The application opens but its code does not run
Symptom
A delivered application opens on a user's PC, but nothing of its code happens: the start form shows without its data or stays empty, buttons do nothing, the application model is not applied, WKL controls stay blank. Often there is no message at all; in other cases Access shows the Microsoft Access Security Notice before the database opens.
Environment
Microsoft 365 Access, full version and runtime, 32-bit and 64-bit; ACCDE and ACCDB.
Cause
Access runs the code of a database only when it trusts it. The macro setting of the Trust Center (File › Options › Trust Center › Trust Center Settings › Macro Settings) and the trusted locations decide; what the user sees depends on both and on the kind of file. For an ACCDE and an ACCDB, without and with a trusted location:
| Macro setting | File not in a trusted location | File in a trusted location |
|---|---|---|
| Enable all macros | Code runs | Code runs |
| Disable all macros with notification (the default), ACCDE, full version and runtime | Security notice; after Open the code runs | Code runs, no notice |
| Disable all macros with notification, ACCDB, full version | No notice, only the message bar; code is off until Enable Content | Code runs |
| Disable all macros with notification, ACCDB, runtime | Security notice; after Open the code runs | Code runs |
| Disable all macros except digitally signed macros | No notice, code is off; an ACCDE is not opened at all | Code runs |
| Disable all macros without notification | No notice, code is off; an ACCDE is not opened at all | Code runs |
| Enable all macros or the default, file marked as downloaded from the internet | Notice “Microsoft has blocked macros from running”, code is off - also with Enable all macros | Code runs |
“Not opened at all” means: Access shows its empty window - title Access, the ribbon, no
navigation pane, no document tabs, no start form. The startup properties of the file
(StartUpShowDBWindow, AllowBypassKey and the others) play no part then: a delivered copy for
production and one for administration look the same, and holding Shift while opening changes
nothing. With the code trusted, the
startup properties act: the administration copy shows its navigation pane, the production copy
keeps its start form and hides the pane even with Shift held (AllowBypassKey = False).
A trusted location counts only for files directly in its folder unless Subfolders of this location
are also trusted is set: a front end in ...\Frontends\1.0\ is not trusted by a location
...\Frontends\ without that option. A trusted location acts with every macro setting, and it also
lifts the block of a file downloaded from the internet.
The ActiveX setting of the Trust Center (ActiveX Settings) acts on its own: with Disable all controls without notification the WKL controls stay empty even in a trusted location - the code runs, and creating a WKL control fails with Access error 2926 (the control is disabled by the security settings). The other ActiveX options did not keep the WKL controls from loading in a trusted location.
A script that starts Access on such a file waits in vain: Access with its code off answered a close
request sent to its main window by closing the window, but the process stays. This applies to
Access started hidden and minimized. Check the trust with
Test-AccessTrust.ps1 before a script starts the application.
Resolution
- Find the reason without starting Access: run
tools\deploy\Test-AccessTrust.ps1 -Path <file>of the release package as the user. Its exit code and output name one reason (see `WklTrustCode`); in VBA the same answer comes from `WklApplication.CheckTrust`. - For code 10 (no trusted location covers the file): put the front end into a trusted location with
tools\deploy\Set-AccessTrustedLocation.ps1 -Path <folder>- with-AllowSubfolderswhen the front end sits in a subfolder of that folder, for example one folder per version. - For code 30 (only signed macros allowed): put the file into a trusted location (step 2); a signed VBA project is not read by the check.
- For code 41 (the user's ActiveX setting): in Access, File › Options › Trust Center › Trust Center Settings › ActiveX Settings, choose any option but Disable all controls without notification.
- For code 50 (file from the internet): put the file into a trusted location (step 2), or remove the mark with Properties › Unblock in Explorer or
Unblock-Filein PowerShell. - For a code of a group policy (11, 12, 13, 20, 40): the IT changes the policy or sets the location by policy; the user cannot override it.
- Do not tell users to click Enable Content as the way of working: it acts for this one opening only, and the next start or another user meets the same block.