Microsoft Access Database Security

Steps to Securing an Access Database by Using User-level Security:

A workgroup information file is a file about the users in a workgroup. Microsoft Access reads this file at startup. It contains information about account names, passwords, group membership and preferences. Preference information is specified in the Options dialog box. A workgroup information file is initially created by the setup program when Microsoft Access is installed. The file is identified by the name and organisation information that is supplied during the setup process of Microsoft Access. A Workgroup ID (WID) is created when a new workgroup information file is created. A I! can ha"e between four and twenty characters and is case#sensiti"e. The I! guarantees that the workgroup file can$t be recreated by another user by simply guessing the name and company. It also makes the Admins group uni%ue to this workgroup file.

Access Workgroup Password Recovery v !"a &eco"er lost passwords for M' Access user(group permissions security files Access orkgroup Password &eco"ery is a program to reco"er lost or forgotten passwords for M' Access workgroup files. All passwords are reco"ered instantly regardless of length. Multilingual passwords are supported.

)ote* The following information details how to create and implement +ser#,e"el 'ecurity using Microsoft Access -.... These steps ha"e been thoroughly tested and ha"e been found to work correctly. Please ensure that you follow the steps and instructions completely to recreate this process. The author takes no responsibility for any problems that arise due to these instructions not being adhered to. Always remember to /A01#+P any files 2database and workgroup3 prior to testing these procedures. #ask A- : $reating a new workgroup infor%ation file Ob4ecti"e* To create a new 'ystem.mdw with a new name ! &'it Access -. Using t(e Windows &'plorer) open t(e folder $:*Progra% +iles*Microsoft ,ffice*,ffice! This folder is where the 'ystem.mdw is located with a fresh installation of Microsoft Office -... 5. $opy t(e file S-S#&M!MDW to t(e root of your co%puter.s (ard drive 2don$t mo"e the file3 to make a backup copy of the file.

6. /n t(e Microsoft ,ffice folder) double-click on MS Access Workgroup Ad%inistrator. This is a shortcut to the Administrator. rkgadm.exe program that, when executed, runs the orkgroup

7. In the first dialog box is the name, company and workgroup to which you are 4oined.

8. $lick $reate to open the orkgroup Owner Information dialog box, which you can use to create a new workgroup information file.

0! /n t(e 1a%e te't bo') type in your na%e! 2! /n t(e ,rganisation te't bo') type in your organisation na%e! 9. /n t(e Workgroup /D te't bo') type in %ywid!

:.. $lick ,3 to accept this information and open the box.

orkgroup Information ;ile dialog

::. Using t(e default pat() c(ange t(e database filena%e to MySyste%!%dw!

:-. $lick ,3 to accept the default path and new name for the new workgroup information file, 0*<Program ;iles<Microsoft Office<Office<My'ystem.mdw :5. /n t(e $onfir% Workgroup /nfor%ation dialog bo') verify t(at t(e infor%ation you typed is correct!

:6. $lick ,3! =ou must confirm your entries for the new workgroup information file. :7. /n t(e %essage bo' indicating t(at you (ave successfully created t(e workgroup infor%ation file) click ,3!

:8. 4ook at t(e c(anges in t(e Workgroup Ad%inistrator dialog bo'! There$s the information that you entered for the new workgroup information file. This workgroup information file is used the next time that you start up Microsoft Access, so there is no need to 4oin the workgroup now.

:>. $lick &'it to close the orkgroup Administrator and display the contents of the Office folder in the indows ?xplorer. )otice that the new file, My'ystem.mdw, isn$t displayed. =ou may need to refresh the "iew to see it. :@. $(oose 5iew) Refres(. 'croll to see My'ystem.mdw and 'ystem.mdw. /oth workgroup information files are sa"ed in the same folder. :9. 6efore you close Windows &'plorer) %ake a s(ortcut to t(e MSAccess!e'e on t(e desktop! =ou$ll be exiting and starting Microsoft Access se"eral times during this tutorial and a desktop shortcut makes restarting Microsoft Access more con"enient. -.. $lose Windows &'plorer.

