SQL Server – Querying Two Databases with One Connection

Since you are running in a workgroup the only possible authentication is one using 'mirrored NT accounts', which means that the process trying to authenticate must be running under an identity that is 'mirrored' on the host that is authenticating the process. 'Mirrored' accounts are distinct local accounts with identical name and password on both hosts doing the authentication.

So it must follow that you're running SSMS from an account that it is mirrored on the SQL Server host (eg. <computername>\Administrator, which is mirrored by the <sqlhost>\Administrator and has the same password). Note that UAC has nothing to do here (ie running as administrator will not help).

Your application is probably running under a different local account (default IIS appool perhaps?) and the account under which the application runs is not mirrored on the SQL Server host.

Your best solution is to ditch the makeshift network and deploy a proper AD (domain). As an interim, make sure you run your application under an account that is mirrored on thew SQL Server host machine.

In my view Windows Authentication is still more secure. Just.

With windows authentication you can allow a group of people (via a Windows Group) to have access to the database. Only those users can use an application, any application, to connect to the database.

If you use a SQL Server account then anyone who knows the credentials (and invariably these always leak out) can connect to your database. Again with any application.

You are absolutely correct that with Windows authentication can connect directly to the database and issue any query they see fit - due to the model your app requires.

A third option

What I would suggest in this situation is the use of an application role: http://msdn.microsoft.com/en-us/library/ms190998.aspx

The problem you have here is you have to be able to code the application to be able to use the application role - that's not always easy. Afraid I'm not an Access expert to be able to advise here specifically.

The advantage of an application role is that you can restrict which applications can perform certain commands. Its similar to a database role but has a password assigned to it that is needed before the rights of the role can be inherited. Using an application role with a Windows group you could limit the users who can connect to a database and the application that they can use to query the database.