Microsoft Access Database Security Steps to Securing an Access Database by Using User-level Security: A workgroup information file is a file

about the users in a workgroup. Microsoft Access reads this file at startup. It contains information about account names, passwords, group membership and preferences. Preference information is specified in the Options dialog box. A workgroup information file is initially created by the setup program when Microsoft Access is installed. The file is identified by the name and organisation information that is supplied during the setup process of Microsoft Access. A Workgroup ID (WID) is created when a new workgroup information file is created. A I! can ha"e between four and twenty characters and is case#sensiti"e. The I! guarantees that the workgroup file can$t be recreated by another user by simply guessing the name and company. It also makes the Admins group uni%ue to this workgroup file. Access Workgroup Password Recovery v !"a &eco"er lost passwords for M' Access user(group permissions security files Access orkgroup Password &eco"ery is a program to reco"er lost or forgotten passwords for M' Access workgroup files. All passwords are reco"ered instantly regardless of length. Multilingual passwords are supported. )ote* The following information details how to create and implement +ser#,e"el 'ecurity using Microsoft Access -.... These steps ha"e been thoroughly tested and ha"e been found to work correctly. Please ensure that you follow the steps and instructions completely to recreate this process. The author takes no responsibility for any problems that arise due to these instructions not being adhered to. Always remember to /A01#+P any files 2database and workgroup3 prior to testing these procedures. #ask A- : $reating a new workgroup infor%ation file Ob4ecti"e* To create a new 'ystem.mdw with a new name ! &'it Access -. Using t(e Windows &'plorer) open t(e folder $:*Progra% +iles*Microsoft ,ffice*,ffice! This folder is where the 'ystem.mdw is located with a fresh installation of Microsoft Office -... 5. $opy t(e file S-S#&M!MDW to t(e root of your co%puter.s (ard drive 2don$t mo"e the file3 to make a backup copy of the file. 6. /n t(e Microsoft ,ffice folder) double-click on MS Access Workgroup Ad%inistrator. This is a shortcut to the rkgadm.exe program that, when executed, runs the orkgroup Administrator. In the first dialog box is the name, company and workgroup to which you are 4oined.

7.

1 / 17

8.

$lick $reate to open the orkgroup Owner Information dialog box, which you can use to create a new workgroup information file.

0! 2! 9.

/n t(e 1a%e te't bo') type in your na%e! /n t(e ,rganisation te't bo') type in your organisation na%e! /n t(e Workgroup /D te't bo') type in %ywid!

:.. ::.

$lick ,3 to accept this information and open the orkgroup Information ;ile dialog box. Using t(e default pat() c(ange t(e database filena%e to MySyste%!%dw!

:-.

$lick ,3 to accept the default path and new name for the new workgroup information file, 0*<Program ;iles<Microsoft Office<Office<My'ystem.mdw :5. /n t(e $onfir% Workgroup /nfor%ation dialog bo') verify t(at t(e infor%ation you typed is correct!

:6. :7.

$lick ,3! =ou must confirm your entries for the new workgroup information file. /n t(e %essage bo' indicating t(at you (ave successfully created t(e workgroup infor%ation file) click ,3!

:8.

4ook at t(e c(anges in t(e Workgroup Ad%inistrator dialog bo'! There$s the information that you entered for the new workgroup information file. This workgroup information file is used the next time that you start up Microsoft Access, so there is no need to

2 / 17

4oin the workgroup now.

:>.

