System.mdw as applies to FE and BE

[David Portwood]

My FE is secured by AppName.mdw. Now I have to secure the BE. Do I use the
same .mdw file? How?

Currently my .mdw file resides on the same network drive as my BE. What's to
prevent someone from deleting the .mdw file? Where should the .mdw file be
located for a multiuser app so that it can't be deleted or somehow corrupted
by a malicious user?

 

['69 Camaro]

Hi, David.

My FE is secured by AppName.mdw. Now I have to secure the BE. Do I use the
same .mdw file? How?

Don't use the Database Splitter Wizard to split the secure database. Your
back end will end up unsecured. Oh, I see you've already discovered that.
;-) Please see Microsoft Access MVP Joan Wild's tip, "Splitting a Secure
Database," on the following Web page:

http://www.jmwild.com/SplitSecure.htm

What's to prevent someone from deleting the .mdw file?

A job transfer to the janitorial staff or to the branch office in the
Arctic.

Restore from backup if anything happens to the workgroup information file on
the network. It only changes when a user is added or deleted, a group is
added or deleted, or a password is changed. In other words, once you've
developed the application and created all the groups and users you need,
only new users being added, old users being deleted, and password changes
every six months will prompt a change in the file, so restoring from last
week's or last month's backup will require little, if any, repeated work on
your part.

Where should the .mdw file be located for a multiuser app so that it can't
be deleted or somehow corrupted by a malicious user?

The workgroup information file should remain on the network in a directory
where the users have permissions to read and write to the file (to change
their own passwords). If you're really paranoid about deletions, ensure
that the Windows group that the users are a member of doesn't have delete
permissions on that file. It's so quick and easy to fix a deleted workgroup
information file from backup that I wouldn't worry about it if I were you.
Just ensure that you _always_ have a backup of that file, even if you have
to keep an extra copy on your own workstation in your Windows profile or on
a floppy disk, locked in a safe.

HTH.
Gunny

See http://www.QBuilt.com for all your database needs.
See http://www.Access.QBuilt.com for Microsoft Access tips and tutorials.
Blogs: www.DataDevilDog.BlogSpot.com, www.DatabaseTips.BlogSpot.com
http://www.Access.QBuilt.com/html/expert_contributors2.html for contact
info.

 

['69 Camaro]

Hi, David.

You may need Microsoft Access MVP Stephen Lebans's relationships window
tool, too, if you want to copy the layout from one database file to another.
And even if you don't use the tool on this database, keep it for later. It
will come in handy. Please see the following Web page to download it:

http://www.lebans.com/saverelationshipview.htm

HTH.
Gunny

See http://www.QBuilt.com for all your database needs.
See http://www.Access.QBuilt.com for Microsoft Access tips and tutorials.
Blogs: www.DataDevilDog.BlogSpot.com, www.DatabaseTips.BlogSpot.com
http://www.Access.QBuilt.com/html/expert_contributors2.html for contact
info.

 

[David Portwood]

Don't use the Database Splitter Wizard to split the secure database. Your

back end will end up unsecured. Oh, I see you've already discovered that.
;-) Please see Microsoft Access MVP Joan Wild's tip, "Splitting a Secure
Database," on the following Web page:

I've just read Joan's tip. It's not applicable to me because I've already
used the splitter wizard to secure the FE. So again I ask: how do I secure
the BE? Do I create a separate WIF or is there some way to link to the same
WIF that my FE is secured with?

 

[Joan Wild]

Do not create a separate WIF. You need to secure the BE using the same WIF as you used for the FE.

If you've got a desktop shortcut that opens the FE, then use that and login as the user you want to own everything. Then hit Ctrl-O and open the backend (you'll still be joined/using the secure mdw). Proceed to secure it.

If you don't have a desktop shortcut, then create one with the following as the target:
"path to msaccess.exe" /wrkgrp "path to secure mdw"

 

['69 Camaro]

Hi, David.

I've just read Joan's tip. It's not applicable to me because I've already
used the splitter wizard

Have you considered logging in as the owner of the database, copying the
permissions with former Microsoft Access MVP Jeff Conrad's DBUtility
(http://www.daiglenet.com/MSAccess.htm), deleting the links, importing all
of the tables and their relationships back into the front end, reassigning
permissions to those tables with the utility, and then following Joan's tip?

Once you import those tables, they'll be owned by the same owner as all the
other objects. You can manually reassign permissions on the imported tables
to the members of the Admins group, but it would probably be faster to use
Jeff's utility. I haven't used it in a long time, so you may actually have
to create an entire new database (as the same database owner) and import all
objects from the front end and back end into it before you can assign the
saved security permissions from the original database with the tool. Even
so, it won't take long to set up the database to implement Joan's tip and
keep both the front end and back end secure.

HTH.
Gunny

See http://www.QBuilt.com for all your database needs.
See http://www.Access.QBuilt.com for Microsoft Access tips and tutorials.
Blogs: www.DataDevilDog.BlogSpot.com, www.DatabaseTips.BlogSpot.com
http://www.Access.QBuilt.com/html/expert_contributors2.html for contact
info.

 

[David Portwood]

Thanks, Joan. I'll give it a try first thing Monday.

Do not create a separate WIF. You need to secure the BE using the same WIF
as you used for the FE.

If you've got a desktop shortcut that opens the FE, then use that and login
as the user you want to own everything. Then hit Ctrl-O and open the
backend (you'll still be joined/using the secure mdw). Proceed to secure
it.

If you don't have a desktop shortcut, then create one with the following as
the target:
"path to msaccess.exe" /wrkgrp "path to secure mdw"

 

[David Portwood]

I'm not sure if I'm allowed to load anything onto my computer at work, even
onto just the local drive. I'll check this on Monday.

I suppose I could just start over. I have a copy of the unsplit database.
I'd rather not, because I made a few (relatively minor ) code changes since
the split. I'll try Joan's suggestion first. If there's a problem, I'll
start over.

Thank you for the help, Gunny. I'd certainly be lost without you and the
others in this group.

 

['69 Camaro]

Hi, David.

I'm not sure if I'm allowed to load anything onto my computer at work,
even onto just the local drive.

That's certainly understandable. Many of us have the same constraints.

Thank you for the help, Gunny. I'd certainly be lost without you and the
others in this group.

You're welcome. We were once in your shoes, too, and wish we had had that
helping hand. Good luck with your project's deployment when it
happens.

HTH.
Gunny

See http://www.QBuilt.com for all your database needs.
See http://www.Access.QBuilt.com for Microsoft Access tips and tutorials.
Blogs: www.DataDevilDog.BlogSpot.com, www.DatabaseTips.BlogSpot.com
http://www.Access.QBuilt.com/html/expert_contributors2.html for contact
info.

 

[DAVID]

Where should the .mdw file be

located for a multiuser app

The .mdw file is a database. It contains a list
of user names, a list of user groups, and a list
of security ID's.

When you login in to a secured database, you
lookup the names and groups in the .mdw, and
get the security ID's, which is what you use.

The rules for where you put the workgroup database
are the same as the rules for where you put any
file:

If you only have one user, or if the workgroup
database is only rarely changed, you put the
workgroup database on your local drive, with the
FE.

If the workgroup database is frequently updated
(with name and password changes) and needs to
be shared between different workstations, you
put it in a shared location.

(david)