Microsoft Access Database Security.doc

8/14/2019 Microsoft Access Database Security.doc

http://slidepdf.com/reader/full/microsoft-access-database-securitydoc 1/26

Microsoft Access Database Security

Steps to Securing an Access Database by Using User-level Security:

A workgroup information file is a file about the users in a workgroup. Microsoft Access reads

this file at startup. It contains information about account names, passwords, group membershipand preferences. Preference information is specified in the Options dialog box.

A workgroup information file is initially created by the setup program when Microsoft Access is

installed. The file is identified by the name and organisation information that is supplied during

the setup process of Microsoft Access.

A Workgroup ID (WID) is created when a new workgroup information file is created. A I!can ha"e between four and twenty characters and is case#sensiti"e. The I! guarantees that the

workgroup file can$t be recreated by another user by simply guessing the name and company. It

also makes the Admins group uni%ue to this workgroup file.

Access Workgroup Password Recovery v!"a

&eco"er lost passwords for M' Access user(group permissions security files

Access orkgroup Password &eco"ery is a program to reco"er lost or forgotten passwords for

M' Access workgroup files. All passwords are reco"ered instantly regardless of length.

Multilingual passwords are supported.

)ote* The following information details how to create and implement +ser#e"el 'ecurity usingMicrosoft Access -. These steps ha"e been thoroughly tested and ha"e been found to work

correctly. Please ensure that you follow the steps and instructions completely to recreate this

process. The author takes no responsibility for any problems that arise due to these instructionsnot being adhered to. Always remember to /A01#+P any files 2database and workgroup3 prior

to testing these procedures.

#ask A-: $reating a new workgroup infor%ation file

Ob4ecti"e* To create a new 'ystem.mdw with a new name

! &'it Access

-. Using t(e Windows &'plorer) open t(e folder $:*Progra% +iles*Microsoft

,ffice*,ffice! This folder is where the 'ystem.mdw is located with a fresh installation of

Microsoft Office -

5. $opy t(e file SS#&M!MDW to t(e root of your co%puter.s (ard drive 2don$t mo"e

the file3 to make a backup copy of the file.

http://www.databasedev.co.uk/access_password_recovery.html

http://www.databasedev.co.uk/security_overview.html

http://www.databasedev.co.uk/security_overview.html




6. /n t(e Microsoft ,ffice folder) double-click on MS Access Workgroup

Ad%inistrator.

This is a shortcut to the rkgadm.exe program that, when executed, runs the orkgroup

Administrator.

7. In the first dialog box is the name, company and workgroup to which you are 4oined.

8. $lick $reate to open the orkgroup Owner Information dialog box, which you can use

to create a new workgroup information file.

0! /n t(e 1a%e te't bo') type in your na%e!

2! /n t(e ,rganisation te't bo') type in your organisation na%e!

9. /n t(e Workgroup /D te't bo') type in %ywid!

:. $lick ,3 to accept this information and open the orkgroup Information ;ile dialog box.

::. Using t(e default pat() c(ange t(e database filena%e to MySyste%!%dw!



:-. $lick ,3 to accept the default path and new name for the new workgroup information

file, 0*<Program ;iles<Microsoft Office<Office<My'ystem.mdw

:5. /n t(e $onfir% Workgroup /nfor%ation dialog bo') verify t(at t(e infor%ation you

typed is correct!

:6. $lick ,3! =ou must confirm your entries for the new workgroup information file.

:7. /n t(e %essage bo' indicating t(at you (ave successfully created t(e workgroup

infor%ation file) click ,3!

:8. 4ook at t(e c(anges in t(e Workgroup Ad%inistrator dialog bo'! There$s the

information that you entered for the new workgroup information file. This workgroup

information file is used the next time that you start up Microsoft Access, so there is noneed to 4oin the workgroup now.



:>. $lick &'it to close the orkgroup Administrator and display the contents of the Office

folder in the indows ?xplorer. )otice that the new file, My'ystem.mdw, isn$t

displayed. =ou may need to refresh the "iew to see it.

:@. $(oose 5iew) Refres(. 'croll to see My'ystem.mdw and 'ystem.mdw. /oth workgroup

information files are sa"ed in the same folder.

