Re: Securing an .MDE

[Deano]

"Tom van Stiphout" <no*************@cox.netwrote in message
news:qj********************************@4ax.com...

On Sat, 12 Jul 2008 13:01:26 -0500, RLN <no*******@devdex.comwrote:

.. You may also want to know that workgroup security is

not available in the new ACCDB format available with A2007. So you
know what the trend is...

I have never used A2007. What do they do instead of workgroup security? Is
it easier/better/worse?

[Tom van Stiphout]

On Sat, 12 Jul 2008 20:46:11 +0100, "Deano" <de***@mailinator.com>
wrote:

It is non-existent.
-Tom.

>
"Tom van Stiphout" <no*************@cox.netwrote in message
news:qj********************************@4ax.com.. .

>On Sat, 12 Jul 2008 13:01:26 -0500, RLN <no*******@devdex.comwrote:

. You may also want to know that workgroup security is

>not available in the new ACCDB format available with A2007. So you
know what the trend is...

I have never used A2007. What do they do instead of workgroup security? Is
it easier/better/worse?

[lyle fairfield]

Tom van Stiphout <no*************@cox.netwrote in
news:5s********************************@4ax.com:

On Sat, 12 Jul 2008 20:46:11 +0100, "Deano" <de***@mailinator.com>
wrote:

It is non-existent.
-Tom.

And better!

[Larry Linson]

"lyle fairfield" <ly******@yah00.cawrote

>It is non-existent.
-Tom.

And better!

Considering the ease with which Access workgroup / user level security could
be broken, having none is, at least, "not all that much worse". :-)

[David W. Fenton]

Tom van Stiphout <no*************@cox.netwrote in
news:5s********************************@4ax.com:

[re: security in A2K7:]

It is non-existent.

Well, there *is* a strengthened database password (though that's not
even close to being comparable to Jet ULS).

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

[David W. Fenton]

"Larry Linson" <bo*****@localhost.notwrote in
news:tybek.74$Cw5.65@trnddc01:

Considering the ease with which Access workgroup / user level
security could be broken, having none is, at least, "not all that
much worse". :-)

Well, except that it does give you a place to track users. I often
use a workgroup file and user logons without passwords just to keep
track of who is who, and what groups they belong to (for
enabling/disabling features). I don't secure anything, I just use it
for user control. And it's quite handy for that.

The only real alternative is Active Directory, which requires
elevated permissions to manage.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

[Tom van Stiphout]

On 13 Jul 2008 00:42:26 GMT, "David W. Fenton"
<XX*******@dfenton.com.invalidwrote:

I would not try to manage AD from your app, but rather simply use the
server's tools to manage it. Your app should only read role
membership.

-Tom.

>"Larry Linson" <bo*****@localhost.notwrote in
news:tybek.74$Cw5.65@trnddc01:

>Considering the ease with which Access workgroup / user level
security could be broken, having none is, at least, "not all that
much worse". :-)

Well, except that it does give you a place to track users. I often
use a workgroup file and user logons without passwords just to keep
track of who is who, and what groups they belong to (for
enabling/disabling features). I don't secure anything, I just use it
for user control. And it's quite handy for that.

The only real alternative is Active Directory, which requires
elevated permissions to manage.

[Deano]

"Tom van Stiphout" <no*************@cox.netwrote in message
news:5s********************************@4ax.com...

On Sat, 12 Jul 2008 20:46:11 +0100, "Deano" <de***@mailinator.com>
wrote:

It is non-existent.
-Tom.

Blimey, I guess you have to make your own solution. I can only presume they
gave a very good reason for this, even if workgroup security wasnt' that
great to begin with. It does seem like a major feature to drop.

[Rick Brandt]

Deano wrote:

"Tom van Stiphout" <no*************@cox.netwrote in message
news:5s********************************@4ax.com...

>On Sat, 12 Jul 2008 20:46:11 +0100, "Deano" <de***@mailinator.com>
wrote:

It is non-existent.
-Tom.

Blimey, I guess you have to make your own solution. I can only
presume they gave a very good reason for this, even if workgroup
security wasnt' that great to begin with. It does seem like a major
feature to drop.

If you just want to track users and provide "guidance" ULS was always way
more trouble that it was worth. Home-grown is a lot easier to put in place
and to maintain. The extra hassle of ULS was only worthwhile if the actual
"security" provided was real and it was not.

--
Rick Brandt, Microsoft Access MVP
Email (as appropriate) to...
RBrandt at Hunter dot com

[Salad]

Rick Brandt wrote:

Deano wrote:

>>"Tom van Stiphout" <no*************@cox.netwrote in message
news:5s********************************@4ax.com. ..

>>>On Sat, 12 Jul 2008 20:46:11 +0100, "Deano" <de***@mailinator.com>
wrote:

It is non-existent.
-Tom.

Blimey, I guess you have to make your own solution. I can only
presume they gave a very good reason for this, even if workgroup
security wasnt' that great to begin with. It does seem like a major
feature to drop.

If you just want to track users and provide "guidance" ULS was always way
more trouble that it was worth. Home-grown is a lot easier to put in place
and to maintain. The extra hassle of ULS was only worthwhile if the actual
"security" provided was real and it was not.

I like/liked for the CurrentUser property.

[Rick Brandt]

Salad wrote:

I like/liked for the CurrentUser property.

But a simple table and the API to get the Windows login is just as good,
trivial to set up, and doesn't have to bother the user with logging into the
app.

--
Rick Brandt, Microsoft Access MVP
Email (as appropriate) to...
RBrandt at Hunter dot com

[David W. Fenton]

Tom van Stiphout <no*************@cox.netwrote in
news:8q********************************@4ax.com:

I would not try to manage AD from your app, but rather simply use
the server's tools to manage it. Your app should only read role
membership.

But *somebody* has to manage it, and that means (in my world) that I
have to grant somebody at the client permissions on the server to
manage users (and group membership/organizational units, depending
on how the sysadmin has set things up).

While my clients like me a lot and are willing to trust me to do it
for them, I never do this kind of thing for them -- I just don't
like being the only one responsible for user management.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

[David W. Fenton]

"Rick Brandt" <ri*********@hotmail.comwrote in
news:L1****************@flpi149.ffdc.sbc.com:

If you just want to track users and provide "guidance" ULS was
always way more trouble that it was worth. Home-grown is a lot
easier to put in place and to maintain. The extra hassle of ULS
was only worthwhile if the actual "security" provided was real and
it was not.

I strongly disagree with this.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

[David W. Fenton]

"Rick Brandt" <ri*********@hotmail.comwrote in
news:HN******************@nlpi061.nbdc.sbc.com:

Salad wrote:

>I like/liked for the CurrentUser property.

But a simple table and the API to get the Windows login is just as
good, trivial to set up, and doesn't have to bother the user with
logging into the app.

My apps have users logging in, but the users don't know that. Their
ULS accounts have no passwords and their account names are the same
as their Windows logon, so the shortcut to launch the app uses the
appropriate environment variable to pass the user's logon to Jet
ULS.

--
David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/