Setting 4ogon Procedures

If you do not acti"ate the logon procedure, you are automatically logged on under the Admin user account, for which there is an empty password. If you want to re%uire users to log on to start Access, you can change the password of the Admin user account. The Admin user is a member of the Admins 2Administrator3 group. The Admin user account is the same for e"ery installation of Access. Administrators always ha"e full permissions for ob4ects created in the workgroup. An Access password is case#sensiti"e and can ha"e up to :6 characters, including any A'0II characters except null 2A'0II character .3. hen you type your password in the )ew Password text box, asterisks are displayed to maintain your passwordAs security. The first time you set a password, do not type anything in the Old Password text box. /efore completing the following acti"ities, please ensure that you ha"e followed the pre"ious exercise* 'teps to 'ecuring an Access !atabase by +sing +ser#le"el 'ecurity

#ask A-7: Activating t(e logon procedure

Ob4ecti"e* To change the logon password for the user named Admin to turn on security for the My)ewApp.mdb database. Please download the My)ewApp.mdb database before starting this tutorial. :. Start Access! !o not open a database -. $(oose #ools) Security) User And 8roup Accounts! =ou use the +ser And Broup Accounts dialog box to define user names, group membership, group names, and a logon password. 5. 5erify t(at t(e Users tab is selected and t(at Ad%in is selected in t(e User 1a%e te't bo'! =ou$re goint to change the password for this user.

6. Select t(e $(ange 4ogon Password tab! /n t(e 1ew Password te't bo') type password! 2!on$t type in the Old Password text box because there is no old password.3 Passwords are case#sensiti"e. )otice that an asterisk is displayed for each character that you type. 7. /n t(e 5erfiy te't bo') type password! Accuracy is essentialC The password text boxes should look identical.

8. $lick ,3 to accept your new password. 0! &'it Access! @. Start Access! #ry to open My1ewApp!%db! The ,ogon dialog box opens before you can open the database. =ou must enter a "alid user name and password.

9. /n t(e 1a%e te't bo') type Ad%in! /n t(e Password te't bo') type password!

:.. $lick ,3. )ow My)ewApp.mdb opensC

8roup Accounts:
hen you install Microsoft Access, you get one user account and two group accounts*

The Admin account is the default user account. The Admins account is the system administratorAs group account. The Access 'etup program automatically adds the Admin user account to the Admins group. The +sers account is a group account that comprises all the user accounts. hen you create a user account, it is automatically added to the +sers group. ?"eryone is always a member of the +sers group and can$t be remo"ed.

=ou can log on to Microsoft Access with a user account, but not with a group account. It is easier if you organise your users into groups and assign permissions to each group, rather than to indi"idual users. A user can be a member of more than one group, and inherits all of the permissions of each group. A good design strategy is to add permissions to the groups, and add users to the appropriate group2s3. A Personal Identifier 2PI!3 is a character string that is used in con4unction with the account name to identify a user or group. The PI! is specified when you create a new user or group. =ou should record this case#sensiti"e code in case you need to recreate the workgroup information file. )ote that the PI! is not a password. It$s another means of identifying who you are to Microsoft Access. ,et$s create two group accounts and set a uni%ue PI! for each one. /efore completing the following acti"ities, please ensure that you ha"e followed the pre"ious exercise* 'etting ,ogon Procedures

#ask A-9: $reating 8roup Accounts in Microsoft Access

Ob4ecti"e* To create two new group accounts, one for the group who does Order ?ntry, and the second for the 'ales Managers group. This information relates to the sample Microsoft Access database download :. $lose My1ewApp!%db wit(out e'iting Access! =ou don$t need to ha"e a database open to create accounts. 7! $(oose #ools) Security) User and 8roup Accounts! 5. /n t(e User And 8roup Accounts dialog bo') notice t(e Available 8roups list in t(e 8roup Me%bers(ip section! There are two groups a"ailable, one named Admins and the other named +sers.

