Microsoft Access VBA Tutorials for self-paced learning, Class Modules, SQL Techniques, and AI Integration Guides.

Showing posts with label MS-Access Security. Show all posts
Showing posts with label MS-Access Security. Show all posts

Users and Groups Listing from Workgroup Information File

Users and Groups Listing from the Workgroup Information File.

How about taking a printout of Users and Groups from the active Workgroup Information File (the Microsoft Access Security File)?

This applies only to users of Microsoft Access 2003 or earlier databases that were implemented with Access Security. Such databases can still be opened and used in Access 2007 or Access 2010 without conversion.

To link to the Workgroup Information File (a database with the .mdw file extension) from Access 2007, you can run the Workgroup Administrator program. For step-by-step instructions, please refer to the article: Running Workgroup Admin Program from Access 2007.

On a personal Note, I am not particularly fond of the frequent Version changes in Access. While new features are always exciting to explore, they often come at the cost of what we have already learned and implemented. For example, I still wonder why the familiar Menus and Toolbars were reorganized and rebranded as the Ribbon in Access 2007. Such changes often add confusion and waste time, forcing users to relearn tasks they could once do quickly. By the time users finally become comfortable with the new interface, a newer version appears—and the cycle starts all over again.

Upgrades are always welcome—provided they rectify the drawbacks and bugs of earlier versions and implement genuine enhancements that users can easily learn and benefit from.

Coming back to the topic of printing Users and Groups from the active Workgroup Information File, Microsoft Access already provides a built-in option. The only limitation is that the listing is sent directly to the printer, which may not be ideal.

To use this option in Access 2003 or earlier:

Select Tools → Security → Users and Group Accounts → Users → Print Users and Groups.

In Access 2007 (with an Access 2003 or earlier database open):

Go to Database Tools → Administer → Users and Permissions → User and Group Accounts → Users → Print Users and Groups.

But why waste stationery when there’s a more flexible option? You can generate a list of Users and Groups and save it to a text file on your disk instead. Below is a simple VBA procedure you can use for this purpose. Copy and paste the following code into a Standard Module, then save and run it:

Database UsersList() Function.

Public Function UsersList() 
'------------------------------------------------------------- 
'Author : a.p.r. pillai 
'Date   : Oct 2011 
'Rights : All Rights Reserved by www.msaccesstips.com 
'Remarks: Creates a list of Users & UserGroups from the 
'       : active Workgroup Information File and saves 
'       : the list into a text file: UserGroup.txt 
'       : in the current database path 
'------------------------------------------------------------- 
Dim wsp As Workspace, grp As Group, usr As User 
Dim fs As Object, cp_path As String 
Dim a, txt 
Const ten As Integer = 10 

cp_path = CurrentProject.Path 
Set wsp = DBEngine.Workspaces(0) 
'Create a Text file: UserGroup.txt with FileSystemObject 
Set fs = CreateObject("Scripting.FileSystemObject") 
Set a = fs.CreateTextFile(cp_path & "\UserGroup.txt", True) 

'Write headings 
a.writeline "SYSTEM-DEFAULT GROUPS" 
a.writeline "-----------------------" 
a.writeline ("User-Groups  User-Names") 
a.writeline ("-----------  ----------") 

'List Default Admins & Users Group First 
For Each grp In wsp.Groups 
   txt = grp.Name 
   If txt = "Admins" Or txt = "Users" Then 
     a.writeline txt & Space(ten - Len(grp.Name)) & Space(3) & "..." 
     For Each usr In grp.Users 
        txt = Space(Len(grp.Name) + (ten - Len(grp.Name))) & Space(3) & usr.Name 
        a.writeline txt 
     Next: a.writeline crlf 
   End If 
Next 

'Groups, except Default Admins & Users 
a.writeline "ADMINISTRATOR-DEFINED GROUPS" 
a.writeline "----------------------------" 
a.writeline ("User-Groups  User-Names") 
a.writeline ("-----------  ----------") 

For Each grp In wsp.Groups 
   txt = grp.Name 
   If txt = "Admins" Or txt = "Users" Then 
      GoTo nextitem 
   Else 
      a.writeline txt & Space(ten - Len(grp.Name)) & Space(3) & "..." 
      For Each usr In grp.Users 
         txt = Space(Len(grp.Name) + (ten - Len(grp.Name))) & Space(3) & usr.Name 
         a.writeline txt 
      Next: a.writeline crlf 
   End If 
nextitem: 
Next 
a.Close 
'Open UserGroup.txt file with the list User list. 
Call Shell("Notepad.exe " & CurrentProject.Path & "\UserGroup.txt", vbNormalFocus) 

End Function

Running UsersList() Function

You can run this program either directly from the Immediate Window (Debug Window) or by calling it from the Click event of a CommandButton on a Form.

When executed, the program will create a text file named UserGroup.txt in the current Database Folder. Once the file is generated, it will automatically open in Windows Notepad for review.

Keep in mind that each time you run this program, the existing file will be overwritten. If you would like to preserve previous listings, remember to rename or move the file to a safe location before running the procedure again.

The result of a sample run of the program is given below:

If you need a printout of Users and Groups, then you may print it from the text file.

Share:

Access Security Key Diagram

MS Access Security Key Diagram - Access 2003.

Implementing Microsoft Access Security is a significant undertaking. Although user-level security was discontinued with Access 2007, thousands of developers continue to rely on this built-in feature to secure their applications. Microsoft’s documentation spans several pages, detailing the intricacies of this system, and it can be difficult to depict correctly to visualize how all the components work together to form the complete security framework.

To clarify this, I have created a diagram that consolidates the key elements of Microsoft Access Security. This visual overview provides a general understanding of the components involved and how they fit into the overall security structure.

Maintaining proper security is critical—not only to regulate user roles but also to safeguard data, protect the integrity of database objects, and ensure the security of VBA code.

For a deeper dive, you can explore the collection of articles on Microsoft Access Security available under the Security sub-menu on the main menu bar of this site.

Microsoft Access Security - Two Sections.

