User Logs in as Admin, No login prompt

[SteffK]

Hi All,

Hope someone can help, I have 15 users who log onto an Access database, who
are encountering difficulties.

All of a sudden they no longer get the login box and are automatically
logged in as Admin. There have been no recent changes to the server, apart
from the monthly Administrator password change, this has never effected this
before.

The first thing I checked was that they were still joined to the system.mdw,
all are, but are not getting the login prompt, does any one have any sort of
idea please?

Cheers,

Steff

 

[Chris O'C via AccessMonster.com]

Someone pulled a prank by removing the Admin user's password in the secure
workgroup. Replace that password and everyone joined to that workgroup will
be prompted for user name and password when opening a database.

A common practice is to name the secure workgroup file something other than
System.mdw so that there's no confusion between it and the default workgroup
file. It's also easier to have everyone join the default workgroup and only
use shortcuts that use the secure workgroup for the secure databases, so that
the users aren't prompted every time they open a database, even the unsecured
ones.

Chris
Microsoft MVP

 

[SteffK]

Chris,

TY so very much, such a simple fix to a confusing problems, Most, most
appreciated, My boss now thinks the sun shines out my Bottom )

 

[Guest]

This is what was found on a brand new computer that will not complete the
Vista Security pack 1 update. Module is missing for windows update and a
previous version of XP had problems with device drivers & administrative
privileges changing to start with. A clean format was not helping with an
embedded system. Also a security disc wipe clean was performed on the old
machine.
Vista says the download is corrupted. Any ideas what is up? Thank you. Donna
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 4/12/2008 11:08:34 AM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: ldmarcou-PC
Description:
Windows detected your registry file is still in use by other applications or
services. The file will be unloaded now. The applications or services that
hold your registry file may not function properly afterwards.

DETAIL -
3 user registry handles leaked from
\Registry\User\S-1-5-21-551187025-3693109612-1846477194-1001:
Process 960 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has
opened key \REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001
Process 188 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has
opened key \REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001
Process 188 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has
opened key
\REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service"
Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2008-04-12T15:08:34.000Z" />
<EventRecordID>12333</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>name of computer here-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">3 user registry handles leaked from
\Registry\User\S-1-5-21-551187025-3693109612-1846477194-1001:
Process 960 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has
opened key \REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001
Process 188 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has
opened key \REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001
Process 188 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has
opened key
\REGISTRY\USER\S-1-5-21-551187025-3693109612-1846477194-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
</Data>
</EventData>
</Event>
By the way, my daughter is an avid image surfer who has web overides on her
desktop to this comp. Botnet from a favorite site may be a clue. Changing
servers and local host access seems to be the event handlers and I've
noticed that logging gets disabled. I hope someone figures this out. Good
luck all.

 

[Chris O'C via AccessMonster.com]

lol, you have him trained!

Chris
Microsoft MVP

Chris,

TY so very much, such a simple fix to a confusing problems, Most, most
appreciated, My boss now thinks the sun shines out my Bottom )