6. Select t(e 8roups tab! Display t(e 1a%e drop-down list! The same two groups are listed here. =ou$re going to create two new groups to add to this list. 7. $lose t(e 1a%e drop-down list! $lick 1ew to open the )ew +ser(Broup dialog box, which is what you$ll use to create new group accounts, one at a time. 8. $reate t(e following group: )ame* Order ?ntry Personal I!* orderpid All the characters are case#sensiti"e.

0! $lick ,3! @. $reate anot(er group as follows: )ame* 'ales Managers Personal I!* salespid

:! $lick ,3! :.. Display t(e 1a%e drop down list! )otice that four groups are now listed, including your two new groups.

)ow that you$"e created new group accounts, it$s time to create new user accounts.

User Accounts
)ow that you$"e created new Microsoft Access Broup Accounts, it$s time to create new user accounts in Microsoft Access. hen you create user accounts for an application, those accounts are stored in the workgroup that the users 4oin when they use the application. Therefore, before you create the user accounts, you should make sure that you are in the correct workgroup information file. =ou can add a user to a group account or remo"e a user from a group account by making selections in the +sers tab of the +sers And Broup Accounts dialog box. 'imilarly, you can delete a user account or a group account from a workgroup by making selections in the +sers tab or the Broups tab of the +sers And Broup Accounts dialog box. =ou cannot delete the group accounts Admins or +sers.

#ask A-;: $reating User Accounts in Microsoft Access

Ob4ecti"e* To create the administrator$s user account as well as four other user accounts, and to assign each user to a group. This information relates to the sample Microsoft Access database download /efore you begin* The +ser and Broup Accounts dialog box is open, and the Order ?ntry and 'ales Managers group accounts are created # please complete the pre"ious tutorial 'etting up Microsoft Access Broup Accounts before starting. ! Select t(e Users tab! -. Display t(e 1a%e drop-down list! There$s only one user listed, Admin. =ou$re going to create fi"e more users to add to this list. 5. /n t(e 8roups section) look at t(e Available 8roups list! ;our groups are listed, including the two that you created. =ou can assign users to these groups.

6. /n t(e User section) click 1ew to open the )ew +ser(Broup dialog box. 7. $reate a user account for yourself) as follows: )ame* 2=our )ame3 Personal I!* mypid $lick ,3!

<! +ro% t(e User 1a%e drop-down list) select your na%e! >. +ro% t(e Available 8roup list) verify t(at Ad%ins is selected! $lick Add to create a security administrator account with you as administrator. =ou are a member of the Admins group. As such you inherit Administer rights to import files, create new users, and assign permissions.

@. 0reate the following new user accounts and assign each user to the indicated group accounts* User 1a%e Personal /D 8roup Me%bers(ip Oli"ia ? oli"iapid Order ?ntryD +sers Oscar ! oscarpid Order ?ntryD +sers 'cott ' scottpid 'ales ManagersD +sers 'usan M susanpid 'ales ManagersD +sers

9. Display and scroll t(roug( t(e 1a%e drop-down list! )ow there are six user accounts, including Admin, yourself, and the additional four that you ha"e created. :.. /n t(e User And 8roup Accounts dialog bo') click ,3 to accept your account additions. )ext we$ll look at 0hanging a 'ecurity Account Password.

$(anging a Password:
)ow that you$"e created new Microsoft Access +ser Accounts, it$s time to look at 'ecurity Account Passwords. Passwords that are entered when you log on to Access are known as 'ecurity Account Passwords. The primary purpose of these passwords is to ensure that no other user can log on using your name. If this is the first time you are adding a password to your Access account, you do not ha"e to use the Old Password text box. The Admin user has full permissions to all database ob4ects. The Admin userAs password is empty, so anyone can log on to Access as the Admin user. To make your system more secure, you can remo"e the Admin user from the Admins group. In this tutorial, you$ll do 4ust that.