  1. The first part of the Security elements (Workgroup File ID elements, User/Group Names, Personal IDs, and Passwords) resides in the Workgroup Information File.

  2. Object-level access rights information that resides within the Database forms the second part.

When these two parts work together, they comprise fourteen security elements that form the user's complete security key.


Workgroup FileID.

The first three elements—Workgroup Name, Organization, and Workgroup ID—serve as the unique identifiers of a Workgroup Information File. It is essential to keep these three unique workgroup information details after creating the file. If the file is ever lost, you will need these exact details to recreate it. Microsoft Access uses this combination of values to distinguish one Workgroup Information File from another.

User-Specific Credentials.

The next three elements—User or Group Name, Personal ID, and Password—are user-specific credentials. Group accounts, however, contain only a Group Name and Personal ID; they do not use passwords. It is crucial to maintain a secure record of all User and Group Names along with their corresponding Personal IDs.

Group accounts are primarily a way to organize users, allowing access privileges to be assigned at the group level. Any user added to a group automatically inherits that group’s access permissions.

When you create a new Workgroup Information File, it includes, by default:

  • One User Account: Admin

  • Two Group Accounts: Admins and Users

The Admin user account is automatically a member of both groups. While the two group accounts (Admins and Users) cannot be deleted, new user accounts you create will be added to the Users group by default. Similarly, the Admin user account itself cannot be deleted, but as a security precaution, it can be removed from the Admins group.

Members of the Admins group hold full administrative authority. They can assign permissions to objects and transfer ownership of objects (except the database object) to other user or group accounts.

Database Owner.

An important point to remember is that the owner of a database or object (i.e., the user who created it) has the same privileges as an administrator, a member of the Admins group. The owner of an object can assign permissions to other users or transfer ownership of that object to another user, just as an administrator would.

However, ownership of a database itself cannot be transferred. If someone wishes to assume ownership of a database, they must create a new database and then import all the objects from the original database. Provided they have sufficient permissions.

Share:

Running Workgroup Admin in Access2007

Running Workgroup Admin in Access2007.

If you are serious about implementing User-Level Security in Microsoft Access 2003 (mdb) databases and want to continue using them in Access 2007 security settings intact, avoid converting them to the Access 2007 format. Once upgraded, the security model changes completely, and User-Level Security is no longer supported in the accdb databases.

If you have already converted an MDB database into ACCDB format and lost all user-level security settings, the situation is not entirely hopeless. If you have a backup of the original .mdb file, you are in luck—simply restore the backup and continue using it in Access 2007, retaining your User-Level Security.

If no backup exists, you can still downgrade the database. Use the Save As… option from the Office Menu (top-left corner), select an earlier format such as Access 2002–2003 or Access 2000, and save the active database as a new .mdb copy. However, this will not automatically restore the lost security settings. You must reapply them manually, assigning permissions to each database object either at the group level or for individual users.

Run the Workgroup Administrator.

In either case, you must join the Workgroup Information File (a database with the file extension .mdw) from Access 2007 to attach your database Users/Groups and continue using them with your .mdb databases, or to implement new security profiles.

When you open an .mdb database in Access 2007, the Users and Permissions menu will appear under Database Tools. However, your Database Users and Groups will not be visible under this option unless you first join the Workgroup Information File you were using in an earlier version of Access.

In Access 2003, you can do this from Tools → Security, which provides an option to run the Workgroup Administrator program to create or join a Workgroup Information File. In Microsoft Access 2000, this program is located in the Language folder (…\1033 for U.S. English) of MS Office:

C:\Program Files\Microsoft Office\Office\1033\WrkgAdm.exe

Running this utility allows you to join the appropriate Workgroup Information File and manage security accordingly.

However, in Microsoft Access 2007, none of these menu options are available. The only way to access the Workgroup Administrator is by running the following command, either from VBA or directly in the Immediate Window:

DoCmd.RunCommand acCmdWorkgroupAdministrator

You can execute this command manually from the Immediate Window (open the VBA editor with Alt+F11, then press Ctrl+G to display the Immediate Window), or programmatically from a CommandButton Click event on a form. This will allow you to create a new Workgroup Information File or join an existing one on the server.

Once you have joined the Workgroup Information File, you can continue using .mdb files with their existing User-level security in Microsoft Access 2007, or manually restore any lost security settings.

Technorati Tags:

Earlier Post Link References:

Share:

User-level Access Security and Access2007

User-level Access Security and Access2007.

In versions of Microsoft Access before Access 2007, User-level and Object-level Security were reliable methods for protecting applications. I secured all my Access applications with User- and Group-level security, which proved highly effective when the applications were shared over a network. Because of this, I never lock the VBA modules with a password or convert the applications into a compiled form (MDE format) to prevent tampering. User-level security provided sufficient control to assign users the access level within the application.

If you wish to continue using this feature in Access 2007, you must avoid converting earlier databases (with the .mdb extension) to the newer .accdb format. Once converted, all User-level security settings are removed and cannot be reinstated. However, you can still maintain and use User-level security in Access 2007 as long as your databases remain in Access 2003 or earlier formats (with the .mdb extension).

Database Objects and Permissions.

With User-level Security, you can control what Users can do and cannot do.  Check the following table to get some idea as to how to set permissions on each object type and what they do:

Permission Applies to these objects Result
Open/Run Entire database, forms, reports, macros Users can open or run the object, including procedures in code modules.
Open Exclusive Entire database Users can open a Database and lock out other users.
Read Design Tables, queries, forms, macros, code modules Users can open the listed objects in the Design view. Note: Whenever you grant access to the data in a table or query by assigning another permission, such as Read Data or Update Data, you also grant Read Design permissions because the design must be visible to correctly present and view the data.
Modify Design Tables, queries, forms, macros, code modules Users can change the design of the listed objects.
Administer The entire database, tables, queries, forms, macros, and code modules Users can assign permissions to the listed objects, even if the User or Group does not own the object.
Read Data Tables, queries Users can read data in a table or query. To grant User Permissions to read queries, you must also give those User Permissions to read the parent tables or queries. This setting implies Read Design permission, which means that Users can read your table or query design in addition to the data.
Update Data Tables, queries Users can update data in a table or query. Users must have permission to update the parent table or queries. This setting implies both Read Design and Read Data permissions.
Insert Data Tables, queries Users can insert data into a table or query. For queries, users must have permission to insert data into the parent Tables or Queries. This setting implies both Read Data and Read Design permissions.
Delete Data Tables, queries Users can delete data from a table or query. For queries, users must have permission to delete data from the parent Tables or Queries. This setting implies both Read Data and Read Design permissions.
Technorati Tags:

Earlier Post Link References:

Share:

User and Group Check

User and Group Check.