:9. 6efore you close Windows &'plorer) %ake a s(ortcut to t(e MSAccess!e'e on t(e

desktop! =ou$ll be exiting and starting Microsoft Access se"eral times during this tutorialand a desktop shortcut makes restarting Microsoft Access more con"enient.

-. $lose Windows &'plorer.

Setting 4ogon Procedures

If you do not acti"ate the logon procedure, you are automatically logged on under the Admin

user account, for which there is an empty password. If you want to re%uire users to log on to start

Access, you can change the password of the Admin user account. The Admin user is a memberof the Admins 2Administrator3 group. The Admin user account is the same for e"ery installation

of Access. Administrators always ha"e full permissions for ob4ects created in the workgroup.

An Access password is case#sensiti"e and can ha"e up to :6 characters, including any A'0II

characters except null 2A'0II character 3. hen you type your password in the )ew Password

text box, asterisks are displayed to maintain your passwords security. The first time you set a

password, do not type anything in the Old Password text box.

/efore completing the following acti"ities, please ensure that you ha"e followed the pre"ious

exercise* 'teps to 'ecuring an Access !atabase by +sing +ser#le"el 'ecurity

#ask A-7: Activating t(e logon procedure

Ob4ecti"e* To change the logon password for the user named Admin to turn on security for the

My)ewApp.mdb database. Please download the My)ewApp.mdb database before starting this

tutorial.

:. Start Access! !o not open a database-. $(oose #ools) Security) User And 8roup Accounts! =ou use the +ser And Broup

Accounts dialog box to define user names, group membership, group names, and a logon

password.

5. 5erify t(at t(e Users tab is selected and t(at Ad%in is selected in t(e User 1a%e

te't bo'! =ou$re goint to change the password for this user.

http://www.databasedev.co.uk/access_security.html

http://www.databasedev.co.uk/downloads/MyNewApp.zip

http://www.databasedev.co.uk/access_security.html




6. Select t(e $(ange 4ogon Password tab! /n t(e 1ew Password te't bo') type

password! 2!on$t type in the Old Password text box because there is no old password.3Passwords are case#sensiti"e. )otice that an asterisk is displayed for each character that

you type.

7. /n t(e 5erfiy te't bo') type password! Accuracy is essentialC The password text boxes

should look identical.

8. $lick ,3 to accept your new password.

0! &'it Access!

@. Start Access! #ry to open My1ewApp!%db! The ogon dialog box opens before youcan open the database. =ou must enter a "alid user name and password.

9. /n t(e 1a%e te't bo') type Ad%in! /n t(e Password te't bo') type password!

:. $lick ,3 . )ow My)ewApp.mdb opensC



8roup Accounts:

hen you install Microsoft Access, you get one user account and two group accounts*

• The Admin account is the default user account.

• The Admins account is the system administrators group account. The Access 'etup program automatically adds the Admin user account to the Admins group.

• The +sers account is a group account that comprises all the user accounts. hen you

create a user account, it is automatically added to the +sers group. ?"eryone is always a

member of the +sers group and can$t be remo"ed.

=ou can log on to Microsoft Access with a user account, but not with a group account.

It is easier if you organise your users into groups and assign permissions to each group, rather

than to indi"idual users. A user can be a member of more than one group, and inherits all of the

permissions of each group. A good design strategy is to add permissions to the groups, and addusers to the appropriate group2s3.

A Personal Identifier 2PI!3 is a character string that is used in con4unction with the account name

to identify a user or group. The PI! is specified when you create a new user or group. =ou

should record this case#sensiti"e code in case you need to recreate the workgroup informationfile. )ote that the PI! is not a password. It$s another means of identifying who you are to

Microsoft Access.

et$s create two group accounts and set a uni%ue PI! for each one.

/efore completing the following acti"ities, please ensure that you ha"e followed the pre"iousexercise* 'etting ogon Procedures

#ask A-9: $reating 8roup Accounts in Microsoft Access

Ob4ecti"e* To create two new group accounts, one for the group who does Order ?ntry, and thesecond for the 'ales Managers group. This information relates to the sample Microsoft Access

database download

:. $lose My1ewApp!%db wit(out e'iting Access! =ou don$t need to ha"e a database

open to create accounts.

