Use sandbox mode in Access 2010

The information in this article explains how to use an operating environment called sandbox mode in Access 2010. In sandbox mode, Access blocks all expressions that it does not consider safe. In this case, an unsafe expression uses functions or properties that could be exploited by malicious users to gain access to drives, files, or other resources for which they do not have authorization. For example, functions such as Kill and Shell could be used to damage data and files on a computer, so they are not considered safe.

Note:  This topic does not apply to web databases, and does not cover all Access 2010 security features. For more information about using other security features in Access 2010, click the links in the See Also section of this article.

What do you want to do?

Understand sandbox mode and how it behaves in Access 2010

Disable sandbox mode (run unsafe expressions)

Understand sandbox mode and how it behaves in Access 2010

When you add an expression to a database, Access runs that expression in an operating environment called sandbox mode. Access does this for databases that were created in either Access 2010, or earlier Access file formats that you open in Access 2010. Access enables sandbox mode by default, and the mode always disables unsafe expressions, even after you enable the content in a database.

If you trust the source of a database and you want to run an expression that sandbox mode disables, you can run that expression by changing a registry key to disable sandbox mode. Remember that the database must either be located in a trusted location, or bear a valid trust signature, for it to be possible to disable sandbox mode. If you want to change the setting for sandbox mode, follow the steps outlined below.

The following drawing shows the decision process that Access follows when it encounters an unsafe expression.

Caution      Incorrectly editing the registry may severely damage your operating system, requiring you to reinstall it. Microsoft cannot guarantee that problems resulting from editing the registry incorrectly can be resolved. Before editing the registry, back up any valuable data. For the most recent information about using and protecting your computer's registry, see Microsoft Windows Help.

If you are not familiar with the registry, or you are not comfortable with changing registry keys yourself, ask for help from someone who is familiar and comfortable with changing the registry. You must have administrator permissions on the computer to change the registry values.

Top of Page

Disable sandbox mode (run unsafe expressions)

You disable sandbox mode in Access 2010 by changing the value of a registry key.

Caution      Incorrectly editing the registry may severely damage your operating system, requiring you to reinstall it. Microsoft cannot guarantee that problems resulting from editing the registry incorrectly can be resolved. Before editing the registry, back up any valuable data. For the most recent information about using and protecting your computer's registry, see Microsoft Windows Help.

Change the registry key

Important: Following these steps allows unsafe expressions to run in all instances of Access for all users on the computer.

1. Close all instances of Access that are running on the computer for which you want to disable sandbox mode.

2. Do one of the following:

   • In Windows 7 or Windows Vista    

     1. Click the Start button , point to All Programs, click Accessories, and then click Run.

     2. In the Open box, type regedit and then press ENTER.

        The Registry Editor starts.

     3. Expand the HKEY_LOCAL_MACHINE folder and navigate to the following registry key:

        \Software\Microsoft\Office\14.0\Access Connectivity Engine\Engines

     4. In the right pane of the registry editor, under Name, double-click SandboxMode.

        The Edit DWORD Value dialog box appears.

     5. In the Value Data field, change the value from 3 to 2, and then click OK.

     6. Close the Registry Editor.

   • In Microsoft Windows XP or Microsoft Windows Server 2003    

     1. On the taskbar click Start, and then click Run.

     2. In the Open box, type regedit and then press ENTER.

        The Registry Editor starts.

     3. Expand the HKEY_LOCAL_MACHINE folder and navigate to the following registry key:

        \Software\Microsoft\Office\14.0\Access Connectivity Engine\Engines

     4. In the right pane of the registry editor, under Name, double-click SandboxMode.

        The Edit DWORD Value dialog box appears.

     5. In the Value Data field, change the value from 3 to 2, and then click OK.

     6. Close the Registry Editor.

Important: Remember that if you do not first enable the content in the database, Access disables any unsafe expressions regardless of whether you change this registry setting.

You can set the registry value to the following values, with 0 (zero) being the most permissive and 3 being the least permissive.

Setting	Description
0	Sandbox mode is disabled at all times.
1	Sandbox mode is used for Access, but not for non-Access programs.
2	Sandbox mode is used for non-Access programs, but not for Access.
3	Sandbox mode is used at all times. This is the default value, set when you install Access.

Top of Page