Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Not sure if this is the right place for this question (Perhaps SuperUser), but I'm sure there are some Access gurus here on ServerFault.

Anyway, we support some legacy MS Access apps and recently a user was able to change some information in our database. NOT GOOD! It should be read only.

MS Access is using a Trusted Connection and the user is part of a Windows Group in SQL Server that is only a DB Reader.

Is there a list of Gotchas when implementing Windows Users on SQL Server that we've missed?

The only clue that we had is that we only allow connections on a non-standard port.

share|improve this question
    
Is the user part of the local admin group on the server by any chance? –  Wayne Arthurton Sep 28 '10 at 21:15
    
Yeah, We checked that... they're not. :( –  Armstrongest Sep 28 '10 at 22:52

1 Answer 1

How did you add the users in?

You should probably setup a group for people that need to access the data. Then setup them with security to allow for Read-Only on just the tables that are needed.

If you don't have specific roles setup for users, you made them added them as the database owner or administrator.

The Trusted Connection only specifies Windows Users instead of SQL specific logins.

share|improve this answer
    
They're set up in Groups such as DOMAIN_GROUP\ReadOnlyUserGroup It's a strange problem. That Group is added into SQL Server as a User. That user's role is ONLY db_reader In the Permissions Section of the SQL Server Database, the User has GRANT Connect to the database. –  Armstrongest Sep 28 '10 at 22:44
    
Would you be offended if I asked you a series of perhaps simple sounding questions? I really would like to help you get to the bottom of this, but don't want to upset you with items that may seem basic. –  Wayne Arthurton Sep 29 '10 at 17:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.