7! $(oose #ools) Security) User and 8roup Accounts!

5. /n t(e User And 8roup Accounts dialog bo') notice t(e Available 8roups list in t(e

8roup Me%bers(ip section! There are two groups a"ailable, one named Admins and

the other named +sers.

http://www.databasedev.co.uk/setting_logon_procedures.html



http://www.databasedev.co.uk/setting_logon_procedures.html





6. Select t(e 8roups tab! Display t(e 1a%e drop-down list!

The same two groups are listed here. =ou$re going to create two new groups to add to this

list.

7. $lose t(e 1a%e drop-down list! $lick 1ew to open the )ew +ser(Broup dialog box,

which is what you$ll use to create new group accounts, one at a time.

8. $reate t(e following group:

)ame* Order ?ntryPersonal I!* orderpid

All the characters are case#sensiti"e.

0! $lick ,3!

@. $reate anot(er group as follows:

)ame* 'ales Managers

Personal I!* salespid

! $lick ,3!

:. Display t(e 1a%e drop down list! )otice that four groups are now listed, including yourtwo new groups.



)ow that you$"e created new group accounts, it$s time to create new user accounts.

User Accounts

)ow that you$"e created new Microsoft Access Broup Accounts, it$s time to create new user

accounts in Microsoft Access.

hen you create user accounts for an application, those accounts are stored in the workgroup

that the users 4oin when they use the application. Therefore, before you create the user accounts,you should make sure that you are in the correct workgroup information file.

=ou can add a user to a group account or remo"e a user from a group account by making

selections in the +sers tab of the +sers And Broup Accounts dialog box. 'imilarly, you candelete a user account or a group account from a workgroup by making selections in the +sers tab

or the Broups tab of the +sers And Broup Accounts dialog box. =ou cannot delete the group

accounts Admins or +sers.

#ask A-;: $reating User Accounts in Microsoft Access

Ob4ecti"e* To create the administrator$s user account as well as four other user accounts, and to

assign each user to a group. This information relates to the sample Microsoft Access databasedownload

/efore you begin* The +ser and Broup Accounts dialog box is open, and the Order ?ntry and

'ales Managers group accounts are created # please complete the pre"ious tutorial 'etting up

Microsoft Access Broup Accounts before starting.

! Select t(e Users tab!

-. Display t(e 1a%e drop-down list! There$s only one user listed, Admin. =ou$re going to

create fi"e more users to add to this list.

5. /n t(e 8roups section) look at t(e Available 8roups list! ;our groups are listed,

including the two that you created. =ou can assign users to these groups.

http://www.databasedev.co.uk/user_accounts.html

http://www.databasedev.co.uk/group_accounts.html
















6. /n t(e User section) click 1ew to open the )ew +ser(Broup dialog box.

7. $reate a user account for yourself) as follows:

)ame* 2=our )ame3

Personal I!* mypid

$lick ,3!

<! +ro% t(e User 1a%e drop-down list) select your na%e!

>. +ro% t(e Available 8roup list) verify t(at Ad%ins is selected! $lick Add to create a

security administrator account with you as administrator. =ou are a member of the

Admins group. As such you inherit Administer rights to import files, create new users,and assign permissions.

@. 0reate the following new user accounts and assign each user to the indicated groupaccounts*

User 1a%e Personal /D 8roup Me%bers(ip

Oli"ia ? oli"iapid Order ?ntryD +sers

Oscar ! oscarpid Order ?ntryD +sers

'cott ' scottpid 'ales ManagersD +sers

'usan M susanpid 'ales ManagersD +sers



9. Display and scroll t(roug( t(e 1a%e drop-down list! )ow there are six user accounts,

including Admin, yourself, and the additional four that you ha"e created.

:. /n t(e User And 8roup Accounts dialog bo') click ,3 to accept your account

additions.

)ext we$ll look at 0hanging a 'ecurity Account Password.

$(anging a Password:

)ow that you$"e created new Microsoft Access +ser Accounts, it$s time to look at 'ecurity

Account Passwords.