In a secured database, basic access rights to objects—such as Tables, Forms, Queries, and Reports—are defined for specific Workgroups or Users as a one-time exercise. These permissions take effect automatically when a User belongs to a particular Workgroup for the database objects.

For example, if the Employees Table is configured to allow only Read Data permission for the Group-A Workgroup, any User in Group A cannot update, insert, or delete records when opening the Employees Form (with the Employees Table as its Record Source) or when accessing the Table directly.

If you want to make this scenario more flexible—for instance, to allow Users to update data— then this is permitted in the User and Group Permissions control under the Security option in the Tools menu.

In this case, all Group-A Workgroup Users can edit and update all data fields of the Employees Table. Normally, Users are not allowed to open Tables directly; instead, they interact with the data through Data Entry, Edit, or Display Forms, which gives the Developer greater control over how the data is accessed and modified.

When the Update Data permission is assigned, Users can modify all fields in the Table. However, if we want to prevent Users from changing certain specific fields, this cannot be enforced using the standard security methods described above.

Field-Level Security Implementation.

This level of security can be implemented only through Visual Basic Programs.  This method can be implemented in the following way:

  1. When the Employee Form is opened by the User for normal work, we can get the User Name through the CurrentUser() Function.

  2. The next step is to check whether this User belongs to the Group-A Workgroup.

  3. If so, lock the Birth Date and Hire Date fields on the Form to prevent the current user from making changes.

We need two programs to try out this method:

  1. A Function to check and confirm whether the User Name passed to it belongs to a particular Workgroup; if so, send a positive signal back to the calling program.

  2. If the user is identified as a member of the Group-A Workgroup, the Birth Date and Hire Date data fields are locked on the Form in the Form_Load() Event Procedure; the current user cannot edit these fields.

  3. If the user belongs to a different Workgroup, then the above fields are unlocked for editing/updating. 

The Demo Run.

To try this out:

  1. Import the Employees Table and Northwind.mdb

  2. Open an existing Standard VBA Module or create a new one.

  3. Copy and paste the following Visual Basic Code into the Module and save it:

    Public Function UserGroupCheck(ByVal strGroupName As String, ByVal strUserName As String) As Boolean
    Dim WrkSpc As Workspace, Usr As User
    
    On Error GoTo UserGroupCheck_Err
    
    Set WrkSpc = DBEngine.Workspaces(0)
    
    For Each Usr In WrkSpc.Groups(strGroupName).Users
    If Usr.Name = strUserName Then
        UserGroupCheck = True
        Exit For
    Else
        UserGroupCheck = False
    End If
    
    Next
    
    UserGroupCheck_Exit:
    Exit Function
    
    UserGroupCheck_Err:
    MsgBox Err.Description, , "UserGroupCheck_Err"
    Resume UserGroupCheck_Exit
    
    End Function
  4. Open the Employees Form in Design View.

  5. Display the Form's VBA Module (View --> Code).

  6. Copy and paste the following code into the VBA Module and save the Form:

    Private Sub Form_Load()
    Dim strUser As String, strGroup As String, boolFlag As Boolean
    
    strUser = CurrentUser
    strGroup = "GroupA" 'replace the GroupA value with your own test Group Name
    boolFlag = UserGroupCheck(strGroup, strUser)
    
    If boolFlag Then
       Me.BirthDate.Locked = True
       Me.HireDate.Locked = True
    Else
       Me.BirthDate.Locked = False
       Me.HireDate.Locked = False
    End If
    
    End Sub
  7. Open the Form in Normal View.

  8. Try to change the existing values in the Birth Date and Hire Date Fields.

If the Current User belongs to the Workgroup name assigned to the strGroup Variable, then the BirthDate and HireDate fields will be locked.

Tip: Even if your database is not implemented with Microsoft Access Security, you can test these programs. Assign the value Admins to the strGroup variable in the Subroutine. By default, you will be logged in as Admin User, a member of the Admins Workgroup. This will lock both test fields from editing when the Employees Form is open.

Technorati Tags:
Share:

Change Secure DB to Unsecured

Change Secure DB to Unsecured.

It is generally uncommon to convert a secured database (implemented using Microsoft Access Security) into an unsecured one. However, this step may become necessary when you want to deploy or share a database in an environment that does not use security.

The first step in removing security from a database is to change the ownership of the database objects. By default, the User who creates the database is its Owner. The owner of an object has full access rights to it and can also assign permissions to other Users or Groups. Additionally, members of the Admins group possess these privileges.

Points to remember:

  1. The User who attempts to convert the Database must have at least Read Permission to all Objects of the Database.

  2. The Hidden Objects, if any, cannot be transferred into the target Database.

The Conversion Process.

The conversion process is simple and needs only a few steps.

  1. Create a new Database.

  2. Select File --> Get External Data --> Import.

  3. Browse to the location of the Database you want to convert, and open it.

  4. Select the Tables tab, and click the Select All CommandButton to select all Tables to import.

  5. Repeat this method for all Queries, Forms, Reports, Macros, and Modules.

  6. If your Database has Custom Menus and Toolbars, then click on Options.

  7. Select the Menus and Toolbars option.

  8. Click OK to import all Objects (except the hidden objects) into the new Database.

At this stage, the access privileges of all objects in the new database are reset to their defaults. By default, every database user is a member of the Users group, and therefore has full access rights to all objects. This includes permissions to Open/Run, Read Design, Modify Design, and Administer permissions.

