Protecting Excel and Word Documents

Protecting Word Documents

Microsoft Word supports three levels of document protection. The user who creates a document has read/write permission to a document and controls the protection level. The three levels of document protection are:

• File open protection

  Word requires the user to enter a password to open a document.

• File modify protection

  Word requires the user to enter a password to open the document with read/write permission. If the user clicks Read Only at the prompt, Word opens the document as read-only.

• Read-only recommended protection

  Word prompts the user to open the document as read-only. If the user clicks No at the prompt, Word opens the document with read/write permission, unless the document has other password protection.

Word encrypts password-protected documents by using the symmetric encryption routine known as RC4. Because protected documents are encrypted, they are not indexed by Find Fast or by the Microsoft Office Server Extensions (OSE) search feature.

Note   Strong encryption such as RC4 is banned in France. If a user’s locale setting in Regional Settings in Control Panel is set to French (Standard), that user is not able to open an Office document that is password protected. Nor can the user save an Office document with RC4 encryption. The user can, however, use XOR encryption by saving an Office document with password protection.

In addition to protecting an entire document, you can also protect specific elements from unauthorized changes. This method is not as secure as using a password to protect the entire document because Word does not use encryption when you protect only specific elements.

For example, field codes can be viewed in a text editor such as Notepad even if forms or sections of a document are protected.

The specific elements that you can protect in a document include the following:

• Tracked changes

Changes made to the document can be neither accepted nor rejected, and change tracking cannot be turned off.

• Comments

Users can insert comments into the document but cannot change the content of the document.

• Forms or sections

Users can make changes only in form fields or unprotected sections of a document.

Caution   If a user assigns password protection to a document and then forgets the password, you cannot open the document, gain access to its data in another document through links, remove protection from the document, or recover data from the document. Advise your users to keep a list of passwords and corresponding document names in a safe place.