Passwords that are entered when you log on to Access are known as 'ecurity Account

Passwords. The primary purpose of these passwords is to ensure that no other user can log on

using your name. If this is the first time you are adding a password to your Access account, youdo not ha"e to use the Old Password text box.

The Admin user has full permissions to all database ob4ects. The Admin users password is

empty, so anyone can log on to Access as the Admin user. To make your system more secure,

you can remo"e the Admin user from the Admins group. In this tutorial, you$ll do 4ust that.

#ask A-=: Setting your logon password and re%oving t(e Ad%in user fro% t(e

Ad%ins group

Ob4ecti"e* To add a password for yourself and to delete the Admin user. This information relates

to the sample Microsoft Access database download

! &'it Access!

-. Start Access! !on$t open a database.

5. $(oose #ools) Security) User And 8roup Accounts! The ogon dialog box opens.

6. 4og on by using your na%e 2as you typed it in when you created your own user

account3 and no password! There$s no password assigned to your name yet. After youclick O1, the +ser And Broup Accounts dialog box opens.

=! Select t(e $(ange 4ogon Password tab!

8. /n t(e 1ew Password and 5erify te't bo'es) type password! &emember, the passwordis case#sensiti"e.

>. $lick Apply to accept the change and lea"e the dialog box open.

http://www.databasedev.co.uk/change_password.html




http://www.databasedev.co.uk/change_password.html





An ob4ect$s owner is the user who creates that ob4ect, also known as the ob4ect$s creator. The

owner of an ob4ect has Administer permissions. Other users cannot change the ob4ect owner$s

permissions. If another user creates a new ob4ect in the database, then that user is the owner ofthe ob4ect. Fa"ing different owners for all the ob4ects within a database can be cumbersome. The

database will be easier to maintain if one user is designated as the owner and takes responsibility

for maintaining the ob4ects. =ou can change the owner of an ob4ect by using the 0hange Ownertab of the +ser and Broup Permissions dialog box.

)ow let$s use the 'ecurity iEard to create an unsecured backup copy of the sample Microsoft

Access database download file* My)ewApp.mdb and to secure My)ewApp.mdb. =ou should

ha"e already completed the pre"ious tutorials within this security sectionD details of each can befound at the bottom of this page.

#ask A-<: Using t(e Microsoft Access Security Wi>ard

Ob4ecti"e* To create a new database that only certain users can access. This information relates

to the sample Microsoft Access database download

! &'it Access! Start Access

7! ,pen My1ewApp!%db! /n t(e 4ogon dialog bo') enter your password and click

,3!

9! $(oose #ools) Security) User And 8roup Per%issions!

6. Select t(e $(ange ,wner tab! The form ob4ects are displayed. )otice that Admin is the

owner of e"ery form. !isplay different ob4ect types from the Ob4ect Type drop#down list.Admin is the owner of e"ery ob4ect type.

7. $lick $ancel to dismiss the dialog box.

8. $(oose #ools) Security) User-4evel Security Wi>ard to run t(e Security Wi>ard!Accept t(e default selection) Modify My $urrent Workgroup /nfor%ation +ile!

$lick 1e't!

>. =ou want to secure all database ob4ects, which is the default wiEard setting. Select t(e

All ,b?ects tab and scroll t(roug( t(e list to verify t(at all tables) @ueries) for%s)

reports and %acros are c(ecked!









2! $lick 1e't!

9. /n t(e ne't wi>ard dialog bo') c(eck t(ese security group accounts: ,rder &ntry

and Sales Managers! ?ach one defines specific permissions for the users you$ll assign to

the group. To read the group permissions assigned to each built#in group, select eachgroup 2but don$t check any of the built#in groups3

"! $lick 1e't!

::. /n t(e ne't wi>ard dialog bo') accept t(e default selection 1o) #(e Users 8roup

S(ould 1ot Bave Any Per%issions! Any permissions you assign to the +sers group

are the same permissions a"ailable to anyone with a copy of Access. =ou want to

completely lock out others.

7! $lick 1e't!

:5. In the next wiEard dialog box, the users you$"e already added to the workgroup

information file are listed. =ou also ha"e the option of adding new users. e$re not

adding any users now, so click 1e't!