However, if you intend to share this unsecured database over a Network, a few additional changes are required to enable concurrent use. Without these adjustments, the database will be limited to single-user access, preventing concurrent use. 

Changes for Multi-User Environment.

  1. Select Tools --> Options --> Advanced.

  2. Select Shared under the Default Open Mode Options Group.

  3. Select Edited Record under the Default Record Locking Options Group.  Open Database using Record Level Locking Option is already selected.

  4. Click OK to close the Dialog Box.

  5. Select Tools --> Security --> User and Group Permissions.

  6. Select the Admin User Name under the User/Group Name List. 

    Why select the Admin User Account? Because in an unsecured environment, it is a member of the Admins Group and logs in silently when no password is set.  MS Access will not prompt for User ID and Password.

  7. Select the Database Object in the Object Type Control.

  8. Unselect the Open Exclusive Option.

  9. Click OK to close the Dialog Box.

Now, you have a new Database with no Security settings.  The old database will remain unchanged.

Technorati Tags:

  1. Microsoft Access Security
  2. Convert MS-Access Old Versions
  3. Convert Old Version Workgroup File
  4. Share Previous Version Database

Share:

Group Account Permissions with VBA

Group Account Permissions with VBA.

    We have learned how to remove all permissions from every object for the Users Group Account. Since all users belong to this default group, they inherit any permissions assigned to it, in addition to those from other group accounts they are members of.

    If you haven’t reviewed the earlier articles on Microsoft Access Security using VBA, it’s recommended to go through the following links before continuing.

    Nature of Permission Assignment.

    Last week, we discussed how to remove all permissions from a specific group account. This week, we’ll learn how to assign different sets of permissions for each type of object—Tables, Queries, Forms, and others—to a particular group account. Once this setup is complete, all users belonging to that group will have restricted access to the designated objects.

    For Tables and Queries, Users cannot make design changes, but they can view the Table Structure or Query Design. Users can add, edit, or Delete Records in Tables.

    Users can open Run Forms and Reports, but cannot view or make Design Changes.

    Macros can be run but cannot be viewed or changed in design.

    Automating Object-Level Permission Settings.

    The VBA Routine below runs for an external Database and sets permissions for the given User-Group Account in the active Workgroup Information File.

    1. Remember, usernames, passwords, and user-group accounts are stored in the Workgroup Information File (.mdw), while permission settings are saved within the individual databases. In that sense, Microsoft Access security works like a two-part combination lock-key system.

    2. Copy and paste the following VBA Code into a Standard Module of your Database.

      Public Function SetPermission2Grp(ByVal DatabaseName As String, ByVal GroupName As String) As Boolean
      '-------------------------------------------------------------------------
      'Author : a.p.r. pillai
      'Date   : March-2010
      'Purpose: To Assign Security Permissions to Objects
      '       : for a particular Security Group Account
      '       : in an external Database.
      'Note   : The Security Group Account must be present
      '       : in the active Workgroup Information File
      '       :'Remarks: All Rights Reserved by www.msaccesstips.com
      '-------------------------------------------------------------------------
      Dim wsp As Workspace, db As Database, ctr As Container, doc As Document
      Dim ctrName As String, docName As String
      Dim L4 As String
      Const OBJSFULL = &HD01FE
      Const dbOpenRun = 2
      Const FrmRptOpenRun = 256
      Const MacOpenRun = 8
      Const TblQryExcludingModifyAdmin = 244 'All permissions Exluding Modify & Administr
      'Assign Permissions to Group Account
      On Error GoTo SetPermission2Grp_Err
      Set wsp = DBEngine.Workspaces(0)
      Set db = wsp.OpenDatabase(DatabaseName)
      wsp.Groups.Refresh
      For Each ctr In db.Containers
      ctrName = ctr.Name
      ctr.UserName = GroupName
      Select Case ctrName
      Case "Databases"
      For Each doc In ctr.Documents
               docName = doc.Name
               doc.UserName = GroupName
               Select Case docName
                 Case "MSysDb"
                   'Set Open/Run Permissions to Database Object
                    doc.Permissions = doc.Permissions Or dbOpenRun
               End Select
            Next doc
      
         Case "Forms"
          'Set Open/Run Permissions to Forms Container
            ctr.Permissions = ctr.Permissions Or FrmRptOpenRun
            ctr.Inherit = True
            For Each doc In ctr.Documents
               docName = doc.Name
               doc.UserName = GroupName
               'Set Open/Run Permissions to Each Form
              doc.Permissions = doc.Permissions Or FrmRptOpenRun
            Next doc
      
         Case "Reports"
          'Set Open/Run Permissions to Reports Container
            ctr.Permissions = ctr.Permissions Or FrmRptOpenRun
            ctr.Inherit = True
            For Each doc In ctr.Documents
               docName = doc.Name
               doc.UserName = GroupName
               'Set Open/Run Permissions to Each Report
               doc.Permissions = doc.Permissions Or FrmRptOpenRun
            Next doc
      
         Case "Scripts"
           'Set Open/Run Permissions to Macros Container
            ctr.Permissions = ctr.Permissions Or MacOpenRun
            ctr.Inherit = True
            For Each doc In ctr.Documents
               docName = doc.Name
              doc.UserName = GroupName
               'Set Open/Run Permissions to Each Macro
               doc.Permissions = doc.Permissions Or MacOpenRun
            Next doc
      
         Case "Tables"
            '1. Assigns Full Permissions to Tables & Queries
            ctr.Permissions = ctr.Permissions Or OBJSFULL
            ctr.Inherit = True
            For Each doc In ctr.Documents
              docName = doc.Name
              doc.UserName = GroupName
               L4 = Left$(docName, 4)
             'Exclude System Objects
              If L4 = "MSys" Or L4 = "~sq_" Then
                GoTo nextloop
              End If
              '2. Remove Modify and Administrator permissions
              doc.Permissions = doc.Permissions Or TblQryExcludingModifyAdmin
      nextloop:
            Next doc
        End Select
      Next
       ctrSetPermission2Grp = false
      
      SetPermission2Grp_Exit:
      Set db = Nothing
      Set wsp = Nothing
      Exit Function
      
      SetPermission2Grp_Err:
      MsgBox Err & ": " & Err.Description, , "SetPermission2Grp"
      SetPermission2Grp = True
      Resume SetPermission2Grp_Exit
      End Function

    3. To test the Program, create a copy of any Database and find a Group Account that is not assigned permissions for the target database.