$lick &'it to close the orkgroup Administrator and display the contents of the Office folder in the indows ?xplorer. )otice that the new file, My'ystem.mdw, isn$t displayed. =ou may need to refresh the "iew to see it. :@. $(oose 5iew) Refres(. 'croll to see My'ystem.mdw and 'ystem.mdw. /oth workgroup information files are sa"ed in the same folder. :9. 6efore you close Windows &'plorer) %ake a s(ortcut to t(e MSAccess!e'e on t(e desktop! =ou$ll be exiting and starting Microsoft Access se"eral times during this tutorial and a desktop shortcut makes restarting Microsoft Access more con"enient. -.. $lose Windows &'plorer. ########################################################################################################################################### ####### Setting Logon Procedures If you do not activate the logon procedure, you are automatically logged on under the Admin user account, for which there is an empty password. If you want to require users to log on to start Access, you can change the password of the Admin user account. The Admin user is a member of the Admins (Administrator) group. The Admin user account is the same for every installation of Access. Administrators always have full permissions for objects created in the wor group. An Access password is case!sensitive and can have up to "# characters, including any A$%II characters e&cept null (A$%II character '). (hen you type your password in the )ew *assword te&t bo&, asteris s are displayed to maintain your password+s security. The first time you set a password, do not type anything in the ,ld *assword te&t bo&. -efore completing the following activities, please ensure that you have followed the previous e&ercise. 'teps to 'ecuring an Access !atabase by +sing +ser#le"el 'ecurity Task A-2: Activating the logon procedure ,bjective. To change the logon password for the user named Admin to turn on security for the /y)ewApp.mdb database. *lease download the My)ewApp.mdb database before starting this tutorial. :. Start Access! !o not open a database -. $(oose #ools) Security) User And 7roup Accounts! =ou use the +ser And Aroup Accounts dialog box to define user names, group membership, group names, and a logon password. 5. 5erify t(at t(e Users tab is selected and t(at Ad%in is selected in t(e User 1a%e te't bo'! =ou$re goint to change the password for this user.

3 / 17

6.

7.

Select t(e $(ange 4ogon Password tab! /n t(e 1ew Password te't bo') type password! 2!on$t type in the Old Password text box because there is no old password.3 Passwords are case#sensiti"e. )otice that an asterisk is displayed for each character that you type. /n t(e 5erfiy te't bo') type password! Accuracy is essentialB The password text boxes should look identical.

8. 0! @.

$lick ,3 to accept your new password. &'it Access! Start Access! #ry to open My1ewApp!%db! The ,ogon dialog box opens before you can open the database. =ou must enter a "alid user name and password.

9.

/n t(e 1a%e te't bo') type Ad%in! /n t(e Password te't bo') type password!

:..

$lick ,3. )ow My)ewApp.mdb opensB

---------------------------------------------------------------------------------------------------------Group Accounts: (hen you install /icrosoft Access, you get one user account and two group accounts.

The Admin account is the default user account. The Admins account is the system administratorCs group account. The Access 'etup program automatically adds the Admin user account to the Admins group. The +sers account is a group account that comprises all the user accounts. hen you create a user account, it is automatically added to the +sers group. ?"eryone is always a member of the +sers group and can$t be remo"ed.

0ou can log on to /icrosoft Access with a user account, but not with a group account. It is easier if you organise your users into groups and assign permissions to each group, rather than to individual users. A user can be a member of more than one group, and inherits all of the permissions of each group. A good design strategy is to add permissions to the groups, and add users to the appropriate group(s). A *ersonal Identifier (*I1) is a character string that is used in conjunction with the account name to identify a user or group. The *I1 is specified when you create a new user or group. 0ou should record this case!sensitive code in case you need to recreate the wor group information file. )ote that the *I1 is not a password. It2s another means of identifying who you are to /icrosoft Access. 3et2s create two group accounts and set a unique *I1 for each one. -efore completing the following activities, please ensure that you have followed the previous e&ercise. 'etting ,ogon Procedures

4 / 17

Task A-3: Creating Group Accounts in Microsoft Access ,bjective. To create two new group accounts, one for the group who does ,rder 4ntry, and the second for the $ales /anagers group. This information relates to the sample Microsoft Access database download :. $lose My1ewApp!%db wit(out e'iting Access! =ou don$t need to ha"e a database open to create accounts. 8! $(oose #ools) Security) User and 7roup Accounts! 5. /n t(e User And 7roup Accounts dialog bo') notice t(e Available 7roups list in t(e 7roup Me%bers(ip section! There are two groups a"ailable, one named Admins and the other named +sers.

6. 7. 8.