:6. In the next wiEard dialog box, you assign users to groups in the workgroup informationfile. Select t(e option Select A 8roup And Assign Users #o #(e 8roup!

:7. =our name is already assigned to the Admins group, and the other users are already

assigned to either the Order ?ntry or 'ales Managers group. Use t(e following grap(ics

to select t(e group na%es and verify t(e users assigned to t(e%!

:8. $lick 1e't to ad"ance to the last wiEard dialog box. 5erify t(e na%e of t(e backup

copy of t(e unsecured database!



Also note that, after the database is secured, you$ll get a report of the settings that were

used to create the users and groups in the workgroup information file.

:>. $lick +inis( and wait while the wiEard secures the database ob4ects and creates the

report.

:@. Scroll t(roug( t(e ,ne-Step Security Wi>ard Report! )otice that there$s an unsecured

database 2.bak file3 and a secured database 2.mdb file3, both stored in the folder. The

report lists the secured ob4ects, groups and users. It$s important to keep this informationa"ailable in the report in case you e"er need to re#create the same workgroup file.

! $lose t(e report!

-. $lick es to sa"e the report as a 'napshot 2.snp3 file. ait for the encryption process to

finish.

7! ,n t(e taskbar) you will see t(e Snaps(ot 5iewer) and clicking t(is will view t(e new

file: My1ewApp!snp!

--. The snapshot report is sa"ed in the same location as the database file.

79! $lose t(e Snaps(ot 5iewer!

)ext we$ll take a look at 'ecurity Permissions and Permission Types.

Per%issions

After you run the 'ecurity iEard, you can manually change database and ob4ect permissions for

user and group accounts in a workgroup. It$s ad"isable to assign permissions to groups, not tousers, because each user inherits the permissions assigned to the group.

Per%ission #ypes

?ach user has access to nine types of permission for data or ob4ects in a database. The following

table describes the nine types of permission, and what each type enables a user to do. To read

http://www.databasedev.co.uk/permissions.html





more about these permissions, search Microsoft Access Felp for permissions, display the topic

ork ith Permissions, and select Types Of Permissions.

Per%ission Allows a user to ,b?ects involved

Open(&un Open a database, form, or report. &un a macro.!atabases, forms, reports,

and macros.

Open?xclusi"e

Open a database on a network, while ensuring that

others cannot open the database while the first user hasit open.

Tables, %ueries, forms,

reports, macros, andmodules.

&ead !esignGiew the design of ob4ects. )o changes to the design

are allowed.


reports, macros, andmodules.

Modify

!esign0hange the design of ob4ects and delete ob4ects.


reports, macros, and

modules.

Administer

'et database passwords, replicate databases, and

change startup properties. Fa"e full access to ob4ectsand data, and assign permissions for ob4ects.

!atabases, tables, %ueries,

forms, reports, macros, andmodules.

&ead !ata Giew data, but not table designs or %uery designs. Tables and %ueries.

+pdate !ata Giew and edit data, but not insert or delete data. Tables and %ueries.

Insert !ata Giew and insert data, but not change or delete data. Tables and %ueries.

!elete !ata Giew and delete data, but not change or insert data. Tables and %ueries.

/efore starting the following exercise you should ha"e already completed the pre"ious tutorialswithin this security sectionD details of each can be found at the bottom of this page.

#ask A-0: 8ranting per%issions to a database and its ob?ects

:. $(oose #ools) Security) User And 8roup Per%issions to display the +ser And Broup

Permissions dialog box.

-. Select t(e $(ange ,wner tab! Select different ob?ect types and notice t(at you are

t(e current owner of t(e database and all its ob?ects

5. Select t(e Per%issions tab! et$s take a look at the permissions assigned to the users andgroups, starting with the groups.



6. +ro% t(e 4ist options) select 8roups! The Admins group is selected in the +ser(Broup

)ame list.

7. &'plore t(e per%issions assigned to various ob?ect types and group na%es! )otice

that the Order ?ntry, 'ales Managers and +sers groups ha"e no permissions assigned tothem. ;or the +sers group, you want to lea"e it set that way.