    4. Press Alt+F11 to open the VBA Editing Window if you have already closed it.

    5. Press Ctrl+G to open the Debug Window.

    6. Type the following Statement in the Debug Window and press the Enter Key to run the Code and assign permissions to the selected Group Account in the Test Database:

      SetPermission2Grp "C:\My Documents\TestData.mdb", "FAGRP"
    7. Replace the Pathname of the Database and the Security Group Account Name with your own.

    8. After running the Code, open the Test Database and check the Permission Settings of the Group Account you have specified as the parameter.

    Note: You may run the Program from a CommandButton Click after assigning the Database path name and Security Group Account Name in TextBoxes.

    Earlier Post Link References:

Share:

Users Group and Permissions

User Groups and Permissions.

Making a Database Truly Secure

When you create a new Workgroup Information File (.mdw) As part of implementing Microsoft Access security, there are two essential steps you must complete immediately:

  1. Create a new Administrator User ID (for example, myAdmin, or any name you prefer) and add this user as a member of the Admins Group.

  2. Remove the default Admin user account from the Admins Group.

    If you skip this step, your database remains insecure—anyone can open and use it if Microsoft Office is reinstalled.

From this point forward, you must use your new user ID (myAdmin) to log in as the database administrator for any databases associated with this new Workgroup Information File.

Additionally, any databases you create while logged in as myAdmin: that User ID is the owner of the database and all its objects.

Remember:

  • The database owner has full authority over all objects, including administrative rights to assign permissions and transfer ownership.

  • When ownership of a specific object is transferred to another user, that user gains complete control over it—they can run, modify, or delete the object.

Next, let’s look at how to assign object-level access rights to a user group.

You must set object-level access rights for user groups before deploying your project for public use. This process is performed manually through the menu path:
Tools → Security → User and Group Permissions.

This procedure also includes an essential first step, similar to the two priority steps mentioned earlier for the Workgroup Information File. The step is to remove all permissions for all objects assigned to the Users Group Account.

Without completing this step, any permission settings you later assign to objects—such as Forms, Reports, or Tables—will have no effect, and users will retain full access, including the ability to make design changes or modify the objects freely.

This process can be time-consuming when done manually, as it requires reviewing and clearing permissions for every object group. Since this step is necessary for all new projects, I decided to automate it with a VBA-based procedure, which I’m sharing here for you to try.

Automated Removal of Object-level Permissions.

  1. Copy and paste the following Program into a Standard Module and save it.

    Public Function DefaultUsersGrp(ByVal DatabasePathName As String) As Boolean
    '----------------------------------------------------------------------------
    'Author : a.p.r. pillai
    'Date     : March-2010
    'Purpose: Remove All Permissions from Users Group Security Account
    'All Rights Reserved by www.msaccesstips.com
    '----------------------------------------------------------------------------
    Dim wsp As Workspace, db As Database, ctr As Container
    Dim GroupName As String, doc As Document
    Dim L4 As String
    
    Const DB_FULLNO = &H60000
    Const OBJS_FULLNO = &H2FE01
    
    'Remove All Permissions on Containers & documents
    'for USERS Group
    
    On Error GoTo DefaultUsersGrp_Err
    
    Set wsp = DBEngine.Workspaces(0)
    Set db = wsp.OpenDatabase(DatabasePathName)
    
    wsp.Groups.Refresh
    GroupName = "Users"
    
    Set ctr = db.Containers("Databases")
    Set doc = ctr.Documents("MSysDb")
    doc.UserName = GroupNamedoc.Permissions = DB_FULLNO
    
    Set ctr = db.Containers("Tables")
    GoSub SetPermission
    
    Set ctr = db.Containers("Forms")
    GoSub SetPermission
    
    Set ctr = db.Containers("Reports")
    GoSub SetPermission
    
    Set ctr = db.Containers("Scripts")
    GoSub SetPermission
    
    Set ctr = db.Containers("Modules")
    GoSub SetPermission
    DefaultUsers_Grp = False
    
    DefaultUsers_Grp_Exit:
       Set db = Nothing
       Set wsp = Nothing
    Exit Function
    
    SetPermission:
    For Each doc In ctr.Documents
        doc.UserName = GroupName
        If ctr.Name = "Tables" Then
            L4 = Left$(docName, 4)
            If L4 = "MSys" Or L4 = "~sq_" Then
              GoTo nextloopxxx
            End If
        End If
        doc.Permissions = OBJS_FULLNO
    nextloopxxx:
    NextReturn
    
    DefaultUsersGrp_Err:
    MsgBox Err & ": " & Err.Description
    DefaultUsersGrp = True
    Resume DefaultUsersGrp_Exit
    End Function

    Points to Note.

  2. Remember, this program is designed to run on an external database—specifically, the one from which you want to remove all permissions for all objects assigned to the Users Group Account.

  3. Before running the program, open the target database and review the current permission settings of all objects for the Users Group Account. It’s strongly recommended that you test the program on a copy of the original database first, to ensure that your data and structure remain safe.

  4. Open the Database with the above Code if you have closed it.

  5. Press Alt+F11 to display the VBA Editing Window and press Ctrl+G to display the Debug Window.

  6. Type the following and press the Enter Key:

    Default UsersGrp "C:\My Documents\myTest.mdb"

  7. Replace the database path name in quotes with your own database name.

    You may run the Program from a CommandButton Click Event Procedure from a Form.

  8. Open your test database and review the current permission settings for the Users Group Account. You’ll notice that all the check marks from the permission options have now disappeared, confirming that the permissions have been successfully removed.