#ask A-=: Setting your logon password and re%oving t(e Ad%in user fro% t(e Ad%ins group
Ob4ecti"e* To add a password for yourself and to delete the Admin user. This information relates to the sample Microsoft Access database download ! &'it Access! -. Start Access! !on$t open a database. 5. $(oose #ools) Security) User And 8roup Accounts! The ,ogon dialog box opens. 6. 4og on by using your na%e 2as you typed it in when you created your own user account3 and no password! There$s no password assigned to your name yet. After you click O1, the +ser And Broup Accounts dialog box opens. =! Select t(e $(ange 4ogon Password tab! 8. /n t(e 1ew Password and 5erify te't bo'es) type password! &emember, the password is case#sensiti"e.

>. $lick Apply to accept the change and lea"e the dialog box open.

@. ,n t(e Users page) select t(e User 1a%e Ad%in!

9. +ro% t(e Me%ber ,f list) select Ad%ins!

:.. $lick Re%ove to remo"e the Admin user from the Admins group. The Admin user remains a member of the +sers group only.

::. $lick ,3 to accept the change and close the +ser And Broup Accounts dialog box. )ext we$ll take a look at The 'ecurity iEard.

#(e Security Wi>ard:

The Admin user owns all the ob4ects in the database and has irre"ocable permissions to them. Fowe"er, it is important to change the ownership to the pro4ect leaderAs account 2you3. hen you create or copy an ob4ect, the user who is logged in becomes the owner. The easiest way to change ownership of all ob4ects in the database is to first make sure your pro4ect leader is logged in, and then run the 'ecurity iEard. =ou can use the 'ecurity iEard to create a new database and fill it with copies of the ob4ects of the database that is currently open. The 'ecurity iEard exports copies of all the ob4ects from the original database. It also secures selected ob4ect types by re"oking all permissions in the +sers group for those ob4ects in the database. The new database is encrypted, which means that it is indecipherable during electronic transmission or when it is stored on a disk, tape, or other magnetic medium. All table relationships and linked tables are recreated in the new database. Fowe"er, the original database is not changed.

$(anging t(e ,wners(ip of Database ,b?ects

An ob4ect$s owner is the user who creates that ob4ect, also known as the ob4ect$s creator. The owner of an ob4ect has Administer permissions. Other users cannot change the ob4ect owner$s permissions. If another user creates a new ob4ect in the database, then that user is the owner of the ob4ect. Fa"ing different owners for all the ob4ects within a database can be cumbersome. The database will be easier to maintain if one user is designated as the owner and takes responsibility for maintaining the ob4ects. =ou can change the owner of an ob4ect by using the 0hange Owner tab of the +ser and Broup Permissions dialog box. )ow let$s use the 'ecurity iEard to create an unsecured backup copy of the sample Microsoft Access database download file* My)ewApp.mdb and to secure My)ewApp.mdb. =ou should ha"e already completed the pre"ious tutorials within this security sectionD details of each can be found at the bottom of this page.

#ask A-<: Using t(e Microsoft Access Security Wi>ard

Ob4ecti"e* To create a new database that only certain users can access. This information relates to the sample Microsoft Access database download ! &'it Access! Start Access 7! ,pen My1ewApp!%db! /n t(e 4ogon dialog bo') enter your password and click ,3! 9! $(oose #ools) Security) User And 8roup Per%issions! 6. Select t(e $(ange ,wner tab! The form ob4ects are displayed. )otice that Admin is the owner of e"ery form. !isplay different ob4ect types from the Ob4ect Type drop#down list. Admin is the owner of e"ery ob4ect type.

7. $lick $ancel to dismiss the dialog box. 8. $(oose #ools) Security) User-4evel Security Wi>ard to run t(e Security Wi>ard! Accept t(e default selection) Modify My $urrent Workgroup /nfor%ation +ile! $lick 1e't! >. =ou want to secure all database ob4ects, which is the default wiEard setting. Select t(e All ,b?ects tab and scroll t(roug( t(e list to verify t(at all tables) @ueries) for%s) reports and %acros are c(ecked!

