DocRecrypt Guide

Question

I wasn't sure where to share this, if there is a better place i apologise. I would assume others had the same difficulty i had, as the documentation is very fragmented or incomplete, even when searching the internet.

Recently, we had a situation where a user encrypted a word document with a password, left the company and of course, noone could then access the document. So we needed a solution.

DocRecrypt being a microsoft tool, we thought would be the best tool to use. What we did not realise is the nightmare we would have. Nearly all of the online forums, documentation and information shows you how to use the DocRecrypt Tool, but not the pre-requisites you need to perform.

Answer 1

To Answer my own question, and provide guidance to other System Administrators.

I have consolidated my findings in to a simple 7 step poster below to assist other system administrators like myself.

NOTE: The Private Key needs to be imported to the Administrator Endpoint with DocRecrypt installed.

Answer 2

DocRecrypt can only recover passwords for Office documents if it was deployed and configured in advance, before the user encrypted the document. Without that prerequisite, it cannot be used to unlock an already password‑protected Word file.

For Word documents in general:

1. Passwords are case‑sensitive and limited to 15 characters. If a user forgets the password and DocRecrypt was not implemented beforehand, Word cannot recover it.
2. Organizations that want a recovery option must deploy DocRecrypt before users start password‑protecting documents. Only documents encrypted after DocRecrypt is in place can be recovered with it.
3. If DocRecrypt was not deployed in advance, the only options are:
   • Obtain the password from the document owner, or
   • Use other organizational controls (for example, avoid per‑document passwords and instead use access control features such as Information Rights Management or SharePoint/OneDrive/Teams permissions) to prevent this scenario.

For future prevention, consider:

• Using document‑level passwords only when absolutely necessary, and ensuring users understand that if the password is lost, Microsoft cannot retrieve it.
• Implementing DocRecrypt in advance if password‑protected documents are required in the organization. See “Remove or reset file passwords using DocRecrypt” from the referenced article.
• Using managed access controls instead of document passwords, such as:
  • Protecting documents with editing restrictions and authenticated owners.
  • Using Information Rights Management (IRM) to restrict access and actions on documents stored locally or on SharePoint/OneDrive/Teams.

---

References:

• Protect a Word document with a password
• Allow changes to parts of a protected Word document
• Manage access to your Word documents