Security Wizard... now i'm locked out! 2

[nuclearmedia]

I ran the User-Level Security Wizard. Now it won't let me or any of the established users in. There are no permissions set for them.

This wouldn't be a problem if I could change it, but now I can't even access the admin options, even though I'm the admin.

There is a user called "Admin" but i don't know the password and I didn't set it...

I've seen a few other postings around about the same problem, I'm thinking it's not just me. I set up several databases, on several machines / versions of access. Same result.

This is for work, and I need in soon. Any help, ASAP, greatly appreciated.

 

[easyit]

Hi,

How do you know there is an admin account? Do you still have some access?

I think you have created a new MDW file and set it to default for your machine. You can change it to the original MDW with the program "WRKGADM.EXE" (search for the location on c:\). This program tells you which mdw you are using

also search for any *.mdw files and switch to the right one.

another problem might be the localisation of office. I have had similar trouble, but ultimately could login with the translated name of the admin account (beheerder= admin in dutch).

I will list the steps to take for proper db securing:
1 create a new workgroupfile (use WRKGADM.EXE). DO NOT NAME IT SYSTEM.MDW. If you use only one MDW then continue, else start WRKGADM.EXE again and switch back to the default system.mdw.
2 open access using this new workgroupfile (use a shortcut if needed see example)
3 open the database (file menu >> open) that you want to secure.
4 create a new user and add him to the admins group (this wil be the new administrator)
5 check that the admins group has rights to all objects in your DB!
6 change the default admins password from blank to something you will remeber.
7 remove all permisions from the users group in the database
8 close the database
9 reopen the database the database you are securing (use shortcut if needed!) and log in as the new administrator
10 run the security wizzard on the new DB (saves time)
11 remove the (standard) Admin user from the admins group
12 create the users and groups your application needs
13 join your users to their rspective groups
14 assign the appropriate permissions to the groups
15 add or remove group permissions as needed.

You need a shortcut if you use several mdw's. If you're sure you will use only one mdw, than access wil always use the same mdw (as is set to default with WRKGADM.EXE) and you do not need a shortcut.
A shortcut example is: c:\program files\..\path to access.exe "path&filename of the database" /WRKGRP "pathname and filename of the newly created MDW file"


good luck!

 

[novicius]

Hello!
I'm currently in the same boat here -- trying to define two groups of users, one who can administrate and one who can merely browse. When I try to create either group, I end up getting locked out of the Admin group. Currently, I have just one question: how do I change users in Access? It keeps opening up in the other group...?

- novicius -

 

[DrSimon]

Can I please join this club of confused Access Security people. I've tried to do all the things that you're supposed to do (Easyit - WRKGADM.EXE created the wrong version of Access - I'm using 2002) but to no avail.
I've used the wizard to try to create a variety of users and user types, but when I rerun, none of those users are there and in spite of setting fairly wide rights, none of the tables etc. in the secured version are visible even though I'm apparently Admin when I open the database. (Nuclearmedia - I've got round the Admin logon problem by clearing the password.)
I've tried to create myself as a user as a member of Users & Admins and tried to delete Admin - but I can't because it says it is the only members of the Admins group and can't be deleted!
I know that some people have managed to get this working but like nuclearmedia & novicius I'm stumped. Can anyone out there help..... please!
Simon Rouse

 

[easyit]

Simon,

Maybe try the following with a copy of your Database or try a test database?

In 2002 you can create a workgroup with the menu; tools=>security=>workgroup administrator.
Click create and fill the boxes (you must fill the ID field). This ID is critical; save (use pen!) it somewhere if you ever need to recreate the workgroup file.
Next choose a location on the network where everybody has read&write Access for the workgroup file.
Preferably do not name the MDW file the same as the database that you will secure; when accessing it, it will create an .ldb file with the same name as the database which may lead to trouble.

After creation, you will automatically have joined this new workgroup. you can now create users, assign rights etc for this workgroup. Security is however not in place yet!

Now open your to-be-secured database.
Now follow steps 4 to - 15 as described. This will secure your database.

