Microsoft Access Security And Passwords

MS Access features three independent types of passwords:

* Database Passwords
* Security Accounts Passwords
* Visual Basic Modules passwords

Surveillance Software

Our latest Access tool is called the Workbench.  Find out who is in your Access databases at any time. Manage multiple version of Access. Stop new users logging in whilst you start asking current users to logout. Handle multiple workgroup files easily (and more securely). Compact your database as soon as everyone logs out. Click here to read and download. 

Database passwords

Database passwords were introduced back in the times of MS Access 95 as a new, easy to use security feature. Setting up a single password that controls who can open a database is both faster and easier compared to setting up a complicated user-level security. If there's a database password set, all users must enter that password to open the database.

The database password is encrypted and stored in the header of a database file. In Access versions 95 and 97 encryption was insecure and a single byte change in the header was enough to remove the password.

If a database header gets corrupted (usually happens when a databases is opened and saved using a text editor, MS Word is a popular choice) Access might erroneously report the database password protected instead of damaged.

Security Accounts Passwords

The most powerful yet complex way to secure a database is to set up user-level security. If user-level security is defined, the members of a workgroup are recorded in user and group accounts that are stored in a Microsoft Access workgroup information file (also known as System Database).

Each user and group account has its own unique Access Security ID (SID) that is created from user or group name, Personal ID and Workgroup ID. There are also some predefined SIDs that remain the same for all the Workgroups: 'Admin' and 'guest' accounts, and 'Guests', 'Users' groups.

Each workgroup information file contains MSysAccounts table that stores all user and group account names, encrypted user passwords and SIDs.

Access uses SIDs to check user's permissions. Each database has MSysACEs table (both Hidden and  System, not visible by default) with permissions information for all the objects in the database. In the table there's a list of SID/applicable permissions pairs for each database object. Before a user attempts any action on a database object MS Access (or Jet Engine to be exact) scans MSysACEs table using current user SID (and all the SIDs of user's groups) to verify permissions for the action. Read more

In Garry's book, you will find out how to orgainse the contents of the workgroup file so that Password Cracker software cannot read it.

Visual Basic Modules passwords

Starting with MS Access 2000 Visual Basic for Applications (VBA) modules can be also protected with a password. VBA passwords are encrypted and stored in the database file. Encryption is reversible and it is recommended to convert the database into an 'MDE' format, making you proprietary code harder to decompile.

Security gone awry

MS Access help file states: '.if you lose or forget your password, it can't be recovered, and you won't be able to open your database.' If you still need to open your database, try

 http://www.LostPassword.com. 

The site has password recovery tools for the most popular office software, ranging from MS Access to FileMaker and from MS Word to WordPerfect.

Access Key is a Password Recovery Kit module that recovers both database and user-level security accounts passwords. There's also an Access Security Recovery service (available for legal  owners/copyright holders only) that comes handy if a Workgroup Information File is lost or corrupted. You can find more info at http://ref.lostpassword.com/access.htm?900407

Dmitry Sumin,
Security Expert, Passware,
 

Editorial:  These tools are out there so it is better that you know about them and act accordingly rather than think that all is safe.  And you too might forget a password one day.

 A really good alternative to Access security is a simple little form that logs NT usernames and times when people log and off your Access Application. This software is available in The Workbench and is being used in most of our projects because our clients like the simplicity.  Click For More

... Garry Robinson 

Another Book That Cover Security Programming

Links >>>  Home | Search | Workbench | Orders | Newsletter | Access Security | Access professionals