You can create a database property named AllowBypassKey and set its value to
False.

See http://www.mvps.org/access/general/gen0040.htm at "The Access Web" for
the correct way to create this property.

However, I always cringe when people suggest using an environment variable
for this purpose, given how easy it is to reset an environment variable. All
a determined student needs to do is:

1. Open a command prompt ("DOS Box")
2. Type Set Username = xxx (where xxx is the ID of a staff member)
3. While still in the same command prompt, start the application (<full path
to msaccess.exe> <full path to database>). Environ("Username") will return
xxx

(Of course, should the student start the application outside of that command
prompt, Environ("Username") will be correct)

Far safer, in my opinion, is to use the GetUserName API call. See
http://www.mvps.org/access/api/api0008.htm at "The Access Web" for a
complete sample.