Protect the session as well as the stored file
Encryption at rest does not protect an unlocked workbook, visible preview, clipboard, recent-file list or another user’s active session. Shared PCs require separate accounts, least privilege, locking and cleanup.
Two staff members use one Windows workstation. Each uses a separate account, the migration folder is accessible only to the authorized user, the screen locks automatically, and exports are never left open between sessions.
Use a controlled sequence
- 01Use individual Windows accounts and prohibit shared administrator sessions.
- 02Restrict the migration working folder to authorized users.
- 03Close spreadsheets and lock the session whenever the operator steps away.
- 04Disable unnecessary previews and clear temporary exports only after evidence and backup checks.
- 05Review recent files, Downloads, print queues and removable media before handoff.
Leave evidence without copying secrets
Record the workstation identifier, account owner, folder permissions, session-lock configuration, approved applications and post-session cleanup result.
Pause and review when
- Everyone uses the same Windows login.
- The protected file is open while an unauthorized person uses the workstation.
- Passwords are copied through persistent clipboard-history or chat tools.
Encrypted files are not a password manager
Encrypted-file storage is not password autofill, browser sync or a general credential manager. Match the system to the user task and test recovery before removing the source.
Run the final independent check
Before returning the shared computer to general use, sign out of cloud services, close the workbook, lock the archive, clear only authorized temporary material and verify that another standard user cannot browse the working folder. Review printer, clipboard and recent-file behavior under local policy. If the device cannot provide separate identities and restricted storage, move the migration to a controlled workstation.
Resolve these before acting
Does locking the encrypted container protect an already exported copy?
No. Every plaintext export, temporary file and open application must be handled separately.
Should clipboard history be used for passwords?
Avoid workflows that leave secrets in persistent clipboard history. A password manager’s autofill is designed to reduce manual exposure.
Sources for this decision
- CISA: use a password manager for strong, unique passwords
- NIST SP 800-63B: authentication and authenticator management
Links support the specific decision on this page and do not imply endorsement. Organizational policy and qualified advice control the real migration.