Select t(e 7roups tab! Display t(e 1a%e drop-down list! The same two groups are listed here. =ou$re going to create two new groups to add to this list. $lose t(e 1a%e drop-down list! $lick 1ew to open the )ew +ser(Aroup dialog box, which is what you$ll use to create new group accounts, one at a time. $reate t(e following group: )ame* Order ?ntry Personal I!* orderpid All the characters are case#sensiti"e.

0! @.

$lick ,3! $reate anot(er group as follows: )ame* 'ales Managers Personal I!* salespid

9! :..

$lick ,3! Display t(e 1a%e drop down list! )otice that four groups are now listed, including your two new groups.

)ow that you2ve created new group accounts, it2s time to create new user accounts.

5 / 17

-------------------------------------------------------------------------------------------------------------ser Accounts )ow that you2ve created new Microsoft Access Aroup Accounts, it2s time to create new user accounts in /icrosoft Access. (hen you create user accounts for an application, those accounts are stored in the wor group that the users join when they use the application. Therefore, before you create the user accounts, you should ma e sure that you are in the correct wor group information file. 0ou can add a user to a group account or remove a user from a group account by ma ing selections in the 5sers tab of the 5sers And 6roup Accounts dialog bo&. $imilarly, you can delete a user account or a group account from a wor group by ma ing selections in the 5sers tab or the 6roups tab of the 5sers And 6roup Accounts dialog bo&. 0ou cannot delete the group accounts Admins or 5sers. Task A-!: Creating ser Accounts in Microsoft Access ,bjective. To create the administrator2s user account as well as four other user accounts, and to assign each user to a group. This information relates to the sample Microsoft Access database download -efore you begin. The 5ser and 6roup Accounts dialog bo& is open, and the ,rder 4ntry and $ales /anagers group accounts are created ! please complete the previous tutorial 'etting up Microsoft Access Aroup Accounts before starting. ! Select t(e Users tab! -. Display t(e 1a%e drop-down list! There$s only one user listed, Admin. =ou$re going to create fi"e more users to add to this list. 5. /n t(e 7roups section) look at t(e Available 7roups list! ;our groups are listed, including the two that you created. =ou can assign users to these groups.

6. 7.

/n t(e User section) click 1ew to open the )ew +ser(Aroup dialog box. $reate a user account for yourself) as follows: )ame* 2=our )ame3 Personal I!* mypid $lick ,3!

:! >.

+ro% t(e User 1a%e drop-down list) select your na%e! +ro% t(e Available 7roup list) verify t(at Ad%ins is selected! $lick Add to create a security administrator account with you as administrator. =ou are a member of the Admins group. As such you inherit Administer rights to import files, create new users, and assign permissions.

6 / 17

@.

0reate the following new user accounts and assign each user to the indicated group accounts* +ser )ame Oli"ia ? Oscar ! 'cott ' 'usan M Personal I! oli"iapid oscarpid scottpid susanpid Aroup Membership Order ?ntryD +sers Order ?ntryD +sers 'ales ManagersD +sers 'ales ManagersD +sers

9.

Display and scroll t(roug( t(e 1a%e drop-down list! )ow there are six user accounts, including Admin, yourself, and the additional four that you ha"e created. :.. /n t(e User And 7roup Accounts dialog bo') click ,3 to accept your account additions.

----------------------------------------------------------------------------------------------------------Changing a Pass"ord: )ow that you2ve created new Microsoft Access +ser Accounts , it2s time to loo at $ecurity Account *asswords. *asswords that are entered when you log on to Access are nown as $ecurity Account *asswords. The primary purpose of these passwords is to ensure that no other user can log on using your name. If this is the first time you are adding a password to your Access account, you do not have to use the ,ld *assword te&t bo&. The Admin user has full permissions to all database objects. The Admin user+s password is empty, so anyone can log on to Access as the Admin user. To ma e your system more secure, you can remove the Admin user from the Admins group. In this tutorial, you2ll do just that. Task A-#: Setting $our logon pass"ord and re%oving the Ad%in user fro% the Ad%ins group ,bjective. To add a password for yourself and to delete the Admin user. This information relates to the sample Microsoft Access database download ! &'it Access! -. Start Access! !on$t open a database. 5. $(oose #ools) Security) User And 7roup Accounts! The ,ogon dialog box opens. 6. 4og on by using your na%e 2as you typed it in when you created your own user account3 and no password! There$s no password assigned to your name yet. After you click O1, the +ser And Aroup Accounts dialog box opens. ;! Select t(e $(ange 4ogon Password tab! 8. /n t(e 1ew Password and 5erify te't bo'es) type password! &emember, the password is case#sensiti"e.