Earlier Post Link References:

Share:

Create Security Group Account with VBA

Create a Security Group Account with VBA.

Last week, we learned how to create a Microsoft Access Security User Account (SMITHJOHN) with VBA and how to add him as a member of the default Group Account Users. The Users and Admins Group Accounts are already present in the default Workgroup Information File (Sytem.mdw ) or in the new Workgroup Information File that you create separately.

If Users need to be organized into categories such as Managers, Supervisors, Data Entry Operators, Editors, and others, access rights can be defined at the group level instead of for individual Users. Any number of Users can be assigned to a group. Once the access rights for a group are defined, every User assigned to that group automatically inherits the privileges granted to it.

One User can be a member of more than one Group. A sample image of the User and Group Accounts control is shown below, and we will examine how the User SMITHJOHN's Security credentials appear in the Control.

In the User Name control, SMITHJOHN is selected. Under the Member label, the Users Group Account is displayed, indicating that this user currently belongs only to that group. The Users Group Account also appears in the Available Group List. Unlike the Users Group Account, which is the default group, the other Group Accounts listed under the Available Group List have been created manually to organize different categories of Users.

To make the user SMITHJOHN a member of the VEHGRP Group Account, select VEHGRP from the Available Groups list and click the Add >> Command Button. This action copies the group name to the Member list. Once added, the selected user automatically inherits all the Access Privileges assigned to the VEHGRP Group Account.

At the end of last week's main program, CreateUser, the following code segment is doing exactly what we did manually in the above paragraph:

. . .
   With wsp
     Set tempGrp = .Users(UsrName).CreateGroup("Users")
         .Users(UsrName).Groups.Append tempGrp
         .Users.Refresh
   End With

Creating the Group Account.

Create the Group Account VEHGRP by going through the same procedure as creating a new User Account from the Groups Tab on the Control above. So, the VEHGRP Account was created at some point in time earlier.

Here, we will learn:

  1. How to create a Microsoft Access Security Group Account MANAGER with VBA.
  2. How to join the User SMITHJOHN to the MANAGER Group Account with VBA.

NB: User and Group Accounts are not case-sensitive. Here they are given in uppercase for legibility only.

The following Program creates the MANAGER Group Account in the Available Groups List:

Public Function CreateUserGrp()
'---------------------------------------------------------------------
'Creating a Security Group Account
'Author : a.p.r. pillai
'Date   : March-2010
'All Rights Reserved by www.msaccesstips.com
'---------------------------------------------------------------------
Dim newGrp As Group, wsp As Workspace
Dim tempGrp As Group
Dim grpName As String, grpID As String

On Error Resume Next

Set wsp = DBEngine.Workspaces(0)

    grpName = "MANAGER"
    grpID = "MGR13579"

With wsp
    Set newGrp = .CreateGroup(grpName, grpID)
               .Groups.Append newGrp

    If Err = 3390 Then
      MsgBox "Group Name : " & grpName & vbCr & vbCr & "Group PID     : " & grpID & vbCr & vbCr & "Account Name already Exists..! "
      Err.Clear
    End If

      .Groups.Refresh
End With

End Function
  1. Copy and paste the above program into a Standard Module.
  2. Click somewhere in the middle of the Code and press the F5 Key to run the Code and create the MANAGER Group Account.
  3. You may select Tools -> Security -> User and Group Accounts (from the Database Window).
  4. Select SMITHJOHN in the User Name List.
  5. Search for the name MANAGER in the Available Groups List, and find it there.

Adding the User Account to a Group.

But the User SMITHJOHN is not added to the MANAGER Group Account, and this is where we need to add the code segment given at the top of this page to the main program.

The revised VBA Code below creates the MANAGER Group Account and adds the User SMITHJOHN to the Group Account.

Public Function CreateUserGrp()
'---------------------------------------------------------------------
'Creating a Security Group Account
'Author : a.p.r. pillai
'Date   : March-2010
'All Rights Reserved by www.msaccesstips.com
'---------------------------------------------------------------------
Dim newGrp As Group, wsp As Workspace
Dim tempGrp As Group
Dim grpName As String, grpID As String

On Error Resume Next

Set wsp = DBEngine.Workspaces(0)

    grpName = "MANAGER"
    grpID = "MGR13579"

With wsp
    Set newGrp = .CreateGroup(grpName, grpID)
               .Groups.Append newGrp
    If Err = 3390 Then
      MsgBox "Group Name : " & grpName & vbCr & vbCr & "Group PID     : " & grpID & vbCr & vbCr & "Account Name already Exists..! "
      Err.Clear
    End If

      .Groups.Refresh
End With

'Add the User SMITHJOHN to the MANAGER Group Account
usrName = "SMITHJOHN"

   With wsp
     Set tempGrp = .Users(usrName).CreateGroup(grpName)
         .Users(usrName).Groups.Append tempGrp
         .Users.Refresh
   End With
End Function

Running the Code a Second Time.

If you run the revised Code again, it will show an Error Message saying that the MANAGER Group Account already exists, because you have already run this code once. But the remaining part of the code will run.

If you open the User and Group Accounts control now and select SMITHJOHN in the User Name Control, you can see that the MANAGER group name is now appearing under the Member List, indicating that the User is a member of the MANAGER Group Account.

See the sample image given below.

Share:

Creating User-Account with VBA

Creating a User Account with VBA.

To create a Microsoft Access user account in the Workgroup Information File System.mdw, navigate to:
Tools → Security → User and Group Accounts → User Name tab.
There, provide a unique User Name and a Personal ID to create a new user account.

We discussed this procedure earlier in the Security Main Menu. The User IDs, Personal IDs, Workgroups, and Passwords are stored in the Workgroup Information File, a database with the MDW file extension. The default file used by Microsoft Access is SYSTEM.MDW.

Access privileges for database objects are stored within the database itself. Together, these two components form the combination lock of Access security:

  • The User ID and Personal ID stored in the Workgroup Information File act as the key, and

  • The object-level access rights stored within the database serve as the lock.

