Link to home
Start Free TrialLog in
Avatar of Dana Timmerman
Dana Timmerman

asked on

Enforce Password Strength

Is there a way to enforce password strength in MS Access? I also need to setup a password expiration date. I already have a login system in place with a user change password form. Thank you!
Avatar of Dale Fye
Dale Fye
Flag of United States of America image

You might want to search EE on "Regular Expressions" and "Password".

Here is one EE article which will help you.

https://www.experts-exchange.com/questions/28685446/password-validation-in-Access.html
No.  And because it's done via the UI, not seeing a way to do it by writing you own code either.
What version are you using?
<=A2003 only allowed 14 characters also ...
That has been removed I believe in >=A2007 ... and the password paradigm is much stronger than the useless scheme in <=A2003.
Avatar of Dana Timmerman
Dana Timmerman

ASKER

Thank you!!!!
It is better to enforce the password strength with Windows/AD.  If you need to restrict to certain users, then retrieve the currently logged in user and compare against a table/list of valid users.
The solution Dale pointed you to will get you started on evaluating strength.  To enforce change, you need to keep a password history table with the date of the change.  Each time the user logs on, you see how long it has been since he last saved a new password and force him to change at the appropriate interval.  The reason for keeping history is because if you are bothering to do this, you want to prevent people from toggling from pswrdA to pswrdB so you have to make sure that they don't reuse a password within a specific time period or ever if that is your business rule.
My assumption was you are talking about the Access Database Password as opposed to rolling your own password form etc. Is that correct ?
If so ... you really don't have any control over Strength ...

mx
No, I am rolling out my own password form, etc. I am just working on password strength requirements. I also have the Login set to only allow 3 attempts with a wrong password. However, I am still trying to figure out how to then completely lock them out of the database if they have 3 failed attempts. What fields should I have in the table? I am fairly new to Access/VBA, but I am catching on. Oh and I am using Access 2010. Thank you!!!
how will you lock them out of the Back End accdb ?
I was intending on splitting the database into 2 and then saving the front end as ACCDE. I also shut off the ribbon, the navigation pane, and disabled the shift bypass key. I then have this login form with multiple users that uses different usertypes. This is my first database, so I know it's not perfect, but it is functioning so far. I could post the login form code that I have?

I just created a Password History table with a field for ChangedDate, UserName, and Attempts. I am still green with VBA, but I think I can do this without creating a new query, right?

All of you have been extremely helpful by the way. I appreciate it big time!
ASKER CERTIFIED SOLUTION
Avatar of Jim Dettman (EE MVE)
Jim Dettman (EE MVE)
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you!!!!!!!!!!!!!!!!!!