Restoring access to encrypted files
When files are encrypted, Kaspersky Endpoint Security receives an encryption key required for directly accessing the encrypted files. Using this encryption key, a user working under any Windows user account that was active during file encryption can directly access the encrypted files. Users working under Windows accounts that were inactive during file encryption must connect to Kaspersky Security Center in order to access the encrypted files.
Encrypted files may be inaccessible under the following circumstances:
- The user's computer stores encryption keys, but there is no connection with Kaspersky Security Center for managing them. In this case, the user must request access to encrypted files from the LAN administrator.
If access to Kaspersky Security Center does not exist, you must:
- request an access key for access to encrypted files on computer hard drives;
- to access encrypted files that are stored on removable drives, request separate access keys for encrypted files on each removable drive.
- Encryption components are deleted from the user's computer. In this event, the user may open encrypted files on local and removable disks but the contents of those files will appear encrypted.
The user may work with encrypted files under the following circumstances:
- Files are placed inside encrypted packages created on a computer with Kaspersky Endpoint Security installed.
- Files are stored on removable drives on which portable mode has been allowed.
To gain access to encrypted files, the user needs to start the recovery procedure (Request-Response).
Recovering access to encrypted files consists of the following steps:
- The user sends a request access file to the administrator (see the figure below).
- The administrator adds the request access file to Kaspersky Security Center, creates an access key file and sends the file to the user.
- The user adds the access key file to Kaspersky Endpoint Security and gains access to the files.
Restoring access to encrypted files
To start the recovery procedure, the user needs to attempt to access a file. As a result, Kaspersky Endpoint Security will create a request access file (a file with the KESDC extension), which the user needs to send to the administrator, for example, by email.
Kaspersky Endpoint Security generates a request access file for access to all encrypted files stored on the computer's drive (local drive or removable drive).
How to obtain an encrypted data access key file in the Administration Console (MMC)
- Open the Kaspersky Security Center Administration Console.
- In the console tree, select Devices.
- On the Devices tab, select the computer of the user requesting access to encrypted data and right-click to open the context menu.
- In the context menu, select Grant access in offline mode.
- In the window that opens, select the Data Encryption tab.
- On the Data Encryption tab, click the Browse button.
- In the window for selecting a request access file, specify the path to the file received from the user.
You will see information about the user's request. Kaspersky Security Center generates a key file. Email the generated encrypted data access key file to the user. Or save the access file and use any available method to transfer the file.
Granting access in offline mode
How to obtain an encrypted data access key file in the Web Console
- In the main window of the Web Console, select Devices → Managed devices.
- Select the check box next to the name of the computer whose data you want to restore access to.
- Click the Grant access to the device in offline mode button.
- Select Data Encryption.
- Click the Select file button and select the request access file that you received from the user (a file with the KESDC extension).
The Web Console will display information about the request. This will include the name of the computer on which the user is requesting access to the file.
- Click the Save key button and select a folder to save the encrypted data access key file (a file with the KESDR extension).
As a result, you will be able to obtain the encrypted data access key, which you will need to transfer to the user.
After receiving the encrypted data access key file, the user needs to run the file by double-clicking it. As a result, Kaspersky Endpoint Security will grant access to all encrypted files stored on the drive. To access encrypted files that are stored on other drives, you must obtain a separate access key file for each drive.
Page top