>. @.

$lick Apply to accept the change and lea"e the dialog box open. ,n t(e Users page) select t(e User 1a%e Ad%in!

7 / 17

9.

+ro% t(e Me%ber ,f list) select Ad%ins!

:..

$lick Re%ove to remo"e the Admin user from the Admins group. The Admin user remains a member of the +sers group only.

::.

$lick ,3 to accept the change and close the +ser And Aroup Accounts dialog box.

-----------------------------------------------------------------------------------------------------------

The Securit$ &i'ard: The Admin user owns all the objects in the database and has irrevocable permissions to them. 7owever, it is important to change the ownership to the project leader+s account (you). (hen you create or copy an object, the user who is logged in becomes the owner. The easiest way to change ownership of all objects in the database is to first ma e sure your project leader is logged in, and then run the $ecurity (i8ard. 0ou can use the $ecurity (i8ard to create a new database and fill it with copies of the objects of the database that is currently open. The $ecurity (i8ard e&ports copies of all the objects from the original database. It also secures selected object types by revo ing all permissions in the 5sers group for those objects in the database. The new database is encrypted, which means that it is indecipherable during electronic transmission or when it is stored on a dis , tape, or other magnetic medium. All table relationships and lin ed tables are recreated in the new database. 7owever, the original database is not changed. Changing the ("nership of )ata*ase (*+ects An object2s owner is the user who creates that object, also nown as the object2s creator. The owner of an object has Administer permissions. ,ther users cannot change the object owner2s permissions. If another user creates a new object in the database, then that user is the owner of the object. 7aving different owners for all the objects within a database can be cumbersome. The database will be easier to maintain if one user is designated as the owner and ta es responsibility for maintaining the objects. 0ou can change the owner of an object by using the %hange ,wner tab of the 5ser and 6roup *ermissions dialog bo&. )ow let2s use the $ecurity (i8ard to create an unsecured bac up copy of the sample Microsoft Access database download file. /y)ewApp.mdb and to secure /y)ewApp.mdb. 0ou should have already completed the previous tutorials within this security section9 details of each can be found at the bottom of this page. Task A-,: sing the Microsoft Access Securit$ &i'ard ,bjective. To create a new database that only certain users can access. This information relates to the sample Microsoft Access database download ! &'it Access! Start Access 8! ,pen My1ewApp!%db! /n t(e 4ogon dialog bo') enter your password and click ,3! <! $(oose #ools) Security) User And 7roup Per%issions! 6. Select t(e $(ange ,wner tab! The form ob4ects are displayed. )otice that Admin is the owner of e"ery form. !isplay different ob4ect types from the Ob4ect Type drop#down list. Admin is the owner of e"ery ob4ect type.

8 / 17

7. :! >.

$lick $ancel to dismiss the dialog box. $(oose #ools) Security) User-4evel Security Wi=ard to run t(e Security Wi=ard! Accept t(e default selection) Modify My $urrent Workgroup /nfor%ation +ile! $lick 1e't! =ou want to secure all database ob4ects, which is the default wiEard setting. Select t(e All ,b>ects tab and scroll t(roug( t(e list to verify t(at all tables) ?ueries) for%s) reports and %acros are c(ecked!

2! 9.

$lick 1e't! /n t(e ne't wi=ard dialog bo') c(eck t(ese security group accounts: ,rder &ntry and Sales Managers! ?ach one defines specific permissions for the users you$ll assign to the group. To read the group permissions assigned to each built#in group, select each group 2but don$t check any of the built#in groups3

"! ::.

