How can one remove the saved username and password from ArcGIS layer (.lyr) files?

A scripted solution preferred but even a point and click method will be welcome.

3 Answers 3


Since 'even a point-and-click method is welcome' I am submitting the following which I use to clear out (or even re-assign) username/passwords from layerfiles and from layers within an MXD. This solution is based on ArcCatalog Version

Step 1: Open ArcCatalog, navigate to the folder containing the objective layer file, and right-click Properties to verify the current connection details saved in the layer file.

Step 2: Exit the Properties dialog, then add the layerfile to a new MXD and save the MXD somewhere convenient. I placed the MXD into the same folder path for now. Right-click on the MXD and choose 'Set Data Sources' (yes, I am borderline-ashamed to describe this sequence of steps because of how convoluted they are...but the steps work to reset the connection.)

Step 3: In the Set Data Sources dialog, choose "Replace All" as there is only one layer in the MXD. In the Replace All dialog, select and blank out the contents of the 'Replace with' line. then click the Replace All button. OK out of the Set Data Sources dialog and NOTICE that a new MXD has been created in the same location.

Step 4: Open the new MXD and immediately save the single layer as a new layer file.

Be sure to cancel out of any connection dialog boxes that appear as you open the new dialog <-- canceling out of these dialogs is important because your objective is to 'clear out' the connection, not re-assign it to a new set of credentials. (Notice in the image the red exclamation on the Table of Contents identifies a layer without connection credentials.)

Step 5: Return to Catalog, refresh the folder, then right-click on the newly-created layerfile to reveal its empty (cleared out) connection properties.

Again, it's not a perfect method by any means, but it does work to clear out the connection username and password from a layer file.

UPDATE: In order to get the connection unchanged, but to null out the username/password, perform this additional step BEFORE any replacement is made: Add a new database connection being sure to uncheck the save username/password box:

Then, in Step 3 during the Replace All action in the Set Data Source dialog, input the path of the newly-created connection so it can be used as the replacement:
Move on to Steps 4 and 5 as normal and you will notice the connection is correctly saved, but the username/password has been blanked out. -- and thanks everyone for the comments to help clarify objectives.

  • But The person who asked the question commented that he doesn't want to remove the workspace reference. he just needs to remove user name and password. you workflow can accomplish this behaviour by replacing the sde connection file one with no username and password. Jan 14, 2015 at 7:39
  • Yes..a replacement to the same connection without a username is exactly the same process... Jan 14, 2015 at 14:46
  • giving the bounty here, for exceptional clarity about a process that works, albeit unavoidably roundabout. The process can be recast in a script a la @Farid's answer, which is what I'll probably actually end up using with some simplification. The effort put in to this answer is commendable (though personally I tend to shy from screenshot heavy treatments). Jan 14, 2015 at 17:38

the solution to your question depends on the type of the layer. If the layer points to a geodataset in an sde connection file, Here is a quick solution. This script is doing the following tasks:

1- check the datasoure source to find the sde connection file

2- create a new connection file from previous one without the option to save username and password

import arcpy
import os.path
from shutil import copyfile

inLayer = r"d:\inLayer.lyr"
outLayer =r"d:\outLayer.lyr"
theLayer = arcpy.mapping.Layer(inLayer)
wspath =  theLayer.workspacePath

baseName = os.path.basename(wspath)
dirName = os.path.dirname(wspath)

    desc =  arcpy.Describe(ws)
    cp =  desc.connectionProperties

    if cp.authentication_mode == 'OSA':
        authType  = ''
    else: #DBMS
        authType = 'DATABASE_AUTH'

    sp = cp.instance.split(':') #'sde:postgresql:localhost'
    if len(sp) >1:
        db_platform = sp[1].upper()
        print 'cant find db platform'

    #Sqlserver must become sql_server
    if db_platform == 'SQLSERVER':
        db_platform = 'SQL_SERVER'

    version1 = ''
    version_type = ''

    if hasattr(cp, 'historical_name'):
        version_type = "HISTORICAL"
        version1 = cp.historical_name
    elif hasattr(cp, 'historical_timestamp'):
        version_type = "POINT_IN_TIME"
        version1 = cp.historical_timestamp
    elif hasattr(cp, 'version'):
        version_type = "TRANSACTIONAL"
        version1 = cp.version
        print 'cant find version info'

    print "removing sde conneciton file..."
    #backup connection file
    copyfile(wspath, wspath+"_Back")
    print "creating new sde connection file"
    r = arcpy.CreateDatabaseConnection_management(dirName,
                                              "#", #for oracle database = schema, from instance
                                              "#" # "5/19/2011 8:43:41 AM"
    #remove the backup file

except Exception as e:
    print 'error,'+str(e)
  • I don't need to remove the workspace, I need to keep the workspace, while removing the stored username and password. Jan 11, 2015 at 7:42
  • Then you need to clear username and password from the sde connection file that the layer points to. Since I can't find a method in arcpy to do so, you can achieve this effect by: 1- find the sde connection file of the layer. 2- create a new sde connection file without storing password (save_user_pass parametere) 3- remove the original connection file If you need a working script, I am ready to do that for you. Jan 11, 2015 at 7:52
  • 2
    I don't believe it's that simple. I'm not 100% sure for lyr files, but I know for MXDs, ArcGIS copies the credentials into the MXD completely. If you delete the connection file it got them from or move to a new machine without a connection file in the same path, the MXD still connects because the credentials are stored inside it. Which is horrific from any security perspective.
    – jpmc26
    Dec 11, 2018 at 19:23

I've used the script linked below with fairly good success. I'm able to select, and repoint multiple lyrfiles to a separate database connection. It seems to choke on Annotation, and Grouped lyrfiles, but the time this saves makes it worth using.

I'm able to re-source an lyrfile from a database connection containing user information, to one with a partial connection. Now when a user tries to use one of these lyrfiles, they are prompted for a password. Note: ArcGIS typically holds user information during a session, so it's a good idea to shut down all your windows, and reopen ArcGIS to properly test.


  • 1
    This answer is link only, and the link has rotted.
    – jpmc26
    Dec 11, 2018 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.