Turn sandbox mode on or off to disable macros

This article explains how to use an Access security feature called sandbox mode. In sandbox mode, Access blocks “unsafe” expressions: any expression that uses functions or properties that could be exploited by malicious users to gain access to drives, files, or other resources for which they do not have authorization. For example, functions such as Kill and Shell could be used to damage data and files on a computer, so they are blocked in sandbox mode.

Note:  This topic does not apply to Access apps or web databases, and does not cover other Access security features. For more information, see the See Also section of this article.

In this article


Disable sandbox mode (run unsafe expressions)


Sandbox mode is a security feature that prevents Access from running certain expressions that could be unsafe. These unsafe expressions are blocked regardless of whether the database has been ‘trusted’ – its content enabled.

How sandbox mode is set

You use a registry key to specify whether Access should run in sandbox mode. Sandbox mode is enabled by default – the registry key value is set to enable sandbox mode when Access is installed on a computer. If you want to allow all expressions to run, you can change the registry key value to disable sandbox mode.

Trusted databases

Regardless of whether sandbox mode is enabled in the registry, Access won’t allow potentially unsafe expressions to run unless the database file either is located in a trusted location, or bears a valid trust signature. If a database isn’t “trusted” Access uses sandbox mode.

The following drawing shows the decision process that Access follows when it encounters an unsafe expression.

The decision process for enabling or disabling sandbox mode

If you are not familiar with the registry, or you are not comfortable with changing registry keys yourself, ask for help from someone who is familiar and comfortable with changing the registry. You must have administrator permissions on the computer to change the registry values.

Top of Page

Disable sandbox mode (run unsafe expressions)

In some installations, you can disable sandbox mode by changing the value of a registry key.

Note:  Not all installations of Access will include the SandBoxMode registry key referred to in the procedure below. If you do not find the registry key, we do not recommend adding it, as it could interfere with Office updates.

Caution      Incorrectly editing the registry may severely damage your operating system, requiring you to reinstall it. Microsoft cannot guarantee that problems resulting from editing the registry incorrectly can be resolved. Before editing the registry, back up any valuable data. For the most recent information about using and protecting your computer's registry, see Microsoft Windows Help.

Change the registry key

Important: Following these steps allows unsafe expressions to run in all instances of Access for all users on the computer.

  1. Close all instances of Access that are running on the computer for which you want to disable sandbox mode.

  2. Press the Windows key, type Run, and press ENTER.

  3. In the Open box, type regedit and then press ENTER.

    The Registry Editor starts.

  4. Expand the HKEY_LOCAL_MACHINE folder and navigate to the following registry key:

    \Software\Microsoft\Office\15.0\Access Connectivity Engine\Engines

  5. In the right pane of the registry editor, under Name, double-click SandBoxMode if it is present. If you don’t find the SandBoxMode registry key, we do not recommend adding it, as it could interfere with Office updates.

    The Edit DWORD Value dialog box appears.

  6. In the Value Data field, change the value from 3 to 2, and then click OK.

  7. Close the Registry Editor.

Important: Remember that if you do not first enable the content in the database, Access disables any unsafe expressions regardless of whether you change this registry setting.

You can set the registry value to the following values, with 0 (zero) being the most permissive and 3 being the least permissive.




Sandbox mode is disabled at all times.


Sandbox mode is used for Access, but not for non-Access programs.


Sandbox mode is used for non-Access programs, but not for Access.


Sandbox mode is used at all times. This is the default value, set when you install Access.

Top of Page

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!