Sys Admins and Net Admins do not like Access running in either of two configurations, mostly because of behavioral issues.
Case A - entire DB is on a server. Server is used as file-server only.
Case B - DB is split, FE is anywhere, BE is on server. Server is used as file-server.
In either case, the problem is that the application is being run on a workstation but its data is being stored on a server. In order to run a query, the workstation needs to see EVERY RECORD IN THE INVOLVED TABLES so it can do filtration. Since a recordset is stored as a temporary object in the DB, that means the internal pointers generated as a result of the query must also be sent and later pulled back across the network link. Obviously, this implies a lot of data.
Another problem is that the way Access uses its locking file, you need some fairly hefty privileges on the shared directory. This is because you have to be able to create or delete the .LDB file whether you are using the DB READ-ONLY or READ-WRITE.
Finally, Access does not encrypt data between a workstation and a server. You might find a third-pary network suite that will do so, but by itself, Access station-to-server security is kinda, well, non-existant.
The factors that bother Sys Admins and Net Admins relate to these issues:
1. Network traffic gets bigger whenever you have:
1.1 Very long tables
1.2 Very wide tables
1.3 Many multi-table joins (regardless of one-to-one or many-to-one joins)
1.4 Many multi-layer queries (i.e. query based on a query based on a query ...)
1.5 Forms with underlying code that manipulates recordsets on the fly or behind the scenes
2. Network security gets worse whenever:
2.1 The database is shared. (Gee, that right there is a zinger.)
2.2 Many users have access to the directory.
2.3 File import/export operations are required in the shared directory.
2.4 The security set-up is not proper or not complete. (I.e. not using or mis-using workgroup security)
2.5 Data being exchanged is subject to any laws relating to personal information security. In USA, we are talking the Privacy Act of 1974, Fair Credit Reporting Act, HIPAA, Patriot Act, and a raft of others.
3. Network and system security gets worse whenever:
3.1 Applications use Active-X
3.2 Applications use any part of MDAC
3.3 You are using an older version of MS Office - particularly if it is older than or at Office 97 (which just recently "fell off" the list of MS supported products.)
3.4 You cannot assure that users are patching their copies of Windows or Office on a regular basis.
Mitigation of this problem involves work on your part.
1. If you have users who have read-only access to the DB, make a stand-alone copy they can run on their system. Base it on an MDE file. Be aware that you will have to regenerate this file often. Every user you eliminate from shared access this way eases the network load and actually improves your security (a little bit). But of course, they will have no flexibility in what they can do with that MDE file.
2. Move the whole database or the backend part to a top-level directory (folder) on the file server and assure that no other user group shares that directory. That way, you can isolate it with respect to system or object security. Discuss your network requirement with your Net Admin or Server Admin person. If Windows Domain Security applies to the server folders, you can suggest creation of a new domain-local group to describe the people who will use this database. By having a single group identifier to manage, your sys admin will be happier. (Admittedly, this is a relative term.) Then all your admin needs to do when your group changes membership is either grant or revoke the user's membership in that group.
3. If at all possible, plan to convert the backend to something like SQL server or some other product that will allow you to pass SQL queries to the server and get back only the resultant data set. This is the optimal solution with respect to network traffic. Be sure you can use Access with that product. You might have to obtain an ODBC license and code for each user in order to do this for your entire site.
4. In general, Sys Admins and Net Admins hate anything that is a resource eater, and unfortunately, Access qualifies. So you might need to discretely discuss the issue with your management and have THEM talk to the admin types who are giving you grief. If someone reminds them of "the big picture" now and then, they will be less likely to complain. Even if the reduction in complaints is only their way of avoiding repeated visits to the big boss's office to hear another "BIG PICTURE" lecture.
