Troubleshoot security (MDB)

You must either be the owner of the database or a member of the Admins group with Open Exclusive permission to encode or decode a database employing user-level security.

Also, you must have enough storage space on your disk for both the original and the encoded or decoded versions of the database.

You can't set a database password if user-level security has been defined for your database and you don't have Administer permission for the database.

A database password is defined in addition to user-level security. If user-level security has been defined, any restrictions based on user-level security permissions remain in effect.

Do not use a database password if you will be replicating a database. Replicated databases can't be synchronized if database passwords are defined.

In rare circumstances, the Microsoft Access workgroup information file can become damaged. If you start Microsoft Access and that file can't be opened, a message will be displayed. How you solve this problem depends on whether you have a backup copy and how your workgroup information file was originally created or specified. The following table summarizes how you should address each situation.

Important  Microsoft Access stores security account information in the workgroup information file. So in all cases where you don't have a backup copy and have to re-create a workgroup information file, if you've restricted permissions to your databases, you must re-create security accounts with the same case-sensitive names and personal ID (PID) entries as before.

Note  You don't have to redefine permissions or object ownership because this information is stored in the security-enabled databases.

Used Workgroup Administrator	Made backup copy	Solution
No. Used default file created when installing Microsoft Access.	No	Re-start Microsoft Access and Microsoft Windows installer will re-create a default workgroup information file.
No. Used default file created when installing Microsoft Access.	Yes	Use Windows Explorer, My Computer, MS-DOS copy command, or backup software to copy the most recent copy of the file to the folder where you installed Microsoft Access.
Yes. Created a new file.	No	Run the Workgroup Administrator again, typing the same case-sensitive name, organization, and workgroup ID (WID) entries you used when you originally created it.
Yes. Created a new file.	Yes	Copy or restore the backup copy to the path where you originally saved your workgroup information file.
Yes. Joined (specified) a file on a path other than the folder where Microsoft Access is installed.	Yes	Copy or restore the backup copy to the original path.
Yes. Joined (specified) a file on a path other than the folder where Microsoft Access is installed.	No	Create a new copy by using the method that was used to create the original file: re-start Microsoft Access so that installer will re-create a default workgroup information file, or run the Workgroup Administrator and type the same case-sensitive name, organization, and workgroup ID entries used when it was originally created.

If a workgroup information file becomes damaged or has been deleted, and a backup copy isn't available, you can re-create the workgroup information file if you have the exact case-sensitive information that you used to create the file and define the accounts and groups in the file originally.

1. Create a new workgroup information file, making sure to enter the exact case-sensitive name, company name, and workgroup ID (WID) that you used to create the original file. Failure to re-enter the exact entries used to create the original file will create an invalid Admins group.

   How?

   A Microsoft Access workgroup information file contains a list of users who share data, also know as a workgroup. Users' passwords are also stored in the workgroup information file. To control who has access to your database, you must create a new workgroup information file.

   1. Start Microsoft Access.
   2. On the Tools menu, point to Security, and then click Workgroup Administrator.
   3. In the Workgroup Administrator dialog box, click Create.
   4. In the Workgroup Owner Information dialog box, type your name and organization, and then type any combination of up to 20 numbers and letters for the workgroup ID (WID).

      Caution  Be sure to write down your exact name, organization, and workgroup ID— including whether letters are uppercase or lowercase (for all three entries)— and keep them in a secure place. If you have to re-create the workgroup information file, you must supply exactly the same name, organization, and workgroup ID. If you forget or lose these entries, you can't recover them and might lose access to your databases.

   5. Type a new name for the new workgroup information file. By default, the workgroup information file is saved in the language folder. To save in a different location, type a new path or click Browse to specify the new path.

   The new workgroup information file is used the next time you start Microsoft Access. Any user and group accounts or passwords that you create are saved in the new workgroup information file. To have others join the workgroup defined by your new workgroup information file, copy the file to a shared folder (if you didn't already save it in a shared folder in step 5), and then have each user run the Workgroup Administrator to join the new workgroup information file.

2. Re-create any group accounts, making sure to enter the exact case-sensitive group name and personal ID (PID) for each group.

   How?

   As part of securing a database, you can create group accounts in your Microsoft Access workgroup that you use to assign a common set of permissions to multiple users.

   To complete this procedure, you must be logged on as a member of the Admins group.

   1. Start Microsoft Access by using the workgroup in which you want to use the account.

      Important  The accounts you create for users must be stored in the workgroup information file that those users will use. If you're using a different workgroup to create the database, change your workgroup before creating the accounts. You can change workgroups by using the Workgroup Administrator.

   2. Open a database.
   3. On the Tools menu, point to Security, and then click User And Group Accounts.
   4. On the Groups tab, click New.
   5. In the New User/Group dialog box, type the name of the new account and a personal ID (PID).

      Caution  Be sure to write down the exact account name and PID, including whether letters are uppercase or lowercase, and keep them in a secure place. If you have to re-create an account that has been deleted or created in a different workgroup, you must supply the same name and PID entries. If you forget or lose these entries, you can't recover them.

      Note  A user account name cannot be same as an existing group account name, and visa versa.

   6. Click OK to create the new group account.

   Note  The PID entered in step 5 is not a password. Microsoft Access uses the PID and the user name as seeds for an encryption algorithm to generate an encrypted identifier for the user account.

3. Re-create each user account, making sure to enter the exact case-sensitive user name and PID for each user.

   How?

   To complete this procedure, you must be logged on as a member of the Admins group.

   Note  It is usually easier to manage security if you organize users into groups, and then assign permissions to groups rather than to individual users.

   1. Start Microsoft Access by using the workgroup in which you want to use the account.

      Important  The accounts you create for users must be stored in the workgroup information file that those users will use. If you're using a different workgroup to create the database, change your workgroup before creating the accounts.

   2. Open a database.
   3. On the Tools menu, point to Security, and then click User And Group Accounts.
   4. On the Users tab, click New.
   5. In the New User/Group dialog box, type the name of the new account and a personal ID (PID), and then click OK to create the new account, which is automatically added to the Users group.

      Caution  Be sure to write down the exact account name and PID, including whether letters are uppercase or lowercase, and keep them in a secure place. If you ever have to re-create an account that has been deleted or created in a different workgroup, you must supply the same name and PID entries. If you forget or lose these entries, you can't recover them.

   Notes

   • A user account name cannot be same as an existing group account name, and visa versa.
   • The PID entered in step 5 is not a password. Microsoft Access uses the PID and the user name as seeds for an encryption algorithm to generate an encrypted identifier for the user account.
4. If you saved the new workgroup information file to a new name or location in step 1, tell other users in the workgroup to use the Workgroup Administrator to join the new workgroup information file.