8. +ro% t(e UserC8roup 1a%e list) select ,rder &ntry! =ou want to assign permissionsto this group.

>. +ro% t(e ,b?ect #ype drop-down list) select Database! In the Permissions section,

check Open(&un



@. $lick Apply! All users in the Order ?ntry group ha"e permission to open and run the

current database.

9. )ow let$s set the Order ?ntry group$s permissions for the table ob4ects in the current

database. ;rom the Ob4ect Type drop#down list, select Table. +ro% t(e ,b?ect 1a%e

list) select all t(e table na%es!

:. /n t(e Per%issions section) c(eck Update Data and /nsert Data! Unc(eck Delete

Data! )otice that the options &ead !esign and &ead !ata are also checked by defaultwith these options. Three options should be unchecked* Modify !esign, Administer, and

!elete !ata.

! $lick Apply!

:-. Apply database and ob?ect per%issions to groups according to t(e specifications in

t(e following table 2select all ob4ect names for each ob4ect type3*

8roup,b?ect

#ypePer%issions

,rder &ntry

Huery&ead !esign, &ead !ata, +pdate !ata, Insert !ata, !elete!ata # all Hueries

;orm Open(&un, &ead !esign # all ;orms

&eport Open(&un, &ead !esign # all &eports

Macro Open(&un # all Macros

Sales

Managers

!atabase Open(&un

Table &ead !ata, &ead !esign # all Tables

Huery &ead !ata, &ead !esign # all Hueries

;orm Open(&un # all ;orms

&eport Open(&un # all &eports

Macro Open(&un # all Macros

:5. $lick ,3 to close the dialog box.

)ow that you ha"e assigned your security for the groups and users, you will want to Test =our

Microsoft Access 'ecurity.

#esting your Microsoft Access Database Security:

After you$"e set up security for all groups and users, you will need to test it. Make sure that each

group has the options that you ha"e selected in the +ser And Broup Permissions dialog box.

http://www.databasedev.co.uk/testing_security.html







#ask A-2: #esting Microsoft Access Database Security!

Ob4ecti"e* To test the "arious groups for the security that you set up in the pre"ious tutorial #

Microsoft Access !atabase 'ecurity # 'ecurity Permissions

:. &'it Access! =ou$ll need to log on as a different user to test security.-. Start Access! ,pen My1ewApp!%db! 4og on wit( t(e na%e Susan M) and no

password! 'usan M is a member of the 'ales Managers group, so you$ll be testing the

permissions you assigned to that group.

5. +ro% t(e Database Window Press + to display database windowE) preview t(e

report) 6ook and $usto%er Sales! /ecause the 'ales Managers group has permission to

Open(&un all reports, 'usan M can pre"iew this report.

6. $(oose 5iew) Design 5iew! As 'usan M, you don$t ha"e permission to "iew the design

of the report.

7. $lick ,3 to dismiss the message box.

<! $lose t(e report!

>. )ow let$s try to add a new customer to the database. +ro% t(e database window) opent(e $usto%er for%! ook at the )ew &ecord na"igation button at the bottom of the

form. It$s dimmed. There$s your first clue that you can$t add a new record.

@. /ut you still ha"e the Add 0ustomer button on the form, right $lick t(e Add $usto%er

button!

Another roadblock. =ou can$t add a new record. The permission assignments work theway that you want them to.

9. $lick ,3 to dismiss the message box.





:. $lose t(e $usto%er for%!

::. +ro% t(e Switc(board) click Add $usto%er! =ou see a blank form.

:-. $lose t(e $usto%er for% 20hose ;ile, 0lose3

9! &'it Access!

:6. Start Microsoft Access and open My1ewApp!%db! 4og on as Ad%in wit( t(e

password) password!

The Admin user can$t e"en get past Bo.:7. $lick ,3 to dismiss the message box.

:8. &'it Access yet again.

:>. Start Access) open My1ewApp!%db) and log on wit( your na%e and password 2your

password is password3.

Once you ha"e tested your security you will want to !ocument !atabase 'ecurity.