In general, Access security consists of two databases that are related. 1) is the database that you have created, en 2) is the MDW database (MDW = workgroup file; I’m mixing the terms). The latter stores information about users, objects rights, groups to whom users belong etc. If you open a MDW file with Access and make sure that sytemobjects are visible (tools/option menu) you can see the tables that Access is using. Fields in these tables are ´hidden´ but there are tools available on the web to hack into them - Access security has it limits…
Confusion usually arises around knowing (or not knowing) which MDW is being used or should be used. Also confusing is the terminology Access vs. access database. Access is an application with which you can create databases. By default the Access application uses the system.mdw. Every database that you create will use the same system.mdw, unless told something else.
You can therefore tell the access application to join a different workgroup file. But you can also tell a access database to use another workgroup (use shortcuts for this).

So, after the steps above (1-3), you have created a new MDW and told Access to use this by default.. Every time you close and restart access, you use this new workgroup file.
If you now create an new database, it will use the new MDW. It is still not secured, because the Admin user has no password yet. You can now create new users, assign rights etc, but anybody with the standard Access installation (and standard system.mdw) can open this database. To enforce security you must set the Admin password!

It is very well possible to create several databases and have them all use the same MDW.

Let me know exactly what is going wrong (and where). I’ll try to aid you in the process.

I would suggest that you create an MDW and use the shortcut solution. Remember in that case that you should switch back the access application to the default SYSTEM.MDW!

Maarten

 

[DrSimon]

Thank you very much Maarten. I will go through this and get back to you if there are problems.
Simon Rouse

 

[sanan]

Hi easyit
First of all let me thank you on very interesting Paper on ACCESS security.
I followed your instruction in the Paper and I studied some of the UERL you provided on this issue.
But I still have some question on it.
· I should mention that I went through all of steps, and It seems like, that it is working all right)
· In your Paper, you mention that, one can make this newly made Work Group One’s default Work group, Could you Explain this Process in more Details?
How can I make this Newly made Work Group My Default One?
· Could you tell me, How can I find out that How many Access Database Exist in
My Access or Computer? (Personal Computer and no other network connection)
· Finally I am using Access to make my Forms and Reports and I am using the SQL
Server fro my database, Could you tell me or Direct me to some Good reading on Securing Such Applications, I do not think that above procedures works for my Forms, since tools>Security> are so different in This Scenario. Again I should mention That I know a little how to setup the Security for my Database in SQL, But I just do not How to find my forms and Reports as Object in my SQL database in order to set Proper Security on them as well.
Any suggestion on above Issue/
Best Regards
Sanan

 

[easyit]

Sanan,

You can make Access a member of a different workgroup by using the executable "WRKGADM.EXE", usally found in "C:\Program Files\Microsoft Office\Office\1043\WRKGADM.EXE" where the folder "1043" is different per country. If you start this program you will see which mdw is being used and you have the option to create a new one or to become a member of another mdw file.
Personally I do not make Access member of a new mdw. I use a different mdw for each project that I make and use shortcuts to tell access which mdw to use for the given database.

How many access db's there are on your PC?? I dunno, try a search for *.md? from the explorer.

Wether you are using SQL as backend (...you have split your DB??) or not doesnt mather for securing access. You should secure the frontend part (which contains the all objects but tables) the same way as described. When your forms (or queries) access the SQL server, they are using some form of connectionstring (dsn, odbc etc) and in these strings there is a password and login name. These have nothing to do with the access frontend security!

Maarten

 

[sanan]

Hi easyit
Thanks for reply.
I am not still clear how to make one of the Work group that I made a Default one, that is off course incase I decide to do so. Please explain Brifley.
On the second part, Are you telling me that without even connecting to SQL server, Just by Using ACCESS I can make my forms at the end Just Conect to SQL server but then I used Tables that were made in ACCESS, How do I over come this Problem? Is there any wizard for this Process?
Please explain a little, Since I am new In al These.
Best Regards
Sanan

 

[easyit]

Sanan,

1) Did you start de exe. that I mentioned?

2) You are misunderstanding me. I tried to explain that Access security and SQL security are seprated items. There is no wizzard (to my knowledge), but you could export (upsize) your tables from access to SQL sever. I believe there is a wizzard for that, somewhere under the "extra" menu.

