permissions to import after a new workgroup file?

[miky]

Hi,
I developed a database with security in mind but assumed that it would
be ok to implement at the end of development. I'm trying to import the
objects to a new database using a new mdw but it's telling me that I
don't have the permissions to do this. Did I do this backwards? I
don't want to apply the security measures on the default workgroup
file, obviously.

The message I'm getting is: "You do not have the necessary permissions
to use the [mdb object]. Have your system administrator or the person
who created this object establish the appropriate permissions for you."

There may be a possibility that the default system.mdw file was changed
in some way that maybe causes this not to work anymore. I had added an
additional user of the admins group when I was testing out the security
model. Could this have anything to do with this? I've tried putting
the users and groups back to the way it was in the beginning but it
doesn't work.

I'd just like to be able to import all the objects to a new database
using a new mdw. I think this would fix things but it's not behaving
the way I'd hoped.

Your help on this is greatly appreciated. Thanks,

miky

 

[Chris Mills]

To import as a new owner from a previous owner, obviously you need permissions
for the objects in the original database. As you setup the original security,
there should be no problems knowing what groups, users, or passwords or PIDs
you setup.

Normally permissions are assigned via Groups. I'd think you would create a
temporary Group consistent with your previous scheme, or one easy way to
describe is to temporarily assign permissions to the Users Group (in the old
database, and which all mdw's have). Anyway, you do need to give the new owner
permissions to the old database, perhaps temporarily for the old database by
some means, in order to import. (otherwise it would hardly have been secure!)

You shouldn't be altering security measures with the "default workgroup". As
soon as you decided to implement security, you should be always using a
"specific workgroup". This could be a COPY of another workgroup file (for all
I know). Also, remember that the workgroup stores Users and Groups, but the
MDB stores all the object permissions. There must be some level of match
between them (namely the mdb must store some cryptic of the User and Group
details).

(it doesn't really matter if you mess-up the Access default system.mdw. That
can be recovered from nearly anywhere, say CD or another installation)

Did I do this backwards?

I don't think so. You may be doing things a different way from the Security
FAQ, or the Security Wizard, but I think that's good if it helps you
understand it. If anyone could just create a new owner and import, then what
would be the point? Your old security seems to be working fine!

Chris

Hi,
I developed a database with security in mind but assumed that it would
be ok to implement at the end of development. I'm trying to import the
objects to a new database using a new mdw but it's telling me that I
don't have the permissions to do this. Did I do this backwards? I
don't want to apply the security measures on the default workgroup
file, obviously.

The message I'm getting is: "You do not have the necessary permissions
to use the [mdb object]. Have your system administrator or the person
who created this object establish the appropriate permissions for you."

There may be a possibility that the default system.mdw file was changed
in some way that maybe causes this not to work anymore. I had added an
additional user of the admins group when I was testing out the security
model. Could this have anything to do with this? I've tried putting
the users and groups back to the way it was in the beginning but it
doesn't work.

I'd just like to be able to import all the objects to a new database
using a new mdw. I think this would fix things but it's not behaving
the way I'd hoped.

Your help on this is greatly appreciated. Thanks,

miky

 

[Graham Wideman [Visio MVP]]

miky:

You're asking for a bit of speculation on "what happened" in the past while
developing your DB, which is tough.

In the absence of an actual answer, you might make some headway using my
PermExpl tool that allows you to browse the current state of play in your
workgroup and database:

http://www.grahamwideman.com/gw/tech/access/permexpl/index.htm

.... and the associated Access Security Apparatus discusses a bunch of issues
related to your concern about some other user in the Admins group.

Hope that helps,

Graham

Hi,
I developed a database with security in mind but assumed that it would
be ok to implement at the end of development. I'm trying to import the
objects to a new database using a new mdw but it's telling me that I
don't have the permissions to do this. Did I do this backwards? I
don't want to apply the security measures on the default workgroup
file, obviously.

The message I'm getting is: "You do not have the necessary permissions
to use the [mdb object]. Have your system administrator or the person
who created this object establish the appropriate permissions for you."

There may be a possibility that the default system.mdw file was changed
in some way that maybe causes this not to work anymore. I had added an
additional user of the admins group when I was testing out the security
model. Could this have anything to do with this? I've tried putting
the users and groups back to the way it was in the beginning but it
doesn't work.

I'd just like to be able to import all the objects to a new database
using a new mdw. I think this would fix things but it's not behaving
the way I'd hoped.

Your help on this is greatly appreciated. Thanks,

miky

 

[miky]

Thank you both for your replies. I'm not sure how the default mdw got
altered. I did make some changes along the way but I was pretty
conscious of making sure I didn't veer too far from default.

I tried getting default mdw's from other systems but this didn't let me
do the import. I also tried creating a new "specific workgroup" but
this didn't work either. I'm probably missing something here but have
yet to figure it out.

One thing I did notice was that the owner of the database is unknown.
Does this affect my ability to get the objects from this database? I
tried opening the database with different mdw's but I couldn't change
the owner - the option is disabled.

Graham, that's a really neat tool. I'd like to look a bit more into it
but I'm not sure right now how it applies. I haven't had a chance to
read the documentation yet. I'm sure that would help.

Thanks again for your time,

miky

 

[Chris Mills]

One danger in giving specific advice, which I'm guilty of and Graham Wideman
pointed out, is that we don't really know what state your "intermediate level
of security" is in.

I really should have said, in the first instance, make sure you have and read
the Security FAQ
http://support.microsoft.com/support/access/content/secfaq.asp

It is said, with good reason, that this has to be followed "to the letter".
Once you *think* you have done that, my advice might have been more pertinent
<g>

Graham's tool is quite good. But it won't help you until you have implemented
security according to the SecFAQ. It's more for all the pesky permissions,
rather than implementing security as the "first" step (or 10 steps).

At the stage we were discussing, the owner will be "unknown" because the
"owner" was in your last system.mdw, but that user is not in the current
system.mdw you are using (or some detail like the PID is different). The
purpose of importing was to change the owner. From "unknown" (whatever) to a
new one. Don't worry about it until you get the SecFAQ. "unknown" is not some
disaster, it's just part of the fun process. You gotta admit, it's fun isn't
it?

You should be running your mdb's with a full shortcut:
....mscaccess.exe ...yourmdb.mdb /wrkgrp ...yoursystem.mdw
(which leaves no doubt what workgroup you are using or where it is)
and /User You /Pwd Yourpassword
(coz you'll be needing it many times. Take it out again to secure your PC
shortcut)

Chris

 

[Chris Mills]

I damn near forgot.

Take a BACKUP (of your mdb's and mdw's) before you do ANYTHING more.