Microsoft Access Database Security - Docu%enting your Database Security:

After you ha"e established security for your application, you can print a security report for a particular workgroup. In this report, you can see the security for both users and groups, 4ust

users, or 4ust groups. The report includes group names and user names, and indicates which users

and groups belong together in the particular workgroup. If you want to send the security reportdirectly to the printer, you can use the Print 'ecurity dialog box to make selections about what

le"el of security you want to document.

et$s start by taking a look at your options to print a report about users and groups in the sample

database # My)ewApp.mdb. =ou will ha"e created these user and group accounts and permissions in the pre"ious tutorials listed at the bottom of this page.

#ask A-: Printing reports about security users and groups!

:. $(oose #ools) Security) User And 8roup Accounts to open the +ser And BroupAccounts dialog box.

http://www.databasedev.co.uk/document_security.html









-. $lick Print Users And 8roups to open the Print 'ecurity dialog box.

5. #ake a look at t(e print security options!

=ou can print reports that show one of the following security le"els*

o All users defined for the current workgroup.

o All groups defined for the current workgroup.

o /oth user and group account information.

All users in the current workgroup can print reports showing user and group information.

6. $lick $ancel! /ecause printed security reports are sent directly to a printer, your

computer must be attached to a printer if you click O1.

5. $lose t(e User And 8roup Accounts dialog bo'! )ext, you$ll create a report on a formwith permissions for each user and group.

Once you ha"e tested your security you will want to !ocument !atabase 'ecurity.

Previewing Per%issions

If you want to "iew the permissions for a particular ob4ect, you can create a report that includes

the ob4ects design information and permissions listed by user and group. +se the !atabase

!ocumenter to "iew the definition for one ob4ect or multiple ob4ects.

et$s use the !ocumenter to pre"iew a report for user and group permissions as they$re set for the

0ustomer form.

=ou will ha"e created these user and group accounts and permissions in the pre"ious tutorials

listed at the bottom of this page using the sample database # My)ewApp.mdb..

#ask A-": Previewing reports about user and group per%issions by ob?ect!

:. $(oose #ools) Analy>e) Docu%enter to open the !ocumenter dialog box.

http://www.databasedev.co.uk/previewing_permissions.html




http://www.databasedev.co.uk/previewing_permissions.html





-. Display t(e for% ob?ects! $(eck fr%$usto%er to run the report on 4ust this one form.

5. $lick ,ptions to open the Print ;orm !efinition dialog box.

6. /n t(e /nclude +or +or% section) unc(eck Properties and $ode! $(eck Per%issions

6y Users And 8roups! To make your report run faster, check only those options you

need. Printing properties can fill up lots of pages.

7. /n t(e /nclude +or Sections And $ontrols section) select 1ot(ing! Again, this is tokeep the report shorter and include only the information you need.

8. $lick ,3 to close the Print ;orm !efinition dialog box.

>. $lick ,3 to run the !ocumenter. This might take se"eral minutes to run, so be patient.

The more information that you re%uest from the !ocumenter, the longer it takes to runthe report.

2! /n t(e ,b?ect Definition report for t(e $usto%er for%) look at t(e user and group

per%issions!

! $lose t(e report!



)ow we$"e in"estigated +ser and Broup 'ecurity in Microsoft Access, let$s take a look at

'ecuring a !atabase with a !atabase Password

Securing a Database wit( a Database Password:

To pre"ent unauthorised users from opening an application, you can add a database password.Fowe"er, a database password does not control what a user does once the application is opened.To set a password, the database must open in exclusi"e mode.

Make sure to keep a record of the database password. If you lose or forget the password, you

cannot open the database or retrie"e its data.

=ou can password#protect a database that contains tables that are linked to another database. =oumust pro"ide the password to the back#end database in a connection stringD you can sa"e the

password as part of the link to the tables. The password information is added to the end of the

connection string by using the password identifier, P!Jpassword. To change the password,

you need Administer permission to the database ob4ect

$aution: /ecause many people will share the same database password, it is risky to rely on the

database password without implementing full user#security. One person could change the

password and lock e"eryone else out. ith full user#security, you can control who has rights tochange the database password.

+nfortunately, people do lose or forget their passwords, making it impossible to access that data.

uckily, it does not mean that the data is lost fore"er. 0heck out the Microsoft Access Password

&eco"ery Tools a"ailable.

et$s experiment by setting a database password using the sample database # My)ewApp.mdb..

