Home All Groups Group Topic Archive Search About

User in Admin Group Can't Modify Objects

Author
5 Dec 2008 9:01 PM
croy
Access 2002 under Windows XP, all patched.

Split db with user-level security applied and working well.

The front-end that I routinely pass around was getting a bit
bloated with a bunch of analysis tables and queries, so I
made a copy and renamed it.  Then I copied it to the machine
of another user who is a member of the admins group.

When he opens the database with a modified shortcut and his
admin logon, and tries to modify a query, he gets a message
stating that Admin permissions are needed for that item to
be modified.

When I go to his machine, and log on with my owner/admin
account, I get the same problem.

Any ideas as to why this renamed copy of the often
distributed front-end would be refusing our desires?

The reason has to be simple, but apparently not simple
enough for me!

--
croy

Author
5 Dec 2008 10:32 PM
Joan Wild
It would seem to me that you are using a different mdw than the one that was
used to secure it with (perhaps a production copy of the mdw, vs. a
development mdw).  The Admins Group would be different in these two.

--
Joan Wild
Microsoft Access MVP
Show quoteHide quote
"croy" <c***@invalid.net> wrote in message
news:i2sij49kncarck3khs5t8ihc8hr7l3vmv3@4ax.com...
> Access 2002 under Windows XP, all patched.
>
> Split db with user-level security applied and working well.
>
> The front-end that I routinely pass around was getting a bit
> bloated with a bunch of analysis tables and queries, so I
> made a copy and renamed it.  Then I copied it to the machine
> of another user who is a member of the admins group.
>
> When he opens the database with a modified shortcut and his
> admin logon, and tries to modify a query, he gets a message
> stating that Admin permissions are needed for that item to
> be modified.
>
> When I go to his machine, and log on with my owner/admin
> account, I get the same problem.
>
> Any ideas as to why this renamed copy of the often
> distributed front-end would be refusing our desires?
>
> The reason has to be simple, but apparently not simple
> enough for me!
>
> --
> croy
Are all your drivers up to date? click for free checkup

Author
11 Dec 2008 11:07 PM
croy
On Fri, 5 Dec 2008 17:32:17 -0500, "Joan Wild"
<jwild@nospamtyenet.com> wrote:

>It would seem to me that you are using a different mdw than the one that was
>used to secure it with (perhaps a production copy of the mdw, vs. a
>development mdw).  The Admins Group would be different in these two.

Thanks for the reply, Joan.

The mdw file is the same one we've been using since March,
and in October we were both building and modifying *lots* of
queries.

But sometime between October and now, something changed.
When I copy even our standard front-end to his drive, he
can't modify and save a query, *unless* (just found this out
today) he changes the Run Permissions to "User"--then he can
modify it and save it.  But all the queries in these
front-ends have always had the owner's run permissions--so
why the change in behavior?

I can't think of what might have changed.  My only
successful work-around, so far, has been to use my Fisher
Find and Replace to strip out all the "WITH OWNERACCESS
OPTION" from the queries, and copy over that version of the
analysis front-end.

Could any of the recent Windows Security Updates affect
this?

If anyone has any thoughts of things to try, I'm all ears!

--
croy
Author
12 Dec 2008 5:27 PM
Joan Wild
Are you changing the sql property of this query in code?  Does the user have
modify permissions on the saved query?

Removing the RWOP should create more problems (i.e. permissions), not less.

--
Joan Wild
Microsoft Access MVP
Show quoteHide quote
"croy" <c***@invalid.net> wrote in message
news:gm63k41q3sak91oggekr4nfcnr3te2d31f@4ax.com...
> On Fri, 5 Dec 2008 17:32:17 -0500, "Joan Wild"
> <jwild@nospamtyenet.com> wrote:
>
>>It would seem to me that you are using a different mdw than the one that
>>was
>>used to secure it with (perhaps a production copy of the mdw, vs. a
>>development mdw).  The Admins Group would be different in these two.
>
> Thanks for the reply, Joan.
>
> The mdw file is the same one we've been using since March,
> and in October we were both building and modifying *lots* of
> queries.
>
> But sometime between October and now, something changed.
> When I copy even our standard front-end to his drive, he
> can't modify and save a query, *unless* (just found this out
> today) he changes the Run Permissions to "User"--then he can
> modify it and save it.  But all the queries in these
> front-ends have always had the owner's run permissions--so
> why the change in behavior?
>
> I can't think of what might have changed.  My only
> successful work-around, so far, has been to use my Fisher
> Find and Replace to strip out all the "WITH OWNERACCESS
> OPTION" from the queries, and copy over that version of the
> analysis front-end.
>
> Could any of the recent Windows Security Updates affect
> this?
>
> If anyone has any thoughts of things to try, I'm all ears!
>
> --
> croy
Author
15 Dec 2008 6:43 PM
croy
On Fri, 12 Dec 2008 12:27:04 -0500, "Joan Wild"
<jwild@nospamtyenet.com> wrote:

>Are you changing the sql property of this query in code? 

If you mean the Run With property, no.  The other user is
doing it manually to each query (a pain for him).

If you mean something else, I'm not sure, except to say that
I'm not changing any query properties in code.

>Does the user have modify permissions on the saved query?

Yes.  The original admins group is still in place, and he's
included in that.  He's also included in a custom "Field
admin" group, but that's probably unnecessary--as I
understand it, if someone is in the admins group, they're
gold. I experimented and gave him *explicit* permissions for
everything, but no improvement.

>Removing the RWOP should create more problems (i.e. permissions), not less.

Yes, that's another oddity in this case.

The other user is out sick today, and right now I'm sitting
here pondering this:  he said if he changes a query's
"Run-With" property to "User's", he can then save the
query.! Hmmm.  What branch of the logic tree is this?  It's
is making no sense to me.  But... his work-around is now to
change the property, and then continue to modify and save
queries.

I *seem* to recall, that when I went to his machine and
opened the database with my database login, I was not able
to save query changes either, but it could be that what I'm
recalling is not being able to change the owner of the
queries, getting the message that I must have admin
permissions to do that--which I do, after all, I'm the
owner!

Ugh.

I'll have to wait now until the other user is back from
death, and play some more then.

--
Thanks for your help and ideas.
croy

Bookmark and Share