|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
User in Admin Group Can't Modify ObjectsSplit db with user-level security applied and working well. The front-end that I routinely pass around was getting a bit bloated with a bunch of analysis tables and queries, so I made a copy and renamed it. Then I copied it to the machine of another user who is a member of the admins group. When he opens the database with a modified shortcut and his admin logon, and tries to modify a query, he gets a message stating that Admin permissions are needed for that item to be modified. When I go to his machine, and log on with my owner/admin account, I get the same problem. Any ideas as to why this renamed copy of the often distributed front-end would be refusing our desires? The reason has to be simple, but apparently not simple enough for me! -- croy It would seem to me that you are using a different mdw than the one that was
used to secure it with (perhaps a production copy of the mdw, vs. a development mdw). The Admins Group would be different in these two. -- Show quoteHide quoteJoan Wild Microsoft Access MVP "croy" <c***@invalid.net> wrote in message news:i2sij49kncarck3khs5t8ihc8hr7l3vmv3@4ax.com... > Access 2002 under Windows XP, all patched. > > Split db with user-level security applied and working well. > > The front-end that I routinely pass around was getting a bit > bloated with a bunch of analysis tables and queries, so I > made a copy and renamed it. Then I copied it to the machine > of another user who is a member of the admins group. > > When he opens the database with a modified shortcut and his > admin logon, and tries to modify a query, he gets a message > stating that Admin permissions are needed for that item to > be modified. > > When I go to his machine, and log on with my owner/admin > account, I get the same problem. > > Any ideas as to why this renamed copy of the often > distributed front-end would be refusing our desires? > > The reason has to be simple, but apparently not simple > enough for me! > > -- > croy On Fri, 5 Dec 2008 17:32:17 -0500, "Joan Wild"
<jwild@nospamtyenet.com> wrote: >It would seem to me that you are using a different mdw than the one that was Thanks for the reply, Joan.>used to secure it with (perhaps a production copy of the mdw, vs. a >development mdw). The Admins Group would be different in these two. The mdw file is the same one we've been using since March, and in October we were both building and modifying *lots* of queries. But sometime between October and now, something changed. When I copy even our standard front-end to his drive, he can't modify and save a query, *unless* (just found this out today) he changes the Run Permissions to "User"--then he can modify it and save it. But all the queries in these front-ends have always had the owner's run permissions--so why the change in behavior? I can't think of what might have changed. My only successful work-around, so far, has been to use my Fisher Find and Replace to strip out all the "WITH OWNERACCESS OPTION" from the queries, and copy over that version of the analysis front-end. Could any of the recent Windows Security Updates affect this? If anyone has any thoughts of things to try, I'm all ears! -- croy Are you changing the sql property of this query in code? Does the user have
modify permissions on the saved query? Removing the RWOP should create more problems (i.e. permissions), not less. -- Show quoteHide quoteJoan Wild Microsoft Access MVP "croy" <c***@invalid.net> wrote in message news:gm63k41q3sak91oggekr4nfcnr3te2d31f@4ax.com... > On Fri, 5 Dec 2008 17:32:17 -0500, "Joan Wild" > <jwild@nospamtyenet.com> wrote: > >>It would seem to me that you are using a different mdw than the one that >>was >>used to secure it with (perhaps a production copy of the mdw, vs. a >>development mdw). The Admins Group would be different in these two. > > Thanks for the reply, Joan. > > The mdw file is the same one we've been using since March, > and in October we were both building and modifying *lots* of > queries. > > But sometime between October and now, something changed. > When I copy even our standard front-end to his drive, he > can't modify and save a query, *unless* (just found this out > today) he changes the Run Permissions to "User"--then he can > modify it and save it. But all the queries in these > front-ends have always had the owner's run permissions--so > why the change in behavior? > > I can't think of what might have changed. My only > successful work-around, so far, has been to use my Fisher > Find and Replace to strip out all the "WITH OWNERACCESS > OPTION" from the queries, and copy over that version of the > analysis front-end. > > Could any of the recent Windows Security Updates affect > this? > > If anyone has any thoughts of things to try, I'm all ears! > > -- > croy On Fri, 12 Dec 2008 12:27:04 -0500, "Joan Wild"
<jwild@nospamtyenet.com> wrote: >Are you changing the sql property of this query in code? If you mean the Run With property, no. The other user isdoing it manually to each query (a pain for him). If you mean something else, I'm not sure, except to say that I'm not changing any query properties in code. >Does the user have modify permissions on the saved query? Yes. The original admins group is still in place, and he'sincluded in that. He's also included in a custom "Field admin" group, but that's probably unnecessary--as I understand it, if someone is in the admins group, they're gold. I experimented and gave him *explicit* permissions for everything, but no improvement. >Removing the RWOP should create more problems (i.e. permissions), not less. Yes, that's another oddity in this case.The other user is out sick today, and right now I'm sitting here pondering this: he said if he changes a query's "Run-With" property to "User's", he can then save the query.! Hmmm. What branch of the logic tree is this? It's is making no sense to me. But... his work-around is now to change the property, and then continue to modify and save queries. I *seem* to recall, that when I went to his machine and opened the database with my database login, I was not able to save query changes either, but it could be that what I'm recalling is not being able to change the owner of the queries, getting the message that I must have admin permissions to do that--which I do, after all, I'm the owner! Ugh. I'll have to wait now until the other user is back from death, and play some more then. -- Thanks for your help and ideas. croy |
|||||||||||||||||||||||