Backend isn't quite secure

Shep

Shep
Local time
Today, 05:59
Joined
Dec 5, 2000
Messages
364
Hi all.
I know Access security has been discussed ad nauseum in these forums and that there is a wealth of information in the archives, nearly all of which I have read often.

And I have a small question.

For years I produced applications which didn't need tight security. However, I tried to stay well informed on the matter.

Security is important in this project. I secured a database properly, as well as I can determine. I then made a copy and deleted all the tables in the one which will be the frontend and linked to the tables in the copy which will be the backend. Only Groups had permissions, individual Users, none. Life was good.

Then I did something, not sure exactly what. The end result is that the frontend seems fine; I cannot open it unless attached via the .mdw I created specifically for this project.

The backend, however, I can open even when attached to the system default .mdw.

Can anyone tell me what I've likely done, and how I might nail down the backend once again?
 
Eh...sorry to bother...never mind. I imported all the junk from the backend into the frontend, deleted the offending backend, made a copy of the frontend and re-linked everything. Problem solved. Life is good again.

Maybe this little exercise will help someone else.
 
Still Don't Get It

So, trying to figure out how to secure my backend here. I've completed the security wizard and secured the main DB. After splitting, the back end does not retain security settings and is free and open. What did I do wrong?
 
First mistake was using wizard. It obsfucates what it really does, and thus makes things a bit harder to fix. I hope you had a unsecured backup.

That said, the easiest way to secure this would be to start with a unsplitted database, secure it properly *then* split it after, so the backend will inherit same security setting. I think that is what you already did, but one little hole is that if Admin (the default user) stills owns the objects, the Admin using default System.mdw still can import it out of secured database. To prevent this, you must make a new blank database that is owned by a user (e.g. by logging in as that user, not as an admin then creating a new blank database in that session) other than Admin, import in all objects, then change the ownership from Admin to that user.

Security wizard is really good for giving the illusion that it secured the database, but in reality, manual securing it is much more safer.
 
Still Having Problems

Even when I log in using my user name and create a blank db admin is still the owner and cannot be changed?

Do I just change the owner of the "objects" to myself?
 
Last edited:
Try this.

1) Open access and create a new workgroup file (something.mdw) with a name other than system.mdw. Don't create or open a database yet - just stay in the main Access window. Use Tools>Security>Workgroup Administrator to create the new workgroup file (something.mdw) and put this file in the network folder where you'll be placing your database.

2) Check to see if you're joined to the new workgroup by going to Tools>Security>Workgroup Adminisistrator. If you are not joined to the new workgroup file (mdw), then close Access and launch again. Join the new workgroup you just created by going to Tools>Security>Workgroup Administrator and press the "join" button and navigate the folder the new one is in and select it.

3) Then add a new user ... something like "SuperAdmin" and give them Admin group and User Group rights. Leave the Admin user with both Admin group and User group rights for now.

4) Logout as Admin and login as "SuperAdmin." This was difficult to make happen. There's not an intuitive way to make Access prompt you for a login. It seemed to occur for me when I closed out of Access, came back in, and then went to Tools>Security>User and Group Accounts. At the prompt enter user id "SuperAdmin" with password of blank. Once in change your password by going to Tools>Security>User and Group Accounts and select the Change Login Tab. Leave "old password" blank and enter a password in the "new password" and "verify" fields. Hit OK, then close Access.

5) Open Access and go to Tools>Security>User and Groups. It should prompt you to login. Enter "SuperAdmin" and the new password you entered before. You should be at Tools>Security>User and Groups. Select the user "Admin" and revoke their Admin group rights. They should only have User group rights.

6) Now create a new database while you're still logged in as SuperAdmin pointing to the new workgroup file (something.mdw). By doing this you are defining the SuperAdmin as the orginal owner of the data base instead of the generic, default "Admin" user. Put it in the same network folder. The next step will create a "2nd" new workgroup file in this same folder. And this is the mdw file you will want to use.

7) While in the new data base, logged in as "SuperAdmin" and pointing to the 1st, new workgroup file (something.mdw) launch the security wizard by going to Tools>Security>User-level Security Wizard. Select the "Create new Workgroup Information File" radio button. On the next page make sure the "file name" field at top is pointing to the network folder where the final data base will go (use the browse button). Eventhough it's greyed out, you can scroll to see that the path is pointing to your "something.mdw" file. Make sure you either use the WID provided or enter your own. Either way it's a good idea to copy it down somewhere (you won't need it for this, though). Finally, on this page make sure the "I want to create a shortcut to open my security enhanced database" radio button is selected. Select next, and you'll see all the tables, forms, etc. They will be blank because you don't have anything in this data base yet. Select next again and you'll see a list of pre-formatted user groups. You can add these later. Select next again and select "no, the Users group should not have any permissions." Select next again ...

8) This next step is important. You'll see a listbox with just one userid below a function to "Add New User". Access considers the one User as you and you can't delete it here. You want to add the "SuperAdmin" user here and give them a password. You'll need this new user id and password to get back in to this database. You now have two users. Select next ...

9) The page will default to that original User ID on the previous page with "Admin" group rights check. Uncheck this. Then select the "SuperAdmin" from the dropdown list and give them the "Admin" rights. Select next.

10) The next step is going to back up the database as unsecured in the same folder location you placed the new data base in. It will also put a shortcut on your desktop with the appropriate configuration that contains 3 pieces of information: 1st the location of the Access.exe, 2nd the location of the database, and 3rd the location of the mdw file. This process will create the 2nd workgroup file and call it Security.mdw. It will be located in the same folder as your data base. Finally, it will provide a report of the configuration for you to print, but it will force you to create a png file and store it in the same folder with your data base.

11) now you'll need to import all the objects from the old database with the lousy security. First you need to go into that database and grant the User Group with all the rights. Open the lousy data base and go to Tools>Security>User Group and Permissions. Select the "Groups" radio button and then select the User Group. Then using the drop down to the right go through all the objects (data base, table, forms, etc.) and highlight every thing and check every permission checkbox bellow and apply. Do this for every single object in the data base. By doing this you are opening this data base wide open so that you can copy it into the new data base you created. If you don't you won't be able to import it into the new data base.

12) Close Access, then using your desktop icon, launch the new data base and go to File>Get External Data>Import. And import everything. I noticed that some of my forms didn't work when I didn a mass import. I had to try to try to open all of them in design mode to see if they opened. If they didn't I just re-imported them one by one. I made sure I imported any child forms before the parent forms (not sure if this made a difference or not, but I didn't want to take any chances).

13) Once everything is imported you'll have to go back into Tools>Startup to point to the correct form to launch and the other configurations selections you may have made in your old data base.

14) You will need to recreate your user groups and user id's now. I used the manual method to create them at this point rather than use the wizard again. Go to Tools>Security>User and Group Accounts to create your custome user groups and user ids. Go to Tools>Security>Use and Group Permissions to create your permissions.

15) Finally, I deleted that original user ID I saw when I went through the Security Wizard in step 8. You also want to make sure your Admin user (that you can't delete in Access 2003 now) only has the User Group rights.

I was able to rename the Security.mdw file created by the wizard without it impacting security. But you need to update the file name on the shortcut, too.
 
You can never truly secure an access backend file - you can get it good enough, but the only way to completely secure your data is to use a SQL server and user permissions.
 

Users who are viewing this thread

Back
Top Bottom