Database Security & workgroup problem.

[Luong]

Hello,

I created a secured database with a new workgroup on my
computer. I placed the database and workgroup file in the
network drive. From my computer, I joined to the new
workgroup, so Everytime I open the database, it will ask
me to log in (I log in as Admins group).

Now, when I go to other users PC to open up the database,
I was able to open directly into the database without any
log in requirement. When I check the user and security
permission, it only has users group permission granted
(which is what I expected).

My question is why are other users able to open the
database in the first place without joining the workgroup
I created? (Assuming the users PCs are joined to their
default Systems workgroup on their C:\ drive). We are
using Windows NT network system and Access 97.

Thanks

 

[Rick Brandt]

Hello,

I created a secured database with a new workgroup on my
computer. I placed the database and workgroup file in the
network drive. From my computer, I joined to the new
workgroup, so Everytime I open the database, it will ask
me to log in (I log in as Admins group).

Now, when I go to other users PC to open up the database,
I was able to open directly into the database without any
log in requirement. When I check the user and security
permission, it only has users group permission granted
(which is what I expected).

My question is why are other users able to open the
database in the first place without joining the workgroup
I created?

Because you didn't secure it properly.

When you open a file using a Workgroup that does NOT prompt you for a
Username and Password, then you are silently logged in as the user "Admin"
that is a member of the group "Users". A properly secured app should have
no permissions granted to either of these in which case they would not be
able to open the app.

A common "missed step" is not making sure that "Admin" is not the owner of
the database or any objects within. Owners have permissions beyond those
explicitly granted.