In working with Microsoft GP for many years, Microsoft has made improvements to security while ignoring others. I would like to review my findings where GP is lacking in security, how it could be used in a pen test to gather info, and what steps Microsoft should take to fix the problems.