The location for the back-end sounds fine. Make sure that each user has a
minimum of Read, Write and eXecute on the folder where the back-end database
exists. For that matter, they should also have Delete (althought that's not
mandatory). This is the case even if you want them only to have read access
to the data: Access creates a locking file (.ldb or .laccdb) in the folder
where the database exists, and they need the ability to do that.
Passwords can be used if you want. To be honest, though, I've never worked
with passwords in Access, so I'm not sure whether anything needs changing to
accomodate them. If you're able to link the front-end to the back-end using
passwords, you'll probably be fine.
[quoted text clipped - 14 lines]
