The AllowBypassKey Property

The bypass key (SHIFT key) sequence is a sneaky little Access trick that has been around since Noah kept a database of animals on his ark. Once you know the SHIFT key sequence, you will be able to use it for all versions of Access. Though it's disappointing that anyone can sidestep security so easily by using the SHIFT key, once I have demonstrated how it actually works, I will show you how to disable it.

The Access help guide describes the bypass key as follows : "You can use the AllowBypassKey property to specify whether or not the SHIFT key is enabled for bypassing the startup properties and the AutoExec macro. For example, you can set the AllowBypassKey property to False to prevent a user from bypassing the startup properties and the AutoExec macro."

The best way to illustrate what effect the bypass key will have on your database is to walk through an example, using the Northwind sample database.

1. Open Microsoft Access.

2. Choose File ˜ Open.

3. Navigate to Northwind.mdb in the samples subdirectory of your Access installation directory (see Figure 2-8).

   
   Figure 2-8: Opening the Northwind database.

4. Select the Northwind.mdb file, and click the Open button, and you will find yourself using the Main Switchboard form.

5. Exit Access.

6. Open Access.

7. Choose File ˜ Open. Now navigate back to Northwind.mdb .

8. Select the file name .

9. Press SHIFT and click the Open button.

This time the database will open a lot faster, the database window will be visible, and the Main Switchboard form will not open at all. In addition, the AutoExec macro will not run either, so any special startup sequences that you have built into your database will not be triggered. You can repeat this trick by pressing SHIFT when using Windows Explorer or even in the Most Recent Used List on the Access menus to open a database.

Note  

Unless the AllowBypassKey property has been set to False, you can bypass the startup options in any Access database by pressing SHIFT in Windows Explorer and then double-clicking the database file. This is a good way to view the hidden database window, turning on the special keys and avoiding customized menus. Your users can also do this, so you may want to think about invoking this extra bypass key protection just before you deliver your software.

Caution  

It's now time to back up your database, because it can be a bit tricky if you do not leave the VBA code somewhere accessible in your database so that you can change the AllowBypassKey property back to True.

Let's look at how we can use the frmStartupProperties form to set the AllowBypassKey property to False.

1. Open this book's demonstration database for your version of Access.

2. Select Chapter 2 and select frmStartupProperties .

3. Because we are testing the process, select the Display Database Window check box just in case we have to return to frmStartupProperties from the Database Window. This form provides a safety net because it will allow us to reset the AllowBypassKey property back to True.

4. Clear the Allow Bypass Key check box.

5. Click Finish.

6. Check the startup options, which won't show the AllowBypassKey property.

7. Close the database and then try to open it while pressing SHIFT. You will find that you won't be able to ”you have turned it off.

Now there is one last step for those who just must have the best protection for their startup properties.

Applying DDL Protection

Finally, if you consider that one of your users may understand how to enable the AllowBypassKey option by using VBA code and you have used workgroup security, you can use the DDL protection to limit this modification to database administrators only. This limitation is possible by using the optional fourth argument ( ddlRequired ) of the StartUpProps subroutine. Remember that before we set the DDL property, we first must delete the current setting of the property, as demonstrated by the following code:

 DeleteStartupProps "AllowBypassKey" StartUpProps "AllowBypassKey", False, True 

What this code means in real words is to test whether a workgroup user can use the frmStartupProperties form to turn off the AllowBypassKey property. If they can, then use the Administrator Only check box on the form to lock it.

The Bypass Key Wrap Up

If your database relies only on the startup properties to protect the data and the objects, then you probably want to make sure it is as safe as possible. A user who knows how to press SHIFT (the bypass key) when opening a database can easily modify or delete any object in the database, copy those hidden tables that the developer tried to hide, or simply enter the data directly into the tables and avoid all the form-based data rules. If you think that your users will never find out about the SHIFT key, try typing "Startup" into your Access help and the instructions for "Ignore startup options" will figure very prominently. So, do you want to trust your database protection to a SHIFT key?

The final word on this topic is that you may want to look to the end of Chapter 6, where I show you a tool that will locate people who have connected to your database without using your required startup form. Now I will show you how special keys can make using the startup options a little easier for the developer.