2! $lick 1e't! 9. /n t(e ne't wi>ard dialog bo') c(eck t(ese security group accounts: ,rder &ntry and Sales Managers! ?ach one defines specific permissions for the users you$ll assign to the group. To read the group permissions assigned to each built#in group, select each group 2but don$t check any of the built#in groups3

"! $lick 1e't! ::. /n t(e ne't wi>ard dialog bo') accept t(e default selection A1o) #(e Users 8roup S(ould 1ot Bave Any Per%issionsA! Any permissions you assign to the +sers group are the same permissions a"ailable to anyone with a copy of Access. =ou want to completely lock out others.

7! $lick 1e't! :5. In the next wiEard dialog box, the users you$"e already added to the workgroup information file are listed. =ou also ha"e the option of adding new users. e$re not adding any users now, so click 1e't!

:6. In the next wiEard dialog box, you assign users to groups in the workgroup information file. Select t(e option Select A 8roup And Assign Users #o #(e 8roup!

:7. =our name is already assigned to the Admins group, and the other users are already assigned to either the Order ?ntry or 'ales Managers group. Use t(e following grap(ics to select t(e group na%es and verify t(e users assigned to t(e%!

:8. $lick 1e't to ad"ance to the last wiEard dialog box. 5erify t(e na%e of t(e backup copy of t(e unsecured database!

Also note that, after the database is secured, you$ll get a report of the settings that were used to create the users and groups in the workgroup information file. :>. $lick +inis( and wait while the wiEard secures the database ob4ects and creates the report. :@. Scroll t(roug( t(e ,ne-Step Security Wi>ard Report! )otice that there$s an unsecured database 2.bak file3 and a secured database 2.mdb file3, both stored in the folder. The report lists the secured ob4ects, groups and users. It$s important to keep this information a"ailable in the report in case you e"er need to re#create the same workgroup file. :! $lose t(e report! -.. $lick -es to sa"e the report as a 'napshot 2.snp3 file. finish. ait for the encryption process to

7 ! ,n t(e taskbar) you will see t(e Snaps(ot 5iewer) and clicking t(is will view t(e new file: My1ewApp!snp! --. The snapshot report is sa"ed in the same location as the database file. 79! $lose t(e Snaps(ot 5iewer! )ext we$ll take a look at 'ecurity Permissions and Permission Types.

Per%issions
After you run the 'ecurity iEard, you can manually change database and ob4ect permissions for user and group accounts in a workgroup. It$s ad"isable to assign permissions to groups, not to users, because each user inherits the permissions assigned to the group.

Per%ission #ypes
?ach user has access to nine types of permission for data or ob4ects in a database. The following table describes the nine types of permission, and what each type enables a user to do. To read

more about these permissions, search Microsoft Access Felp for permissions, display the topic ork ith Permissions, and select Types Of Permissions. ,b?ects involved !atabases, forms, reports, Open(&un Open a database, form, or report. &un a macro. and macros. Open a database on a network, while ensuring that Tables, %ueries, forms, Open others cannot open the database while the first user has reports, macros, and ?xclusi"e it open. modules. Tables, %ueries, forms, Giew the design of ob4ects. )o changes to the design &ead !esign reports, macros, and are allowed. modules. Tables, %ueries, forms, Modify 0hange the design of ob4ects and delete ob4ects. reports, macros, and !esign modules. 'et database passwords, replicate databases, and !atabases, tables, %ueries, Administer change startup properties. Fa"e full access to ob4ects forms, reports, macros, and and data, and assign permissions for ob4ects. modules. &ead !ata Giew data, but not table designs or %uery designs. Tables and %ueries. +pdate !ata Giew and edit data, but not insert or delete data. Tables and %ueries. Insert !ata Giew and insert data, but not change or delete data. Tables and %ueries. !elete !ata Giew and delete data, but not change or insert data. Tables and %ueries. /efore starting the following exercise you should ha"e already completed the pre"ious tutorials within this security sectionD details of each can be found at the bottom of this page. Per%ission Allows a user to

#ask A-0: 8ranting per%issions to a database and its ob?ects

:. $(oose #ools) Security) User And 8roup Per%issions to display the +ser And Broup Permissions dialog box. -. Select t(e $(ange ,wner tab! Select different ob?ect types and notice t(at you are t(e current owner of t(e database and all its ob?ects

5. Select t(e Per%issions tab! ,et$s take a look at the permissions assigned to the users and groups, starting with the groups.

