ACC97: Check NT Permissions When Using IDC/ASP Files with Access

• Microsoft Access 97
• Microsoft Internet Information Server version 2.0 and 3.0

SUMMARY

Advanced: Requires expert coding, interoperability, and multiuser skills.

This article discusses some of the Microsoft Windows NT permissions issues you may encounter when you create and use Internet Database Connector (IDC) files or Active Server Page (ASP) files from a Microsoft Access database.

This article assumes that you are familiar with the Internet Database Connector, ActiveX Server, Microsoft Windows NT, and Internet Information Server (IIS).

For more information about using IDC to publish data on an intranet or the Internet, please refer to the IIS online documentation. You can also explore Microsoft's World Wide Web site for IIS at http://www.microsoft.com/iis/default.asp.

For more information about using ASP to publish data on an intranet or the Internet, please refer to the Active Server online tutorial.

NOTE: This article does not apply to Web servers running Microsoft Windows 95 with Personal Web Server because Microsoft Windows 95 does not use the same security features that are built into Microsoft Windows NT.

MORE INFORMATION

If you use IDC or ASP files to publish Microsoft Access data on an intranet or the Internet, you may receive the following error message when you browse through those files with your Web browser if the permissions, usernames and passwords are not set correctly in Microsoft Windows NT:

   The Microsoft Jet database engine cannot open the file '(unknown)'.
   It is already opened exclusively by another user, or you need
   permission to view its data.

• Incorrect Username or Password
• Insufficient NTFS Directory Permissions
• Insufficient Share Permissions
• Access Database Is on a Windows 95 Computer with Insufficient Share Permissions

NOTE: The troubleshooting tips that follow apply to the anonymous logon username account set up in the IIS Internet Service Manager. IUSR_<Server Name> is the default account name, but it can be changed. If anonymous logons are not allowed (for example, if Basic Authentication or Windows NT Challenge/Response is in use), then the following troubleshooting tips apply to whatever user accounts may be trying to access the WWW services. For more information about setting up the WWW service in the Internet Service Manager, please refer to your IIS online documentation.

Incorrect Username or Password

You specified an incorrect username or password for the IUSR_<Server Name> account, either in the Windows NT User Manager or in the Internet Service Manager.

IUSR_<Server Name> is an account that is created when you set up IIS for the purpose of allowing anonymous Internet access to resources on the Web server. The IUSR_<Server Name> account is created with a randomly generated password. If the password is changed in the Internet Service Manager, the actual Microsoft Windows NT account password must also be changed in the Microsoft Windows NT User Manager.

If the System DSN that your IDC or ASP files use points to a Microsoft Access database located on a different Microsoft Windows NT computer than your Web server, then the same IUSR_<Server Name> account with the same password must be created on the computer where the Microsoft Access database is located. If your Microsoft Access database is not on a different computer than your Web server, but it uses attached tables that are on a different computer, then the same IUSR_<Server Name> account with the same password must be created on the computer where the attached tables are located. Remember that the IUSR_<Server Name> account is created initially with a randomly generated password; the only way to know the password is to change it to something else.

Insufficient NTFS Directory Permissions

The IUSR_<Server Name> account requires both Read and Write permissions on the directories where your Microsoft Access databases are located. Keep in mind that NTFS directory permissions are different than share permissions. If your databases are on a different computer than your Web server, or if you are using attached tables, then Read and Write permissions must be granted on the directories on both computers where the Microsoft Access databases reside.

Insufficient Share Permissions

If the System DSN points a Microsoft Access database that resides on a different computer than your Web server, then the IUSR_<Server Name> account must exist on the other computer, and should have Read and Write permissions on the share where the Microsoft Access database resides.

Access Database Is on a Windows 95 Computer with Insufficient Share Permissions

If your System DSN points to a Microsoft Access database that is located on a Microsoft Windows 95 computer that uses User-level access control, whatever account is set up to be the Anonymous Logon in the Internet Service Manager must be authenticated by the share permissions on Microsoft Windows 95. This means if IUSR_<Server Name> is set up as the Anonymous Logon, then IUSR_<Server Name> must also be a valid account in the domain, with the same password used in the Internet Service Manager. The "Username:" value under "Anonymous Logon" in the Internet Service Manager must be modified to use the following format:

     DOMAIN\IUSR_<Server Name>

   '<path and file name>' isn't a valid path.  Make sure that the path
   name is spelled correctly and that you are connected to the server on
   which the file resides.

REFERENCES

For information about exporting IDC files in Microsoft Access 97, search the Microsoft Access 97 Help Index for "IDC files."

For information about exporting ASP files in Microsoft Access 97, search the Microsoft Access 97 Help Index for "ASP files."

For more information about setting Microsoft Windows NT Share permissions and NTFS directory permissions, please refer to your Microsoft Windows NT documentation.

For more information about the Internet Information Server and the Internet Database Connector, please refer to your IIS online documentation.