Prevent file copy?

[Lizardkng]

We have a MS Access database residing on our w2k server, which all users access across the network, via a desktop shortcut.

I have one user, who thinks he has the best method for ensuring access to this file, and that is for him to make a local copy on his 2k Pro Client....

Is there any way to prevent a user from making a physical copy of a file on a server, onto their local client?

I cant really make it read only, and I dont want to restrict just his account, I would like to do it as a group, but Im unsure how to go about it?

 

[Marcs41]

Kick him ;-)
If they need full access to the mdb, you cannot stop that.
Talk the the user, and let him/her understand they are NOT supposed to do that.
That is called IT-Policy, follow the rules or get kicked. If the solution is here, let us know it was helpful so others can benefit from it as too

 

[Lizardkng]

It should be noted, that they do not need "full control" over the mdb...they only need read access...does that make any difference?

We really dont have an IT policy, because I alone am the "IT Team". We are a small E-911 dispatch center, with 10 employees, 24/7/365, and I just happen to be the guy who was in the MCSE track when I got hired.

Any help is appreciated.

 

[GiaBetiu]

When you have such problems, the only way to avoid it is to make an application that will access that file.
The idea of multi tier... and then the access to the databse is strictly controlled.
Also, you can forbidden them the right to browse that directory. I know, there wil be still that will access it,... copying the path and making a dos copy command.
Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[GrnEyedLdy]

LizardKng,

Maybe I am missing something here, but if you limit their access to read only then they won't be able to make a copy of the file.

Just a thought

Patty

 

[MattWray]

You can still do a "Save As" with Read Only access. But he would have to change the name of the file... Thanks,

Matt Wray

http://www.netcomtec.com

http://www.total-tec.com

 

[GrnEyedLdy]

Thanks Matt,

I figured I was missing something...

Patty

 

[Marcs41]

GrnEyedLdy and mattwray,
Read access lets you copy the file, since all you do is read anyway, you are not modifying it.

Lizard, it's not because there is no policy that some basic rules should not be respected for IT security reasons, talk to that person to make them understand.

If that does not help, here is another way, it involves some redesign, but it solves your problem.

Make another database as a front to the real one.
Give users access to that on, but not to the real one.
Let that front database connect-as someuser to the real mdb. If the solution is here, let us know it was helpful so others can benefit from it as too

 

[Lizardkng]

Hmm, well, I dont do any of the programming, the database was built by our director.

Im sure he could point one app to another, but I dunno anything about that...

I was hoping there was a quick and easy fix for this...aside from me confronting him, again...

Thanks people

 

[ashpp]

A bit extreme but you could copy the file to a new 'secret' location and then disable the right-click on the client machines. (He wouldn't be able to see where the file was).

You could also write a batch to file to execute the database rather than using a shortcut. ie.

run.bat
\\servername\secretapp$\database.mdb

Encode the batch file to a COM file and then give out shortcuts to that.

Ash.

 

[Lizardkng]

Wow....quite a bit over our heads I think....

I was really hoping for a simple solution....ah well...

Thanks

 

[MattWray]

Unless you use a Domain, I don't think there is a simple solution... Thanks,

Matt Wray

http://www.netcomtec.com

http://www.total-tec.com

 

[Lizardkng]

We do use a domain...

W2k Domain Controller, and all w2k Pro clients...does that matter?

 

[Marcs41]

No If the solution is here, let us know it was helpful so others can benefit from it as too

 

[MattWray]

If you use a domain, then have you looked into GPO's?

http://www.microsoft.com/windows2000/techinfo/planning/management/groupsteps.asp

Thanks,

Matt Wray

http://www.netcomtec.com

http://www.total-tec.com

 

[ashpp]

I don't see how a GPO would help?

 

[Lizardkng]

I do use GPOs....but I cant find anything about preventing the copying of files across the network...?

 

[Marcs41]

Pull the network cable.


No, seriously, if you give the users the rights to the files, they will be able to copy them, period.
Again, make some Policy, talk to the diector and explain why.
Or have him change it or talk to the person in question.
If another front to the database is too much work, a little trick is maybe an option.
In the Autostart Macro, build in a check for the existance of a file that has to be at the same location as the mdb, like here.ini. That can be a dummy file, but hide that from the users. If the file is not found at the same location then the mdb closes. If the solution is here, let us know it was helpful so others can benefit from it as too

 

[bmmini1]

Forget GPOs and all of the security stuff. If a user has read access to a file and write access to the local hard drive he will always be able to copy this file to his client.

I think the better way is to insert a mechanism into the database to compare the path filename at startup.

Create a new module in your database and insert the following VisualBasic Code

Public Function Compare()
If Application.CurrentProject.FullName <> &quot;<Your database path+name>&quot; Then Application.CloseCurrentDatabase
End Function

After saving this module create a macro with the name &quot;AutoExec&quot; and insert a &quot;RunCode&quot; action. In this action execute the &quot;Compare()&quot; function of the module created before.
If you have already a AutoExec macro you should instert the RunCode action at top most position to make sure it is executed first after opening the database.

You can hide the macro and protect the macro and module from changing.

All this will not prevent your user to copy the file, but if he starts his local file the database will automatically be closed and the user has a blank Access application on his screen.

If you try this, please check if the VB command works for UNC paths also or only for mapped drives and let me know the result.

hope it helps