosts. The reason you have to launch it as an administrator is otherwise you will not be able to save the changes. You will have to select "All Files (*.*)" from the bottom right side of the Open window in order to see the hosts file. Do not add any file extension to the hosts file otherwise it will not function.
Once opened copy and past the following code into the hosts file and save it.
127.0.0.1 plugin.intuitcdn.net
127.0.0.1 csp.intuit.com
127.0.0.1 spcentitlement.intuit.com
127.0.0.1 fpp.intuit.com
127.0.0.1 assets.intuitcdn.net
127.0.0.1 deviceintel-identityra.api.intuit.com
127.0.0.1 accounts.intuit.com
127.0.0.1 uxfabric.intuitcdn.a.intuit.com
Your host file should look like this once you do that:hosts.JPG
After making those changes, open up the command prompt and type in
ipconfig /flushdnsNow restart your computer and those domains will be blocked. Ideally you want to do this before installing or using Intuit software. However if you already have the software installed you can make these changes and the end result will be the same.