Microsoft Access Security And Passwords

Links >>>  Home | Search | Orders | Books | Free Newsletter | Table Of Contents

MS Access features three independent types of passwords:

* Database Passwords
* Security Accounts Passwords
* Visual Basic Modules passwords

Surveillance Software

Our latest Access tool is called the Workbench.  Find out who is in your Access databases at any time. Manage multiple version of Access. Stop new users logging in whilst you start asking current users to logout. Handle multiple workgroup files easily (and more securely). Compact your database as soon as everyone logs out. Click here to read and download. 

Database passwords

Database passwords were introduced back in the times of MS Access 95 as a new, easy to use security feature. Setting up a single password that controls who can open a database is both faster and easier compared to setting up a complicated user-level security. If there's a database password set, all users must enter that password to open the database.

The database password is encrypted and stored in the header of a database file. In Access versions 95 and 97 encryption was insecure and a single byte change in the header was enough to remove the password.

If a database header gets corrupted (usually happens when a databases is opened and saved using a text editor, MS Word is a popular choice) Access might erroneously report the database password protected instead of damaged.

Security Accounts Passwords

The most powerful yet complex way to secure a database is to set up user-level security. If user-level security is defined, the members of a workgroup are recorded in user and group accounts that are stored in a Microsoft Access workgroup information file (also known as System Database).

Each user and group account has its own unique Access Security ID (SID) that is created from user or group name, Personal ID and Workgroup ID. There are also some predefined SIDs that remain the same for all the Workgroups: 'Admin' and 'guest' accounts, and 'Guests', 'Users' groups.

Each workgroup information file contains MSysAccounts table that stores all user and group account names, encrypted user passwords and SIDs.

Access uses SIDs to check user's permissions. Each database has MSysACEs table (both Hidden and  System, not visible by default) with permissions information for all the objects in the database. In the table there's a list of SID/applicable permissions pairs for each database object. Before a user attempts any action on a database object MS Access (or Jet Engine to be exact) scans MSysACEs table using current user SID (and all the SIDs of user's groups) to verify permissions for the action. Read more

In Garry's book, you will find out how to orgainse the contents of the workgroup file so that Password Cracker software cannot read it.

Visual Basic Modules passwords

Starting with MS Access 2000 Visual Basic for Applications (VBA) modules can be also protected with a password. VBA passwords are encrypted and stored in the database file. Encryption is reversible and it is recommended to convert the database into an 'MDE' format, making you proprietary code harder to decompile.

Security gone awry

MS Access help file states: '.if you lose or forget your password, it can't be recovered, and you won't be able to open your database.' If you still need to open your database, try

 http://www.LostPassword.com. 

The site has password recovery tools for the most popular office software, ranging from MS Access to FileMaker and from MS Word to WordPerfect.

Access Key is a Password Recovery Kit module that recovers both database and user-level security accounts passwords. There's also an Access Security Recovery service (available for legal  owners/copyright holders only) that comes handy if a Workgroup Information File is lost or corrupted. You can find more info at http://ref.lostpassword.com/access.htm?900407

Dmitry Sumin,
Security Expert, Passware,
 

Editorial:  These tools are out there so it is better that you know about them and act accordingly rather than think that all is safe.  And you too might forget a password one day.

 A really good alternative to Access security is a simple little form that logs NT usernames and times when people log and off your Access Application. This software is available in The Workbench and is being used in most of our projects because our clients like the simplicity.  Click For More

... Garry Robinson 

Read what Peter Vogel, Editor of Smart Access had to say about the book...

Is Your Database Secure ? Need to know more about how to protect your database investment. Confused about Access security. Then have a look at the book that Garry wrote for Apress in 2003. It covers best practise security and protection for Access 97 upwards Click here to read more

Another Book That Cover Security Programming

Access Developers Handbook 2000 ...  The chapter on securing your application in the Enterprise edition is over 100 pages in length and covers security for Jet in great detail.  There are also very detailed examples on Jet programming using DAO, ADOX and even the new SQL extensions introduced into ADO in Access 2000.  There is less detail on security for data pages and ADP projects.  Highly recommended if the white security paper (written by the same authors does not go far enough).    Read More

Related Pages On This Site

Alternative Access Protection/Security Ideas
Microsoft Access Passwords, Workgroups and ADO
Links for resources on Microsoft Access Security
The Workbench includes a sample database that manages NT /Win 2000 User Accounts
Samples of Developer Workgroup Security Manipulation
Samples of Data Security and Database Passwords
Samples of How To Change Startup Properties and Use Hotkeys
The Workbench now makes startup property management easier