Avoid Security Warning

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Cron

    #16
    Re: Avoid Security Warning

    On Oct 8, 1:20 am, "Chris O'C via AccessMonster.c om" <u29189@uwe>
    wrote:
    Several flaws in your logic.  The vba won't run because the college students
    at those hundreds of workstations don't have the smarts to enable the content
    by pressing a bar that pretty much says "contents disabled unless you press
    here".  You don't want to go to those hundreds of workstations yourselfto do
    it while each user is logged in.  (The trusted locations are per user, not
    per workstation, so unless the network is set up with roaming profiles - kind
    of doubtful - you have a lot more work than you thought if students are
    allowed to use more than 1 pc when using your app during the semester.)  The
    user who's executing the vba code needs to have enough permissions to write
    to the registry.  Most college networks are locked down so student users
    don't usually have those permissions.
    True, but if it was just a once off, I could tell the students to
    click the enable content button. It just can't appear every time the
    database is opened. You might be right about the registry edits being
    disabled altho the settings do allow the change through access so I've
    a feeling the security won't be smart enough to distinguish VBA from
    access.

    >
    What kind of digital signature are you using that needs to be packaged tobe
    installed on each pc?  You can't sign the files on one pc with your digital
    certificate and copy the front end to each user's desktop and copy the back
    end to the network server?
    I'm not sure if that was a question but I tried this quickly on my
    home network and it didnt work but I might have missed something. Is
    the following possible...

    Create a digital signiture using office.
    Sign and package the database with it in access.
    Unpack the signed package to a new computer and run as digitally
    signed without problems??

    Cheers,
    Ciarán

    Comment

    • Chris O'C via AccessMonster.com

      #17
      Re: Avoid Security Warning

      That's good news, it should work if you use vba. It's just enabling the vba
      that's the problem, so....

      Chris
      Microsoft MVP


      Cron wrote:
      >On Oct 8, 1:20 am, "Chris O'C via AccessMonster.c om" <u29189@uwe>
      >wrote:
      >You might be right about the registry edits being
      >disabled altho the settings do allow the change through access so I've
      >a feeling the security won't be smart enough to distinguish VBA from
      >access.
      --
      Message posted via AccessMonster.c om


      Comment

      • Cron

        #18
        Re: Avoid Security Warning

        On Oct 8, 1:54 am, "Chris O'C via AccessMonster.c om" <u29189@uwe>
        wrote:
        That's good news, it should work if you use vba.  It's just enabling the vba
        that's the problem, so....
        I also don't have a clue how to code it or if it's even possible
        through VBA! ... hopefully someone in the neighbourhood will know ...?

        Comment

        • Chris O'C via AccessMonster.com

          #19
          Re: Avoid Security Warning

          Are you using a self cert digital certificate? I've seen it work on a
          network of pcs using Access 2003 but that takes a consultant who's a security
          expert. (I've never seen it tried in Access 2007, so it might not be
          possible on your network.) A normal developer won't be able to do it. A
          normal developer needs a Thawte digital certificate or another commercial
          certificate provider to distribute digital signatures at the organizational
          level.

          Chris
          Microsoft MVP


          Cron wrote:
          >On Oct 8, 1:20 am, "Chris O'C via AccessMonster.c om" <u29189@uwe>
          >wrote:
          >I tried this quickly on my
          >home network and it didnt work but I might have missed something. Is
          >the following possible...
          >
          >Create a digital signiture using office.
          >Sign and package the database with it in access.
          >Unpack the signed package to a new computer and run as digitally
          >signed without problems??
          --
          Message posted via http://www.accessmonster.com

          Comment

          • Salad

            #20
            Re: Avoid Security Warning

            Chris O'C via AccessMonster.c om wrote:
            Several flaws in your logic. The vba won't run because the college students
            at those hundreds of workstations don't have the smarts to enable the content
            by pressing a bar that pretty much says "contents disabled unless you press
            here". You don't want to go to those hundreds of workstations yourself to do
            it while each user is logged in. (The trusted locations are per user, not
            per workstation, so unless the network is set up with roaming profiles - kind
            of doubtful - you have a lot more work than you thought if students are
            allowed to use more than 1 pc when using your app during the semester.) The
            user who's executing the vba code needs to have enough permissions to write
            to the registry. Most college networks are locked down so student users
            don't usually have those permissions.
            I haven't migrated to 2007 yet so I don't understand the trusted
            location concept you just stated. If I set "C:\A2007\A pps" as a trusted
            folder wouldn't it be a trusted folder for all students?

            Wouldn't Tony Toews AutoFe be a useful tool for distributing the
            application to the students?
            >
            What kind of digital signature are you using that needs to be packaged to be
            installed on each pc? You can't sign the files on one pc with your digital
            certificate and copy the front end to each user's desktop and copy the back
            end to the network server?
            >
            Chris
            Microsoft MVP
            >
            >
            Cron wrote:
            >
            >
            >>does
            >>anyone know a way to add a trusted location to the registry using VBA?
            >>or is there a way to digitally sign a database without packaging it?
            >
            >

            Comment

            • Tony Toews [MVP]

              #21
              Re: Avoid Security Warning

              Cron <cronoklee@hotm ail.comwrote:
              >Create a digital signiture using office.
              >Sign and package the database with it in access.
              >Unpack the signed package to a new computer and run as digitally
              >signed without problems??
              You should be able to digitally sign the MDB/MDE all by itself.

              Tony
              --
              Tony Toews, Microsoft Access MVP
              Please respond only in the newsgroups so that others can
              read the entire thread of messages.
              Microsoft Access Links, Hints, Tips & Accounting Systems at

              Tony's Microsoft Access Blog - http://msmvps.com/blogs/access/

              Comment

              • Tony Toews [MVP]

                #22
                Re: Avoid Security Warning

                Cron <cronoklee@hotm ail.comwrote:
                >Right, I'll have a
                >look around tomorrow and see if can find some VBA to allow trusted
                >locations.
                All trusted locations are stored in the registry under:
                HKCU\Software\M icrosoft\Office \12.0\Access\Se curity\Trusted
                Locations\Locat ionN
                (where N is an integer)

                To see what the entries should look like, just add a trusted location through the
                Trust Center, then go to the registry to look at the key and see what it did. Note:
                you cannot trust a specific file, but only at the folder level, so you'll want to
                make sure that you're installing your app to a folder that contains only your
                application and not other stuff.

                You can add any key name you want unde Trusted Locations\ instead of using LocationN.
                Such as Trusted Locations\My App or Trusted Locations\<gene rated GUID>

                So what you could do is have a startup form with a big text comment telling the user
                to click on Security prompt at the top of the Access window. Now the first thing
                your VBA does is set the above Trusted Locations registry key, if not already there
                and close the form and continue. If the VBA code is working because the Trusted
                Locations key is set then this form is visible for a flicker.

                You will need to use an API call to set the registry location. See vbnet.mvps.org.

                Tony
                --
                Tony Toews, Microsoft Access MVP
                Please respond only in the newsgroups so that others can
                read the entire thread of messages.
                Microsoft Access Links, Hints, Tips & Accounting Systems at

                Tony's Microsoft Access Blog - http://msmvps.com/blogs/access/

                Comment

                Working...