Create ACCDE front end with no table access except through forms

Question

I'm about to release my database to my staff, but I want to ensure that no one will be able to access the tables directly. I have a set of forms that I have designed and I want to restrict users to interacting with the database via those forms. I've already split the database into a back end and will have a pair of front ends (so far so good).

I can disable full menus, navigation pane, etc., but a user can just go in through file->privacy options->current database and turn them back on!

How do I go about creating a front end that limits access to the back end the way I want that doesn't require me to trust the database users?

Thanks,

-Chris

Answer 1

That was supposed to be "To be honest with you a user...

Answer 2

Hiding the Nav Pane, providing your own ribbon, deploying as an ACCDE, disabling the bypass key, not giving users a full license, only the Runtime are all out of the box methods for locking down a database. But remember Access is designed to be an end user tool. So it was never designed with high level security features.

To be honest with a user that can figure out how to get into Options and unlock the database is not going to have problems dealing with the interface you create for them. And it is you job as developer, to create an interface that will be easy to use and intuitive. I've been building apps for corporate users for decades. I have never run into a problem with users screwing around with my apps and going behind the interface. We have a corporate policy about corporate data and no one would risk their job for a peak.

Answer 3

I don't trust some of them not to be idiots. I'm not concerned with people going in to the back end and causing problems; I'm worried about people opening up the tables via the navigation pane in the front end because they can't figure out or can't bother to ask the correct way to do things. It seems crazy to me that there is no out-of-the box way to lock down the front end to a set forms and nothing else.

Answer 4

If you don't trust your users not to monkey with corporate data then you have a bigger problem then coding in security.

Use SQL Server as your back end instead of the ACE engine. See my blog (scottgem.wordpress.com) for other ways to secure your app.