Hi jkmccnh,
jkmccnh said:
Joan,
I've been testing out user-security but it doesn't seem to address the
problem of someone using tables/queries to change data thus by-passing the
logging that occurs with the form use.
Users should not be using the queries directly. All data interaction should
be via the forms/reports.
I have the query set to use my (owner's) permission, my
permissions give me full access to the tables... but I have to also set
read/edit/add/delete permissions to the workgroups query permissions?
You would only need to set these permissions if users need to be able to
edit/add/delete records. In other words, if all they're doing is reading
the data via the form, then they only need read permissions. But you are
correct, that if they need to delete records via the form, then they need
delete permissions on the record source (the RWOP query).
What's
ther purpose of using owner's permission then?
As I said, users shouldn't even have access to the queries tab. You should
lock down your application. Some things to consider:
Backup your database; you can easily lock yourself out playing around with
these features.
Create custom menus/toolbars for use throughout your application.
Create a startup form (a main menu form if you have one) that is opened on
startup.
Use the features in Tools, Startup to
set the startup form
set your default menu (the custom one you made)
disable all the checkboxes about allowing built in menus, toolbars,
changes etc.
hide the db window (ensure the custom menu you create does not
include the Windows, Unhide item)
Click on the Advanced button and uncheck the allow special keys
(this will disable the F11 key, among others)
If you need to bypass these startup features, you can hold the shift key
down while you open the db. If you feel that your users may use this to
bypass your settings, you can disable the shift key bypass - there's an
example in help for doing this(look for AllowBypassKey) or at
http://www.mvps.org/access/modules/mdl0011.htm
and
http://www.mvps.org/access/general/gen0040.htm
You can also create a MDE from your database, which will prevent changes to
forms, reports and modules (If you do this, be certain to keep your original
mdb in case you need to make changes).
I also tried saving the form's
data source as a SQL statement but got the "you don't have permission..."
message when I tried to run the form. I must not be understanding
something
correctly...can you help?
RWOP can only be used on saved queries. When you attempt this with a SQL
statement as the recordsource, at runtime a temporary query is created.
Since it's the user that creates this query, they don't have permissions on
the underlying tables. They are the creator/owner of this 'query', so RWOP
is pointless.