6. +ro% t(e 4ist options) select 8roups! The Admins group is selected in the +ser(Broup )ame list.

7. &'plore t(e per%issions assigned to various ob?ect types and group na%es! )otice that the Order ?ntry, 'ales Managers and +sers groups ha"e no permissions assigned to them. ;or the +sers group, you want to lea"e it set that way. 8. +ro% t(e UserC8roup 1a%e list) select ,rder &ntry! =ou want to assign permissions to this group. >. +ro% t(e ,b?ect #ype drop-down list) select Database! In the Permissions section, check Open(&un

@. $lick Apply! All users in the Order ?ntry group ha"e permission to open and run the current database. 9. )ow let$s set the Order ?ntry group$s permissions for the table ob4ects in the current database. ;rom the Ob4ect Type drop#down list, select Table. +ro% t(e ,b?ect 1a%e list) select all t(e table na%es! :.. /n t(e Per%issions section) c(eck Update Data and /nsert Data! Unc(eck Delete Data! )otice that the options &ead !esign and &ead !ata are also checked by default with these options. Three options should be unchecked* Modify !esign, Administer, and !elete !ata.

! $lick Apply! :-. Apply database and ob?ect per%issions to groups according to t(e specifications in t(e following table 2select all ob4ect names for each ob4ect type3* 8roup ,b?ect #ype Huery ,rder &ntry ;orm &eport Macro Per%issions &ead !esign, &ead !ata, +pdate !ata, Insert !ata, !elete !ata # all Hueries Open(&un, &ead !esign # all ;orms Open(&un, &ead !esign # all &eports Open(&un # all Macros

!atabase Open(&un Table &ead !ata, &ead !esign # all Tables Huery &ead !ata, &ead !esign # all Hueries Sales Managers ;orm Open(&un # all ;orms &eport Open(&un # all &eports Macro Open(&un # all Macros :5. $lick ,3 to close the dialog box. )ow that you ha"e assigned your security for the groups and users, you will want to Test =our Microsoft Access 'ecurity.

#esting your Microsoft Access Database Security:

After you$"e set up security for all groups and users, you will need to test it. Make sure that each group has the options that you ha"e selected in the +ser And Broup Permissions dialog box.

#ask A-2: #esting Microsoft Access Database Security!

Ob4ecti"e* To test the "arious groups for the security that you set up in the pre"ious tutorial # Microsoft Access !atabase 'ecurity # 'ecurity Permissions :. &'it Access! =ou$ll need to log on as a different user to test security. -. Start Access! ,pen My1ewApp!%db! 4og on wit( t(e na%e Susan M) and no password! 'usan M is a member of the 'ales Managers group, so you$ll be testing the permissions you assigned to that group. 5. +ro% t(e Database Window DPress + to display database windowE) preview t(e report) 6ook and $usto%er Sales! /ecause the 'ales Managers group has permission to Open(&un all reports, 'usan M can pre"iew this report. 6. $(oose 5iew) Design 5iew! As 'usan M, you don$t ha"e permission to "iew the design of the report.

7. $lick ,3 to dismiss the message box. <! $lose t(e report! >. )ow let$s try to add a new customer to the database. +ro% t(e database window) open t(e $usto%er for%! ,ook at the )ew &ecord na"igation button at the bottom of the form. It$s dimmed. There$s your first clue that you can$t add a new record.

@. /ut you still ha"e the Add 0ustomer button on the form, rightI $lick t(e Add $usto%er button!

Another roadblock. =ou can$t add a new record. The permission assignments work the way that you want them to. 9. $lick ,3 to dismiss the message box.

:.. $lose t(e $usto%er for%! ::. +ro% t(e Switc(board) click Add $usto%er! =ou see a blank form. :-. $lose t(e $usto%er for% 20hose ;ile, 0lose3 9! &'it Access! :6. Start Microsoft Access and open My1ewApp!%db! 4og on as Ad%in wit( t(e password) ApasswordA!