...Why do you want to do this bye the way? Access on a stand alone machine should be more than adequate for your needs. You should switch to SQL if you have a lot of users (254+) or when performance becomes an issue - I cannot imagine a stand alone PC ever hitting these limits

 

[sanan]

Hi easyit
Yes I made a new workgroup, and I also name it Systemm1000, There is no problem on this issue, But I just want to know how to make this new Work group the Deafult One, I should mention that The short cut that I made to my desk top made this new work group the Default one (I think)
But I want to know if there is an Exact way to make it the Default work group.
Regarding the second part I am experimention in order to make a Big application that is better to run on SQL Server.
I now have a new problem with my SQL Server I just posted a new thread for that one which goes like this you may be able to help on that one too, and it is Urgent:

I am new to SQL server, I was Experimenting with it’s Security Features, That I guess
I made a very bad move, That basically I can not make a connect to my Sever at all.
I have made some Database applications that are Important to me. These Applications are made using Access for Forms and Reports, and SQL Server for Database.
I have some question:
1. I made a backup before, I start this teat of mine, But if worst comes to worst that I have to uninstall the SQL server then Install a fresh one, and then Run my Backup would I be able to Recover all my Forms and Report that I made?
2. My second question is for an attempt to correct my Mistake, I try to describe the event that led to this Disaster, At first I had the windows authentication for security, But then I moved to SQL, I created a new User and gave it Pass word, and Every thing was O.K., But after a While, Since I had too many problems in my Forms VB Coding using ADO Record set Addressing, I decided I want to go back to Windows again, Here is where the Disaster happened, I Right Clicked on my Server and Used it’s Properties and in there I Choused the Window’s Authentication, and after that I could not even Start my server or Connect to it.
Any Suggestion on what should I do?

 

[easyit]

You can check (In VBA) to which MDW you are connected with:

"Jet OLEDB:System database=" & SysCmd(acSysCmdGetWorkgroupFile)

But if you used the wrkgadm.exe, you see the same... and if you click for the membership, than you can change the workgroup (it will become default).

I cannot help you on the sql server part, sorry.

 

[sanan]

Hi easyit
I am sorry, But I just can not find the membersgip?
What is it? where is it?
I just could not find it by right clicking or clicking the
workgroup "WRKGADM.EXE".
Best Regards
Sanan

 

[easyit]

Are you kiddin me?
If you start wrkgadm.exe, you have three buttons: Create, close and...?

can't be that difficult. Try each of them & have fun.

 

[edwilli]

I have the same problem as the original postee, but I don't have the WRKGADM.EXE file on my desktop. What's worse is that I did name the workgroup file SECURITY.mdw

Is there any other way to undo this mess?

 

[easyit]

Yes there is.

Steps to take:

1) make a backup of the system.mdw and the database
2) remove security by clearing (deleting) tha password from the Admin account BUT BEFORE THIS: Make sure that the Admin account has rights to all objects in the database and is a member of the admins group. This is important, because once you remove the password from the Admin account, when reopening the database, you will automatically log in with the Admin account. if you have no rights assigned, than you are locked out.

You do not need the WRKGADM.EXE for these steps, just use the menu within MsAccess.

Also, this file (WRKGADM.EXE) does not need to be on the desktop, it is somewher on your harddrive, use search...

goodluck

Maarten

 

[Melagan]

I have found in many cases that a copy of wrkgadm.exe is installed in C:\Windows\System32 or C:\WINNT\System32, which is in the default load path of any system. In other words, you can execute the program by going to start/run and type in wrkgadm.exe. That tidbit helps when you're going in and out of .mdw files often.
On a seperate note, though, I wouldn't recommend using wrkgadm.exe to set your default workgroup file. The default, in my opinion, should always remain an untampered-with c:\windows\system32\system.mdw file. Use a switch command in your shortcut to set the workgroup file. Example: Target = "C:\Program Files\Microsoft\Office\msaccess.exe" "C:\DB\YourDatabase.mdb /wrkgrp C:\DB\Workgroup\YourDatabaseWorkGroup.mdw"

This ties in to what easyit was talking about above a few posts with having seperate .mdw files for each DB on your computer -- just create shortcuts with the appropriate /wrkgrp switches in them and you'll be all set.