Should Crystal Report be allowed for certain employees for production database? I am talking about production database. There are couple of people who use crystal on daily basis for various types of reports. Some use it to just peak at the data, other generate reports of it. Should this be allowed from security/performance/other point of view? There is no http access to our database/application, everything is internal on intranet.

What is the correct procedure here? The employee in current scenario have the password for the database. Should it be changed to Windows Authentication? Any suggestions.
It will depend on the type of data being access and your company's security requirements/policy. In general you do not want users sharing an account, especially if that account has more than read permissions on your database. I would verify with your security folks or legal group if there are any specific requirements for managing access to data, or with auditing. If you fall under any industry standards like HIPPA or PCI they have controls that require being able to map access to a particular user.

With regards to how you allow users to run reports that is usually driven by policy where I have worked. Do you experience any performance issues now with how they are pulling reports and "peak" at data? As a DBA, I'm a control freak to a certain degree, I like to know who and what is making calls to my data. I have been in one environment where reports were pointed to a database snapshot of the production database, so their was less of a performance concern. Another environment it was not until their report caused a performance issue in production that we would tell them if you want that information run it after business hours.