A user gains access to specific objects only when the correct User ID, Password, and Personal ID are provided.

The Personal ID is a critical part of each user’s profile—it is required if you ever need to recreate a Workgroup Information File after the original one becomes corrupted or lost.

The Administrators (members of the Admins Group) have the authority to create and manage User and Group IDs.

Creating a User Account Manually.

First, let’s create a test user account manually. Follow the procedure given below to create a user account step by step.

User Name: JOHNSMITH (maximum 20 characters)

  • Personal ID: JS123456 (4 to 20 Alphanumeric characters)

Visit the link: Create MS Access User Account for more details.

  1. Select Tools -> Security -> User and Group Accounts

  2. Click New in the Users Tab.

  3. Type JOHNSMITH in the Name control.

  4. Type JS123456 in the Personal ID control.

  5. Click OK to complete the procedure.

The Users Group.

By default, all User Accounts are added to the Users Group Members. If a user needs to belong to additional user groups, you must select the desired group name from the Available Groups list and add it to the Member Of list using the control on the right-hand side.

Now, let’s learn how to create a user account using VBA—excluding, for now, the step that assigns the user to a specific group. We’ll explore how to link users to groups later, after we cover the topic: how to create a group account with VBA.

Create a User Account with VBA.

The following VBA Code creates a User Account with the User Name: SMITHJOHN, with the Personal ID: SJ78901, and with an initial Password: SMITHJOHN:

Public Function CreateUsers()
'---------------------------------------------------------------------------------
'Author : a.p.r. pillai
'Date   : Feb-2010
'All Rights Reserved by www.msaccesstips.com
'Other Ref: http://www.msaccesstips.com/2006/11/create-msaccess-user-account/
'---------------------------------------------------------------------------------
Dim wsp As Workspace
Dim newUser As User, tempGrp As Group
Dim UsrName As String, PersonalID As String
Dim Password As String

On Error Resume Next

Set wsp = DBEngine.Workspaces(0)

    UsrName = "SMITHJOHN" ' 1 to 20 characters.
    PersonalID = "SJ78901" 'upto 4 to 20 alphaumeric characters
    Password = "SMITHJOHN" 'upto 14 characters except NULL

'Create User Account with personalID
   Set newUser = wsp.CreateUser(UsrName, PersonalID, Password)
   wsp.Users.Append newUser

   If Err = 3390 Then
      MsgBox "User Name : " & UsrName & vbCr & vbCr & "User PID    : " & PersonalID & vbCr & vbCr & "Account Name already Exists..! "
      Err.Clear
      Exit Function
   End If
   wsp.Users.Refresh

'Users Group must be created and joined the
'User to it. When created manually this step
'(for Users Group)is done automatically.
   With wsp
     Set tempGrp = .Users(UsrName).CreateGroup("Users")
         .Users(UsrName).Groups.Append tempGrp
         .Users.Refresh
   End With

End Function

When we create a User ID, we can assign a password for the User.  After opening a new MS Access Application window, select the Menu Options Tools ->Security ->User and Group Accounts ->, log in without a password, select the Change Logon Password Tab of the Dialog Control, and set a new password.

  1. Copy and paste the above Code into a Standard Module and save it.

  2. Click in the middle of the Code and press F5 to run the Code and create the User Account in the active Workgroup Information File.

  3. Select Tools - ->Security- ->User and Group Accounts and check for the User Name SMITHJOHN on the list.

The User Names are in alphabetical order.

Search for a particular User Name with VBA.

We can check for the presence of a particular User Name in the active Workgroup Information File with the following VBA Code:

Public Function Check4UserAccount(ByVal strUsrName As String) As Boolean
'------------------------------------------------------------------------
'Author : a.p.r. pillai
'Date   : Feb-2010
'All Rights Reserved by www.msaccesstips.com
'------------------------------------------------------------------------

Dim WS As Workspace, msg As String
Dim UsrName As String, K As User, Flag As Boolean

Set WS = DBEngine.Workspaces(0)

'All the Users belong to the Common Group 'Users'
Flag = False
With WS.Groups("Users")
        For Each K In .Users
                  If K.Name = strUsrName Then
                          Flag = True
                          Exit For
                  End If
        Next
End With

If flag Then
     MsgBox "User Name: " & strUsrName & " Already Exists! "
End If

Check4UserAccount = flag

End Function

Type the following in the Debug Window (Immediate Window) and press the Enter Key to run the above Code:

Check4UserAccount "SMITHJOHN"

If you have not run the first program to create the User Account SMITHJOHN, then to test the second Program, call the above function with the admin username.

Type the following in the Debug Window (Immediate Window) and press the Enter Key:

Check4UserAccount "Admin"

Earlier Post Link References:

Share:

Share Previous Version Database

Share Previous-version Secured Database.

With one exception, the issues involved when sharing a secured database across more than one version of Microsoft Access are the same as the issues for sharing an unsecured database across more than one version.

The one exception concerns how to handle the workgroup information file that is used with the secured database. You have two choices:

  1. Tell users who will be upgrading to Microsoft Access 2000 to join the appropriate workgroup information file with the oldest version of Microsoft Access that will be sharing the secured database.

    Microsoft Access 2000 can use workgroup information files created with previous versions, but previous versions can only use workgroup information files created with Microsoft Access 2000 or a previous version.

    Important: If users will be sharing a secured database from Microsoft Access 95 or 97, you should compact the current workgroup information file with Microsoft Access 2000 before using it. Compacting the file by using Microsoft Access 2000 does not change the file format, so the file can continue to be used by any Microsoft Access 95 or 97 users who are not upgrading.

  2. If the shared database is Microsoft Access version 2.0, convert the workgroup information file that will be used with the secured database and then tell only users who are upgrading to Microsoft Access 2000 to join the converted workgroup information file. All users who are not upgrading from version 2.0 must continue to use the workgroup information file produced with that version.
<-- fb="" for="" h3="" images="" posts="" without="">Earlier Post Link References: -->

MS-ACCESS Security Links.