$lick 1e't! /n t(e ne't wi=ard dialog bo') accept t(e default selection @1o) #(e Users 7roup S(ould 1ot Aave Any Per%issions@! Any permissions you assign to the +sers group are the same permissions a"ailable to anyone with a copy of Access. =ou want to completely lock out others.

8!

$lick 1e't!

9 / 17

:5.

In the next wiEard dialog box, the users you$"e already added to the workgroup information file are listed. =ou also ha"e the option of adding new users. e$re not adding any users now, so click 1e't!

:6.

In the next wiEard dialog box, you assign users to groups in the workgroup information file. Select t(e option Select A 7roup And Assign Users #o #(e 7roup!

:7.

=our name is already assigned to the Admins group, and the other users are already assigned to either the Order ?ntry or 'ales Managers group. Use t(e following grap(ics to select t(e group na%es and verify t(e users assigned to t(e%!

:8.

$lick 1e't to ad"ance to the last wiEard dialog box. 5erify t(e na%e of t(e backup copy of t(e unsecured database!

Also note that, after the database is secured, you$ll get a report of the settings that were used to create the users and groups in the workgroup information file. :>. $lick +inis( and wait while the wiEard secures the database ob4ects and creates the report. :@. Scroll t(roug( t(e ,ne-Step Security Wi=ard Report! )otice that there$s an unsecured database 2.bak file3 and a secured database 2.mdb file3, both stored in the folder.

10 / 17

The report lists the secured ob4ects, groups and users. It$s important to keep this information a"ailable in the report in case you e"er need to re#create the same workgroup file. 9! $lose t(e report! -.. $lick -es to sa"e the report as a 'napshot 2.snp3 file. ait for the encryption process to finish.

8 !

,n t(e taskbar) you will see t(e Snaps(ot 5iewer) and clicking t(is will view t(e new file: My1ewApp!snp! --. The snapshot report is sa"ed in the same location as the database file. 8<! $lose t(e Snaps(ot 5iewer!

----------------------------------------------------------------------------------------------------Per%issions After you run the $ecurity (i8ard, you can manually change database and object permissions for user and group accounts in a wor group. It2s advisable to assign permissions to groups, not to users, because each user inherits the permissions assigned to the group. Per%ission T$pes 4ach user has access to nine types of permission for data or objects in a database. The following table describes the nine types of permission, and what each type enables a user to do. To read more about these permissions, search /icrosoft Access 7elp for permissions, display the topic (or (ith *ermissions, and select Types ,f *ermissions. Permissio n Allows a user to Open(&un Open a database, form, or report. &un a macro. Open ?xclusi"e &ead !esign Modify !esign Ob4ects in"ol"ed !atabases, forms, reports, and macros.

Open a database on a network, while ensuring that Tables, %ueries, forms, others cannot open the database while the first user has reports, macros, and it open. modules. Tables, %ueries, forms, Fiew the design of ob4ects. )o changes to the design are reports, macros, and allowed. modules. Tables, %ueries, forms, reports, macros, and modules. !atabases, tables, %ueries, forms, reports, macros, and modules. Tables and %ueries. Tables and %ueries. Tables and %ueries. Tables and %ueries.

0hange the design of ob4ects and delete ob4ects.

'et database passwords, replicate databases, and Administe change startup properties. Ga"e full access to ob4ects r and data, and assign permissions for ob4ects. &ead !ata Fiew data, but not table designs or %uery designs. +pdate !ata Insert !ata !elete !ata Fiew and edit data, but not insert or delete data. Fiew and insert data, but not change or delete data. Fiew and delete data, but not change or insert data.

11 / 17

-efore starting the following e&ercise you should have already completed the previous tutorials within this security section9 details of each can be found at the bottom of this page. Task A--: Granting per%issions to a data*ase and its o*+ects :. $(oose #ools) Security) User And 7roup Per%issions to display the +ser And Aroup Permissions dialog box. -. Select t(e $(ange ,wner tab! Select different ob>ect types and notice t(at you are t(e current owner of t(e database and all its ob>ects

5. 6.

