FredixBlog

Steps to secure a database
1) Find the system.mdw file, usually in c:\\windows\\system folder. Make a copy of it in your database’s directory.

2) Give it another name than system.mdw, for instance secure.mdw, preferably not the same name than your database.

3) Make a shortcut using the /wrkgrp option, in order to open your database with the above workgroup file. You can also join permanently to the workgroup with wrkgadm.exe, but the shortcut solution is more flexible.

4) Open your database with the shortcut. See if it works.

5) Create a new user with full administrative rights. (I use appadmin for instance)

6) Give a password to the admin account.

7) Close your database and open it again. You are prompted for a user and password.

Open the database with your new account.

9) Close your database. Create a new one. Look in the security settings: The owner of the database should be the new account you created above.

10) Import all objects of the old database into the new one. Look again in the security settings: Your new account is the owner, not Admin.

11) Now, note that the group ‘users’ has the right to open the database. Admin belongs to this group, so he can still open the database. As you cannot remove Admin from the users group, you will have to create a new users group (appusers) and revoke the right to open the database from the users group. This will be the next steps.

12) Create a new user group (appusers). Give this group the right to open the database, etc (same as users group)

13) revoke all the rights from the ‘users’ group

14) Create a new administrators group (appadmins). Give it the same right than the Admins group

15) Revoke all the rights from the ‘Admins’ group. Here is the reason why: In the normal workgroup file, Admin belongs to the Admins group. If, from your database the Admin group has the right to open the database, the admin user, when connected to the normal workgroup file, will be able to open it.The above steps will therefore prevent opening the database from a workstation set with the default workgroup file!