  1. Create a security user account
  2. Create a security group account
  3. Add users to security groups
  4. Remove users from security groups
  5. Delete a security user account
  6. Delete a security group account
  7. Create or change a security account password
  8. Clear a security account password
  9. Assign or remove permissions
  10. Assign default permissions for new tables, queries, forms, reports, and macros.
  11. View or transfer ownership of Objects
  12. Transfer ownership of an entire database to another administrator
  13. Permit others to view or run my query but not change data or query design.
  14. Change default permissions for all new queries.
  15. RunPermissions Property
  16. Convert Microsoft Access 95 or 97 secured databases.
  17. Convert a workgroup information file from a previous version of Microsoft Access.
  18. Share a previous-version secured database across several versions of Microsoft Access
Share:

Convert Old Version Workgroup File

Convert Workgroup File to New Version

To take advantage of security and performance improvements, you should re-create the Workgroup Information File as described below:

  1. Create a new workgroup information file, making sure to enter the exact, case-sensitive name, company name, and workgroup ID that was used to create the original file. Failure to re-enter the exact entries that were used to create the original file will create an invalid Admins group.
  2. Re-create any group accounts, making sure to enter the exact, case-sensitive user name and PID for each user.
  3. Tell other Microsoft Access 2000 users in the workgroup to use the workgroup Administrator to join the new workgroup information file.

    Click Next to see how to Share a previous-version secured database across several versions of Microsoft Access.

    Goto Main


<-- fb="" for="" h3="" images="" posts="" without="">Earlier Post Link References: -->

MS-ACCESS Security Links.

  1. Create a security user account
  2. Create a security group account
  3. Add users to security groups
  4. Remove users from security groups
  5. Delete a security user account
  6. Delete a security group account
  7. Create or change a security account password
  8. Clear a security account password
  9. Assign or remove permissions
  10. Assign default permissions for new tables, queries, forms, reports, and macros.
  11. View or transfer ownership of Objects
  12. Transfer ownership of an entire database to another administrator
  13. Permit others to view or run my query but not change data or query design.
  14. Change default permissions for all new queries.
  15. RunPermissions Property
  16. Convert Microsoft Access 95 or 97 secured databases.
  17. Convert a workgroup information file from a previous version of Microsoft Access.
  18. Share a previous-version secured database across several versions of Microsoft Access
Share:

Convert MS Access Old Versions

Convert Microsoft Access 95/97 Secured Database.

When upgrading from Microsoft Access 95 or 97, you need to convert your secured database, but you don't need to convert the Workgroup Information File to use it with Microsoft Access 2000. However, you should compact the Workgroup Information File before using it.

  1. Convert the secured database.
  2. Compact the secured database.
  3. Exit Microsoft Access.
  4. Before compacting the Workgroup Information File (typically named 'System.mdw') that was used with the secured database, temporarily join another Workgroup Information File.
  5. Start Microsoft Access without opening a database.
  6. Compact the Workgroup Information File that was used with the secured database.
  7. Tell users to join the compacted Workgroup Information File before opening the secured database.
<-- fb="" for="" h3="" images="" posts="" without="">Earlier Post Link References: -->

MS-ACCESS Security Links.

  1. Create a security user account
  2. Create a security group account
  3. Add users to security groups
  4. Remove users from security groups
  5. Delete a security user account
  6. Delete a security group account
  7. Create or change a security account password
  8. Clear a security account password
  9. Assign or remove permissions
  10. Assign default permissions for new tables, queries, forms, reports, and macros.
  11. View or transfer ownership of Objects
  12. Transfer ownership of an entire database to another administrator
  13. Permit others to view or run my query but not change data or query design.
  14. Change default permissions for all new queries.
  15. RunPermissions Property
  16. Convert Microsoft Access 95 or 97 secured databases.
  17. Convert a workgroup information file from a previous version of Microsoft Access.
  18. Share a previous-version secured database across several versions of Microsoft Access
Share:

PRESENTATION: ACCESS USER GROUPS (EUROPE)

Translate

PageRank

Post Feed


Search

Popular Posts

Blog Archive

Powered by Blogger.

Labels

Forms Functions How Tos MS-Access Security Reports msaccess forms Animations msaccess animation Utilities msaccess controls Access and Internet MS-Access Scurity MS-Access and Internet External Links Queries Array Class Module msaccess reports Accesstips msaccess tips WithEvents Downloads Objects Menus and Toolbars MsaccessLinks Process Controls Art Work Collection Object Property msaccess How Tos Combo Boxes ListView Control Query VBA msaccessQuery Calculation Dictionary Object Event Graph Charts ImageList Control List Boxes TreeView Control Command Buttons Controls Data Emails and Alerts Form Custom Functions Custom Wizards DOS Commands Data Type Key Object Reference ms-access functions msaccess functions msaccess graphs msaccess reporttricks Command Button Report msaccess menus msaccessprocess security advanced Access Security Add Auto-Number Field Type Form Instances ImageList Item Macros Menus Nodes Recordset Top Values Variables msaccess email progressmeter Access2007 Copy Excel Expression Fields Join Methods Microsoft Numbering System RaiseEvent Records Security Split SubForm Table Tables Time Difference Utility WScript Workgroup Wrapper Classes database function msaccess wizards tutorial Access Emails and Alerts Access Fields Access How Tos Access Mail Merge Access2003 Accounting Year Action Animation Attachment Binary Numbers Bookmarks Budgeting ChDir Color Palette Common Controls Conditional Formatting Data Filtering Database Records Defining Pages Desktop Shortcuts Diagram Disk Dynamic Lookup Error Handler Export External Filter Formatting Groups Hexadecimal Numbers Import Labels List Logo Macro Mail Merge Main Form Memo Message Box Monitoring Octal Numbers Operating System Paste Primary-Key Product Rank Reading Remove Rich Text Sequence SetFocus Summary Tab-Page Union Query User Users Water-Mark Word automatically commands hyperlinks iSeries Date iif ms-access msaccess msaccess alerts pdf files reference restore switch text toolbar updating upload vba code