Select t(e Per%issions tab! ,et$s take a look at the permissions assigned to the users and groups, starting with the groups. +ro% t(e 4ist options) select 7roups! The Admins group is selected in the +ser(Aroup )ame list.

7. 8. >.

&'plore t(e per%issions assigned to various ob>ect types and group na%es! )otice that the Order ?ntry, 'ales Managers and +sers groups ha"e no permissions assigned to them. ;or the +sers group, you want to lea"e it set that way. +ro% t(e UserB7roup 1a%e list) select ,rder &ntry! =ou want to assign permissions to this group. +ro% t(e ,b>ect #ype drop-down list) select Database! In the Permissions section, check Open(&un

12 / 17

@.

$lick Apply! All users in the Order ?ntry group ha"e permission to open and run the current database. 9. )ow let$s set the Order ?ntry group$s permissions for the table ob4ects in the current database. ;rom the Ob4ect Type drop#down list, select Table. +ro% t(e ,b>ect 1a%e list) select all t(e table na%es! :.. /n t(e Per%issions section) c(eck Update Data and /nsert Data! Unc(eck Delete Data! )otice that the options &ead !esign and &ead !ata are also checked by default with these options. Three options should be unchecked* Modify !esign, Administer, and !elete !ata.

! :-.

$lick Apply! Apply database and ob>ect per%issions to groups according to t(e specifications in t(e following table 2select all ob4ect names for each ob4ect type3* Ob4ect Type Huery ;orm &eport ,rder &ntry Macro

Aroup

Permissions &ead !esign, &ead !ata, +pdate !ata, Insert !ata, !elete !ata # all Hueries Open(&un, &ead !esign # all ;orms Open(&un, &ead !esign # all &eports Open(&un # all Macros

13 / 17

!atabase Table Huery ;orm Sales Managers :5. &eport Macro

Open(&un &ead !ata, &ead !esign # all Tables &ead !ata, &ead !esign # all Hueries Open(&un # all ;orms Open(&un # all &eports Open(&un # all Macros

$lick ,3 to close the dialog box.

-------------------------------------------------------------------------------------------------------------Testing $our Microsoft Access )ata*ase Securit$: After you2ve set up security for all groups and users, you will need to test it. /a e sure that each group has the options that you have selected in the 5ser And 6roup *ermissions dialog bo&. Task A-.: Testing Microsoft Access )ata*ase Securit$/ ,bjective. To test the various groups for the security that you set up in the previous tutorial ! Microsoft Access !atabase 'ecurity # 'ecurity Permissions :. &'it Access! =ou$ll need to log on as a different user to test security. -. Start Access! ,pen My1ewApp!%db! 4og on wit( t(e na%e Susan M) and no password! 'usan M is a member of the 'ales Managers group, so you$ll be testing the permissions you assigned to that group. 5. +ro% t(e Database Window CPress + to display database windowD) preview t(e report) 6ook and $usto%er Sales! /ecause the 'ales Managers group has permission to Open(&un all reports, 'usan M can pre"iew this report. 6. $(oose 5iew) Design 5iew! As 'usan M, you don$t ha"e permission to "iew the design of the report.

7. :! >.

$lick ,3 to dismiss the message box. $lose t(e report! )ow let$s try to add a new customer to the database. +ro% t(e database window) open t(e $usto%er for%! ,ook at the )ew &ecord na"igation button at the bottom of the form. It$s dimmed. There$s your first clue that you can$t add a new record.

@.

/ut you still ha"e the Add 0ustomer button on the form, rightI $lick t(e Add $usto%er button!

Another roadblock. =ou can$t add a new record. The permission assignments work the way that you want them to. 9. $lick ,3 to dismiss the message box. "! $lose t(e $usto%er for%! ::. +ro% t(e Switc(board) click Add $usto%er! =ou see a blank form.

14 / 17

:-. <! :6.

