Exclusive locks

[Guest]

Once again, this forum has been a great resource! I've been having problems
opening forms in design mode in a database that I just secured by creating a
new workgroup file, so I searched on "exclusive" and found several threads
from people with similar problems. I can get around it at this point, but
I'd like to understand a little more.

Here's the situation. When I secured the database, I created two new users,
DBA and Staff, and checked two of the "custom" groups that the wizard
suggests, "Full Permissions" and "Full Data Users." I then specified that
user DBA should be in groups Admins and Users, user Staff should be in groups
Full Data Users and Users, and the pre-existing user Admin should be in
groups Full Permissions and Users (the users "Admin" and "Staff" are exactly
the user names I wanted for the users of this database, along with a "DBA"
user for programming, so I figured it would be okay to use the existing
"Admin" user).

When I checked, I was surprised to find that the Full Permissions and Full
Data Users groups *didn't* have the permissions that I thought they would
have for existing objects, they only had permissions on new objects. So I
selected all of the existing objects in each category and gave them the
permissions that I wanted.

When I logged in as DBA, I got the familiar "You do not have exclusive
access to the database at this time," etc., message when I tried to open a
form in design mode, despite the fact that I'm the only one opening the
database on this non-networked PC. But when I logged in as Admin, I *didn't*
get that message, despite the fact that the DBA user is in the Admins group,
and the Admin user has all of the same priveleges as the DBA user.

After reading the FAQ page that I saw referenced in a different thread on
this subject, I understand that the exclusive access requirement was
introduced in Access 2000 for a number of reasons. But I still don't
understand a couple of things:

1. Why isn't Access able to obtain the exclusive lock that it's apparently
trying for when opening the form in design view, regardless of the user that
I'm logged in as, when I'm the only one who can have the database open (and I
don't already have another instance of it open)?

2. Why is the exclusive lock successful for user Admin but not for user
DBA? If this is a built-in feature of the built-in Admin user (e.g., the
Admin user *always* gets an exclusive lock on the database, and any other
users *never* get an exclusive lock), is it documented somewhere?

3. Is the fact that the expected permissions associated with the suggested
user groups aren't granted to existing objects documented somewhere? Or did
I do something wrong when I specified that I wanted to use the suggested user
groups?

As I said, I've figured out how to work on the database at this point,
either by logging in as Admin, or opening Access and using the "Open
Exclusive" option, or including "/excl" in the shortcut specification as
suggested by someone else. But I'd *really* like to understand Access's
behavior here for future projects, and to make working on this one easier.

Thanks for any help anyone can provide!

Cheers,
Rich

 

[Guest]

Oops. I just answered questions 1 and 2 below. Apparently, when I was
granting permissions to the Admins group, I neglected to grant any of the
database permissions. Adding them allowed me to login as DBA and open a form
in design view.

This reinforces my need for question 3, though: I'd expect that group
Admins would automatically have those permissions checked.

Thanks again!

 

[Joan Wild]

Staff should be in groups Full Data Users and Users, and the
pre-existing user Admin should be in groups Full Permissions and
Users (the users "Admin" and "Staff" are exactly the user names I
wanted for the users of this database, along with a "DBA" user for
programming, so I figured it would be okay to use the existing
"Admin" user).

Nope (well maybe). You should give no permissions to the Admin user. The
exception would be if you wanted everyone (anyone) with Access to have 'full
permissions'

When I checked, I was surprised to find that the Full Permissions and
Full Data Users groups *didn't* have the permissions that I thought
they would have for existing objects, they only had permissions on
new objects. So I selected all of the existing objects in each
category and gave them the permissions that I wanted.

Were you checking the permissions on the groups or on the users in the
groups?

1. Why isn't Access able to obtain the exclusive lock that it's
apparently trying for when opening the form in design view,
regardless of the user that I'm logged in as, when I'm the only one
who can have the database open (and I don't already have another
instance of it open)?

Use File, Open to open the database (and choose Open Exclusive in the open
dialog). Alternatively, you can add the /excl switch to your desktop
shortcut you use to open the database.

2. Why is the exclusive lock successful for user Admin but not for
user DBA?

Don't know (can't reproduce).

3. Is the fact that the expected permissions associated with the
suggested user groups aren't granted to existing objects documented
somewhere? Or did I do something wrong when I specified that I
wanted to use the suggested user groups?

During the wizard, you choose which objects you want secured - perhaps you
missed some checkboxes? Also are you looking at the groups' permissions or
the user's permission. Users will inherit any permissions on the groups
they are members of, but the permissions dialog won't show these implicit
permissions - only explicit ones.

 

[Guest]

Joan,

So is the built-in Admin user unacceptable because anybody with Access has
the same user with the same PID?

Thanks,
Rich

 

[Joan Wild]

Joan,

So is the built-in Admin user unacceptable because anybody with
Access has the same user with the same PID?

Yes. Also the built-in Users Group is also common to all mdw files. You
should remove all permissions from it as well.

Also ensure that the Admin user doesn't own anything.