User-Level Security

[sggmm]

Hi, I am trying to setup a database (stored in a shared folder) with user-level security in a multiuser environment. I have created a new Workgroup Information File (called DB.MDW). When the workgroup information file in any user workstation changed from the default SYSTEM.MDW (come with Access 2000) to the one I created (DB.MDW), the database works exactly the way I want it to be, ie different user requires different password and has different level of permissions.

My question is why a user workstation with the default SYSTEM.MDW is able to logon to my database without any password?

Thank you very much

 

[SgtJarrow]

Each person must be joined to the correct .mdw file......see thread702-269448 for details on how to do this automatically for every user.... Programming isn't a profession of choice.
It's a profession of calling...
"Hey Programmer, your application broke again!"

Robert L. Johnson III, A+, Network+, MCP
robert.l.johnson.iii@citi.com

 

[sggmm]

I realised that I could change the corrected.mdw file to all the users. But what my concern the most is where is the security of the database I created. If anyone who use the default system.mdw file can logon my database without password, what is the point of creating this database with different .mdw file?

 

[SgtJarrow]

Your question is a good one....and one I can only speculate on....

Access required the .mdw file to deterime what security level you are using. The .mdb has no security whatsoever (to my knowledge). So if you use a .mdw file that has no administrator password set, it would appear you can access the database. If you have a password set for your "default".mdw file this will not be the case, as the objects for your database will not exist and therefore no one will have permissions to anything except administrator.

I used a quick web search of different .mdw files scurity risk and found this article:

http://www.bpro.com/Misc/MC_Secur.htm

I did not read it word for word, but it seems to imply that if the users have been using the database and you are now implementing a new .mdw file, their old .mdw file already has the objects and since there is no Admin password setup, they are loggin in as Admin by default.

Just my speculations....I am by NO means a .mdw expert. Programming isn't a profession of choice.
It's a profession of calling...
"Hey Programmer, your application broke again!"

Robert L. Johnson III, A+, Network+, MCP
robert.l.johnson.iii@citi.com

 

[lameid]

I answered a similar question yesterday... Search for PIDs and my username.