$lose t(e $usto%er for% 20hose ;ile, 0lose3 &'it Access! Start Microsoft Access and open My1ewApp!%db! 4og on as Ad%in wit( t(e password) @password@!

:7. :8. :>.

The Admin user can$t e"en get past Ao. $lick ,3 to dismiss the message box. &'it Access yet again. Start Access) open My1ewApp!%db) and log on wit( your na%e and password 2your password is password3.

---------------------------------------------------------------------------------------------------------------Microsoft Access )ata*ase Securit$ - )ocu%enting $our )ata*ase Securit$: After you have established security for your application, you can print a security report for a particular wor group. In this report, you can see the security for both users and groups, just users, or just groups. The report includes group names and user names, and indicates which users and groups belong together in the particular wor group. If you want to send the security report directly to the printer, you can use the *rint $ecurity dialog bo& to ma e selections about what level of security you want to document. 3et2s start by ta ing a loo at your options to print a report about users and groups in the sample database # My)ewApp.mdb. 0ou will have created these user and group accounts and permissions in the previous tutorials listed at the bottom of this page. Task A-0: Printing reports a*out securit$ users and groups/ :. $(oose #ools) Security) User And 7roup Accounts to open the +ser And Aroup Accounts dialog box. -. $lick Print Users And 7roups to open the Print 'ecurity dialog box.

5.

#ake a look at t(e print security options!

6. 7.

=ou can print reports that show one of the following security le"els* All users defined for the current workgroup. All groups defined for the current workgroup. /oth user and group account information. All users in the current workgroup can print reports showing user and group information. $lick $ancel! /ecause printed security reports are sent directly to a printer, your computer must be attached to a printer if you click O1. $lose t(e User And 7roup Accounts dialog bo'! )ext, you$ll create a report on a form with permissions for each user and group.

6.
Previe"ing Per%issions If you want to view the permissions for a particular object, you can create a report that includes the object+s design information and permissions listed by user and group. 5se the 1atabase 1ocumenter to view the definition for one object or multiple objects.

15 / 17

3et2s use the 1ocumenter to preview a report for user and group permissions as they2re set for the %ustomer form. 0ou will have created these user and group accounts and permissions in the previous tutorials listed at the bottom of this page using the sample database # My)ewApp.mdb.. Task A-12: Previe"ing reports a*out user and group per%issions *$ o*+ect/ :. $(oose #ools) Analy=e) Docu%enter to open the !ocumenter dialog box. -. Display t(e for% ob>ects! $(eck fr%$usto%er to run the report on 4ust this one form.

5. 6.

$lick ,ptions to open the Print ;orm !efinition dialog box. /n t(e /nclude +or +or% section) unc(eck Properties and $ode! $(eck Per%issions 6y Users And 7roups! To make your report run faster, check only those options you need. Printing properties can fill up lots of pages.

7.

/n t(e /nclude +or Sections And $ontrols section) select 1ot(ing! Again, this is to keep the report shorter and include only the information you need.

8. >.

$lick ,3 to close the Print ;orm !efinition dialog box. $lick ,3 to run the !ocumenter. This might take se"eral minutes to run, so be patient. The more information that you re%uest from the !ocumenter, the longer it takes to run the report. 2! /n t(e ,b>ect Definition report for t(e $usto%er for%) look at t(e user and group per%issions! 9! $lose t(e report!

--------------------------------------------------------------------------------------------------------------Securing a )ata*ase "ith a )ata*ase Pass"ord: To prevent unauthorised users from opening an application, you can add a database password. 7owever, a database password does not control what a user does once the application is opened. To set a password, the database must open in e&clusive mode. /a e sure to eep a record of the database password. If you lose or forget the password, you cannot open the database or retrieve its data.

