Assigning Workgroup to just one Database File ?

[lucour]

Hi,

I am trying to setup User Level Security around a Purchase Order Database that I created. Using the Wizard I was able to setup different users with different permissions.

However, as I found out the hard way (but I did recover it), 'joining' a PC to a my new security workgroup forces all Access databases on the PC to use this.

Is there a way to force just this one Access .mdb file to use the newly created PO Workgroup security file ?

I am aware of setting up a shortcut to point to thesecured db. Ie: "C:\Program Files\Microsoft Office\Office\msaccess.exe" /wrkgrp "C:\PO Forms\MyWorkgroupFile.mdw" "C:\PO Forms\MyDB.mdb" /user

But despite the above shortcut, couldn't users just find out where it points to (by looking at the Properties of the shortcut), and open the .mdb file based on that ?

Thanks !

 

[The_Doc_Man]

But despite the above shortcut, couldn't users just find out where it points to (by looking at the Properties of the shortcut), and open the .mdb file based on that ?

Absolutely they could... but not without joining the associated WorkGroup if you set it up correctly. If the WorkGroup is set up right, you make certain fixes (not necessarily in this order) that have the effect of forcing you to join the workgroup or see nothing worth anything.

1. Define groups of your own to control access rights. NEVER rely on the group Users or the user Admin.

2. Give yourself membership in group Admins. Remove that same membership from user Admin. Leave user Admin in group Users only. (You have no choice on the latter; you can never remove a user from the Users group.)

3. Put all of your legit users in one or more of your special user groups. (In the "or more" case, permissions are additive.) You cannot take your users out of Users group but you can guarantee they are in at least one other group before you let them in.

4. Take away just about all access rights from group Users. Like, maybe even take away the ability to open tables, queries, reports, forms, etc. Certainly remove Open Exclusive at your first opportunity.

5. Verify that NO users (small U) have individual rights or object ownership. Make either a "fake" owner who is in Admins group or make yourself the owner. (Owners can always modify permissions of their own objects.)

6. Never ever leave an account with a blank password even though there is a button to clear passwords. Oh, you can clear a password. You just cannot leave it that way.

7. Search this forum for other ways to prevent folks from breaking in to your DB. Look under the general keywords Secure, Security, or Securing.