.mdw makes my head spin

[Mr Smin]

I've been trying to grasp User Level Security on here and around the web but one thing is leaving me lost.

I have a backend on a fileserver, with a .mdw in the same folder.
On a user's machine I have a front end and a shortcut which specifies to use the .mdw on the fileserver.
If the user lanches from the shortcut it's all fine, but if they double click the frontend, they are in the database as Admin with no password requested by the database.

I'm guessing that without the shortcut, Access uses the .mdw on their C: drive, but that takes me no closer to resolving the problem - can anyone explain this for me?

Thanks.

 

[boblarson]

The problem is that you didn't secure the backend properly. When you create user level security, you need to add a new user name to the users and then make that user part of the ADMINS (note the S) GROUP. Then you REMOVE the ADMIN (note - no S) from the ADMINS group. That way anybody opening the database, or attempting to, with their default security.mdw workgroup file, can't. If you leave the Admin user part of the Admins group then anyone can just open the database and be an admin because that is the default of their default mdw file.

 

[boblarson]

But BIG WARNING -

DO NOT remove the Admin from the Admins Group BEFORE you have another user assigned to that Admins group or else you will LOCK YOURSELF OUT of the database for doing admin work (including adding new users, changing security and all) and there's no way to recover that if you do.

 

[Mr Smin]

Hmm - I have myself in the Admins group under my own name but when I try to delete the user 'Admin' it says that operation cannot be performed.
It will let me remove user 'Admin' from the Admins group (leaving Admin in only the Users group which has no permissions). Do you know if that would work?

 

[Mr Smin]

Also, do I need to run the security wizard on the backend and front end separately?

 

[boblarson]

Hmm - I have myself in the Admins group under my own name but when I try to delete the user 'Admin' it says that operation cannot be performed.

You can't remove the Admin user - you just remove them from the Admins group.

It will let me remove user 'Admin' from the Admins group (leaving Admin in only the Users group which has no permissions). Do you know if that would work?

Yes, that is how it is supposed to work.

I've not used ULS much at all so I don't really know for sure how you would apply it to the backend.

 

[Mr Smin]

Sorry - just realised how dense I was, not reading your original post thoroughly!