16 / 17

0ou can password!protect a database that contains tables that are lin ed to another database. 0ou must provide the password to the bac !end database in a connection string9 you can save the password as part of the lin to the tables. The password information is added to the end of the connection string by using the password identifier, *(1:password. To change the password, you need Administer permission to the database object $aution: -ecause many people will share the same database password, it is ris y to rely on the database password without implementing full user!security. ,ne person could change the password and loc everyone else out. (ith full user!security, you can control who has rights to change the database password. 5nfortunately, people do lose or forget their passwords, ma ing it impossible to access that data. 3uc ily, it does not mean that the data is lost forever. %hec out the Microsoft Access Password &eco"ery Tools available. 3et2s e&periment by setting a database password using the sample database # My)ewApp.mdb.. Task A-11: Setting a data*ase pass"ord/ ! $lose My1ewApp!%db -. 5. $lick t(e ,pen Database button - =ou need to use the Open dialog box. Select My1ewApp!%db! $lick on t(e arrow ne't to t(e ,pen button!

6.

7. 8.

$(oose ,pen &'clusive to open the My)ewApp.mdb database with exclusi"e access. This gi"es you the sole access to the database when you ha"e it open. =ou can$t set a database password if it$s in shared access mode. /y choosing the Open ?xclusi"e option, you pre"ent other users from opening the database whilst you ha"e it open. $(oose #ools) Security) Set Database Password to open the 'et !atabase dialog box. /n t(e Password and 5erify te't bo'es) type dbpassword! Passwords are case# sensiti"e.

>. 2! 9.

$lick ,3 to accept the database password and close the dialog box. $lose t(e database! ,et$s test the password to see if it works. ,pen My1ewApp!%db! =ou must enter the database password to open the database.

:.. #ype dbpassword) and click ,3! The database opens. 3e%oving the )ata*ase Pass"ord 0ou can remove the password you have set for a database. ,nce a password is set, the choice in the Tools, $ecurity menu choice becomes 5nset 1atabase *assword. 0ou will be prompted for the password9 it is case!sensitive. After you remove the database password, anyone has access to the database. 3et2s remove the database password you set for /y)ewApp.mdb

17 / 17

Task A-12: 3e%oving a data*ase pass"ord/ ! $lose My1ewApp!%db! ,pen My1ewApp!%db in &'clusive Mode! 8! &nter dbpassword! $lick ,3 5. $(oose #ools) Security) Unset Database Password! )otice how this command has a different name now that the database has a password set on it. 6. /n t(e Password te't bo') type dbpassword!

7. 8. >.

$lick ,3 to accept the password and close the dialog box. ,et$s test this change. $lose t(e database! ,pen My1ewApp!%db! =ou didn$t need to enter a database password to open the database.

------------------------------------------------------------------------------------------------------)istri*uting the Secured )ata*ase Application -ecause permissions are stored with application databases, and accounts and passwords are stored with wor groups, users must have access to both the appropriate databases and wor groups. To ma e an application database (or databases) and wor groups available to users, you can do any of the following procedures.

0opy the workgroup information file that defines the workgroup to a network ser"er. +sers can 4oin this workgroup by specifying the network ser"er path to the workgroup information file. Pro"ide each user with a copy of the workgroup information file that defines the workgroup, so that the users can place it on their local workstation P0. +sers can then 4oin the workgroup. One drawback to this method is that if you update the workgroup you must gi"e users separate copies of the updated files. If users are using different workgroup information files, you can create the same group account in each workgroup instead of copying the whole workgroup into the file. The common group account must ha"e the same name and personal identifier 2PI!3 in each workgroup. =ou need to add the users in each workgroup to the common group. In all cases, the application files 2M!/Cs3 can be located on a shared network dri"e or copied to the indi"idual workstations. If a userCs permissions are changed, you need to redistribute a copy of the application database to each P0 where that user needs to work.

0ou might not want to give users a copy of the wor group information file that defines the wor group you used when you created the application, because then users might get full permissions to databases and objects (if they can guess a password and log on to Access as members of the Admins group). 4ach user must have a copy of Access in order to run your application. If you want users to run an application without having a copy of Access on their computers, you must use the *ac age And 1eployment (i8ard included in the /$ ,ffice ;''' 1eveloper2s 4dition. This wi8ard includes the files necessary to use the run!time version of /icrosoft Access. It has its own setup program that you can use to create a custom run!time setup for each user+s computer.

18 / 17