The Admin user can$t e"en get past Bo. :7. $lick ,3 to dismiss the message box. :8. &'it Access yet again. :>. Start Access) open My1ewApp!%db) and log on wit( your na%e and password 2your password is password3. Once you ha"e tested your security you will want to !ocument !atabase 'ecurity.

Microsoft Access Database Security - Docu%enting your Database Security:

After you ha"e established security for your application, you can print a security report for a particular workgroup. In this report, you can see the security for both users and groups, 4ust users, or 4ust groups. The report includes group names and user names, and indicates which users and groups belong together in the particular workgroup. If you want to send the security report directly to the printer, you can use the Print 'ecurity dialog box to make selections about what le"el of security you want to document. ,et$s start by taking a look at your options to print a report about users and groups in the sample database # My)ewApp.mdb. =ou will ha"e created these user and group accounts and permissions in the pre"ious tutorials listed at the bottom of this page.

#ask A-:: Printing reports about security users and groups!

:. $(oose #ools) Security) User And 8roup Accounts to open the +ser And Broup Accounts dialog box.

-. $lick Print Users And 8roups to open the Print 'ecurity dialog box.

5. #ake a look at t(e print security options!

=ou can print reports that show one of the following security le"els*
o o o

All users defined for the current workgroup. All groups defined for the current workgroup. /oth user and group account information.

All users in the current workgroup can print reports showing user and group information. 6. $lick $ancel! /ecause printed security reports are sent directly to a printer, your computer must be attached to a printer if you click O1. 5. $lose t(e User And 8roup Accounts dialog bo'! )ext, you$ll create a report on a form with permissions for each user and group. Once you ha"e tested your security you will want to !ocument !atabase 'ecurity.

Previewing Per%issions
If you want to "iew the permissions for a particular ob4ect, you can create a report that includes the ob4ectAs design information and permissions listed by user and group. +se the !atabase !ocumenter to "iew the definition for one ob4ect or multiple ob4ects. ,et$s use the !ocumenter to pre"iew a report for user and group permissions as they$re set for the 0ustomer form. =ou will ha"e created these user and group accounts and permissions in the pre"ious tutorials listed at the bottom of this page using the sample database # My)ewApp.mdb..

#ask A- ": Previewing reports about user and group per%issions by ob?ect!
:. $(oose #ools) Analy>e) Docu%enter to open the !ocumenter dialog box.

-. Display t(e for% ob?ects! $(eck fr%$usto%er to run the report on 4ust this one form.

5. $lick ,ptions to open the Print ;orm !efinition dialog box. 6. /n t(e /nclude +or +or% section) unc(eck Properties and $ode! $(eck Per%issions 6y Users And 8roups! To make your report run faster, check only those options you need. Printing properties can fill up lots of pages.

7. /n t(e /nclude +or Sections And $ontrols section) select 1ot(ing! Again, this is to keep the report shorter and include only the information you need.

8. $lick ,3 to close the Print ;orm !efinition dialog box. >. $lick ,3 to run the !ocumenter. This might take se"eral minutes to run, so be patient. The more information that you re%uest from the !ocumenter, the longer it takes to run the report. 2! /n t(e ,b?ect Definition report for t(e $usto%er for%) look at t(e user and group per%issions! :! $lose t(e report!

)ow we$"e in"estigated +ser and Broup 'ecurity in Microsoft Access, let$s take a look at 'ecuring a !atabase with a !atabase Password

Securing a Database wit( a Database Password:

To pre"ent unauthorised users from opening an application, you can add a database password. Fowe"er, a database password does not control what a user does once the application is opened. To set a password, the database must open in exclusi"e mode. Make sure to keep a record of the database password. If you lose or forget the password, you cannot open the database or retrie"e its data. =ou can password#protect a database that contains tables that are linked to another database. =ou must pro"ide the password to the back#end database in a connection stringD you can sa"e the password as part of the link to the tables. The password information is added to the end of the connection string by using the password identifier, P !Jpassword. To change the password, you need Administer permission to the database ob4ect $aution: /ecause many people will share the same database password, it is risky to rely on the database password without implementing full user#security. One person could change the password and lock e"eryone else out. ith full user#security, you can control who has rights to change the database password. +nfortunately, people do lose or forget their passwords, making it impossible to access that data. ,uckily, it does not mean that the data is lost fore"er. 0heck out the Microsoft Access Password &eco"ery Tools a"ailable. ,et$s experiment by setting a database password using the sample database # My)ewApp.mdb..

