I am running an Access project (.adp) against a SQL Server 2000 database. I have setup users and roles so that my users cannot inadvertently delete important server objects (like entire tables). When I setup my Access front end on their machines I choose the username/password security option from the Connection menu. My problem is that I realized that if I were a user on these machines I could just go into the Connection menu and change the security to Windows NT integrated and have full access to do whatever I want in the db.
How are integrated security permissions handled? Are they treated differently than username/password? Where is the username password in the NT scheme? Is it the windows login? We have Novell running as well that has it's own login, could this be confusing things?
This is my first foray into trying to secure anything computer-related and it's a fairly extensive topic. I could use any help?
Thanks in advance.

Windows Integrated Security simply means that a user attempting to connect to a SQL Server database does not supply an explicit username and password; instead, the server obtains the user's NT logon account information and uses that to validate access to the server and/or database. If that NT username is not an authorized user of the server and database, or if the user is not a member of a NT user group which is authorized access to the server or database, the user will not be granted access.

The difference between the two modes is whether SQL Server maintains the UserName and Password internally and validates a user presenting a UserName/Password against that information, or whether the server obtains the connecting user's NT user account information and validates using that.

In either case, you must define the level of access granted to the UserName (or optionally, in the case of Integrated Security, the group it is in).

You still have complete control over which databases and what kind of access to grant, since you must still set up the UserName as a valid user in SQL Server in either case. With Integrated Security, though, you can instead manage users at the group level. Thus users can be added or deleted simply by adding or removing them from the NT login group, without having to go to the Server at all to manage the accounts.

Jeff Mason
Custom Apps, Inc.
www.custom-apps.com