>I saw a discussion on another NG and now I'm curiously trying to fill in the holes of my understanding. No one lets me near enough to a server to really learn (break things!)
>
>
>1. In my FPW2.6 days the tables and the EXE lived on the server together. The user had to have full rights to the directory in order to run the app, so the tables were basically sitting ducks which could be edited in Excel.
>
>2. With a VFP DBC under an NT4 server, rights are still set at the directory level and the tables are still accessible outside the app through ODBC with Access or whatever. Is this correct?

Yes. The users need that same rights as they did with Fox2x.

>
>3. With a VFP6 DBC under W2K server, rights can be set at the table level, but a user with rights to the table (which they would have to run the app) can still access the tables outside of the app (as above through ODBC.) Is this correct?

You can set the rights on a particular file using NT. If a user doesn't have read rights, they can't see the data.

>
>4. With a COM object running under MTS deployed on the server with the data, access to the data can be restricted to the COM "user" only, so this effectively provides security but requires the overhead of MTS. Is this correct?

Yes. I have recommended this solution to people.

>
>5. With VFP7 we are supposed to have some database events which will allow a database deployed on an NT4 server where the user has full rights to ask "who wants to know?" when the data is accessed. A user accessing the data through ODBC and Access or whatever would be missing the oIHaveRights object and could be denied access. There is a DevCon session devoted to this one, so I'll get the whole story there.

You can effectively setup security in VFP 7.0 using the new DBC events. I think Doug Hennig is doing a session on this at Miami.