#ask A- : Setting a database password!

! $lose My1ewApp!%db -. $lick t(e ,pen Database button - =ou need to use the Open dialog box. 5. Select My1ewApp!%db! $lick on t(e arrow ne't to t(e ,pen button!

6. $(oose ,pen &'clusive to open the My)ewApp.mdb database with exclusi"e access. This gi"es you the sole access to the database when you ha"e it open. =ou can$t set a

database password if it$s in shared access mode. /y choosing the Open ?xclusi"e option, you pre"ent other users from opening the database whilst you ha"e it open. 7. $(oose #ools) Security) Set Database Password to open the 'et !atabase dialog box. 8. /n t(e Password and 5erify te't bo'es) type dbpassword! Passwords are case# sensiti"e.

>. $lick ,3 to accept the database password and close the dialog box. 2! $lose t(e database! 9. ,et$s test the password to see if it works. ,pen My1ewApp!%db! =ou must enter the database password to open the database.

:.. #ype dbpassword) and click ,3! The database opens.

Re%oving t(e Database Password

=ou can remo"e the password you ha"e set for a database. Once a password is set, the choice in the Tools, 'ecurity menu choice becomes +nset !atabase Password. =ou will be prompted for the passwordD it is case#sensiti"e. After you remo"e the database password, anyone has access to the database. ,et$s remo"e the database password you set for My)ewApp.mdb

#ask A- 7: Re%oving a database password!

! $lose My1ewApp!%db! ,pen My1ewApp!%db in &'clusive Mode! 7! &nter dbpassword! $lick ,3

5. $(oose #ools) Security) Unset Database Password! )otice how this command has a different name now that the database has a password set on it. 6. /n t(e Password te't bo') type dbpassword!

7. $lick ,3 to accept the password and close the dialog box. 8. ,et$s test this change. $lose t(e database! >. ,pen My1ewApp!%db! =ou didn$t need to enter a database password to open the database. ;or the final tutorial in this section, let$s take a look at !istributing the 'ecured Application

Distributing t(e Secured Database Application

/ecause permissions are stored with application databases, and accounts and passwords are stored with workgroups, users must ha"e access to both the appropriate databases and workgroups. To make an application database 2or databases3 and workgroups a"ailable to users, you can do any of the following procedures*

0opy the workgroup information file that defines the workgroup to a network ser"er. +sers can 4oin this workgroup by specifying the network ser"er path to the workgroup information file. Pro"ide each user with a copy of the workgroup information file that defines the workgroup, so that the users can place it on their local workstation P0. +sers can then 4oin the workgroup. One drawback to this method is that if you update the workgroup you must gi"e users separate copies of the updated files. If users are using different workgroup information files, you can create the same group account in each workgroup instead of copying the whole workgroup into the file. The common group account must ha"e the same name and personal identifier 2PI!3 in each workgroup. =ou need to add the users in each workgroup to the common group. In all cases, the application files 2M!/As3 can be located on a shared network dri"e or copied to the indi"idual workstations. If a userAs permissions are changed, you need to redistribute a copy of the application database to each P0 where that user needs to work.

=ou might not want to gi"e users a copy of the workgroup information file that defines the workgroup you used when you created the application, because then users might get full

permissions to databases and ob4ects 2if they can guess a password and log on to Access as members of the Admins group3. ?ach user must ha"e a copy of Access in order to run your application. If you want users to run an application without ha"ing a copy of Access on their computers, you must use the Package And !eployment iEard included in the M' Office -... !e"eloper$s ?dition. This wiEard includes the files necessary to use the run#time "ersion of Microsoft Access. It has its own setup program that you can use to create a custom run#time setup for each userAs computer.