#ask A-: Setting a database password!

! $lose My1ewApp!%db

-. $lick t(e ,pen Database button - =ou need to use the Open dialog box.

5. Select My1ewApp!%db! $lick on t(e arrow ne't to t(e ,pen button!

6. $(oose ,pen &'clusive to open the My)ewApp.mdb database with exclusi"e access.

This gi"es you the sole access to the database when you ha"e it open. =ou can$t set a

http://www.databasedev.co.uk/database_password.html






http://www.databasedev.co.uk/database_password.html






database password if it$s in shared access mode. /y choosing the Open ?xclusi"e option,

you pre"ent other users from opening the database whilst you ha"e it open.

7. $(oose #ools) Security) Set Database Password to open the 'et !atabase dialog box.

8. /n t(e Password and 5erify te't bo'es) type dbpassword! Passwords are case#

sensiti"e.

>. $lick ,3 to accept the database password and close the dialog box.

2! $lose t(e database!

9. et$s test the password to see if it works. ,pen My1ewApp!%db! =ou must enter thedatabase password to open the database.

:. #ype dbpassword) and click ,3! The database opens.

Re%oving t(e Database Password

=ou can remo"e the password you ha"e set for a database. Once a password is set, the choice in

the Tools, 'ecurity menu choice becomes +nset !atabase Password. =ou will be prompted forthe passwordD it is case#sensiti"e. After you remo"e the database password, anyone has access to

the database.

et$s remo"e the database password you set for My)ewApp.mdb

#ask A-7: Re%oving a database password!

! $lose My1ewApp!%db! ,pen My1ewApp!%db in &'clusive Mode!

7! &nter dbpassword! $lick ,3



5. $(oose #ools) Security) Unset Database Password! )otice how this command has a

different name now that the database has a password set on it.

6. /n t(e Password te't bo') type dbpassword!

7. $lick ,3 to accept the password and close the dialog box.

8. et$s test this change. $lose t(e database!

>. ,pen My1ewApp!%db! =ou didn$t need to enter a database password to open thedatabase.

;or the final tutorial in this section, let$s take a look at !istributing the 'ecured Application

Distributing t(e Secured Database Application

/ecause permissions are stored with application databases, and accounts and passwords are

stored with workgroups, users must ha"e access to both the appropriate databases and

workgroups. To make an application database 2or databases3 and workgroups a"ailable to users,you can do any of the following procedures*

• 0opy the workgroup information file that defines the workgroup to a network ser"er.

+sers can 4oin this workgroup by specifying the network ser"er path to the workgroup

information file.

• Pro"ide each user with a copy of the workgroup information file that defines the

workgroup, so that the users can place it on their local workstation P0. +sers can then

4oin the workgroup. One drawback to this method is that if you update the workgroup you

must gi"e users separate copies of the updated files.

• If users are using different workgroup information files, you can create the same group

account in each workgroup instead of copying the whole workgroup into the file. Thecommon group account must ha"e the same name and personal identifier 2PI!3 in each

workgroup. =ou need to add the users in each workgroup to the common group.

• In all cases, the application files 2M!/s3 can be located on a shared network dri"e or

copied to the indi"idual workstations. If a users permissions are changed, you need to

redistribute a copy of the application database to each P0 where that user needs to work.

=ou might not want to gi"e users a copy of the workgroup information file that defines the

workgroup you used when you created the application, because then users might get full

http://www.databasedev.co.uk/distribute_secure_app.html

http://www.databasedev.co.uk/distribute_secure_app.html



permissions to databases and ob4ects 2if they can guess a password and log on to Access as

members of the Admins group3.

?ach user must ha"e a copy of Access in order to run your application. If you want users to runan application without ha"ing a copy of Access on their computers, you must use the Package

And !eployment iEard included in the M' Office - !e"eloper$s ?dition. This wiEardincludes the files necessary to use the run#time "ersion of Microsoft Access. It has its own setup

program that you can use to create a custom run#time setup for each users computer.

Microsoft Access Database Security.doc

Documents

Transcript of Microsoft Access Database Security.doc