Active Directory Rights Management Services

Short description: Microsoft server software for information rights management

Active Directory Rights Management Services (AD RMS, known as Rights Management Services or RMS before Windows Server 2008) is a server software for information rights management shipped with Windows Server. It uses encryption and a form of selective functionality denial for limiting access to documents such as corporate e-mails, Microsoft Word documents, and web pages, and the operations authorized users can perform on them. Companies can use this technology to encrypt information stored in such document formats, and through policies embedded in the documents, prevent the protected content from being decrypted except by specified people or groups, in certain environments, under certain conditions, and for certain periods of time. Specific operations like printing, copying, editing, forwarding, and deleting can be allowed or disallowed by content authors for individual pieces of content, and RMS administrators can deploy RMS templates that group these rights together into predefined rights that can be applied en masse.

RMS debuted in Windows Server 2003, with client API libraries made available for Windows 2000 and later. The Rights Management Client is included in Windows Vista and later, is available for Windows XP, Windows 2000 or Windows Server 2003.[1] In addition, there is an implementation of AD RMS in Office for Mac to use rights protection in OS X and some third-party products are available to use rights protection on Android, Blackberry OS, iOS and Windows RT.[2][3]

## Contents

* 1 Attacks against policy enforcement capabilities
* 2 Software support
* 3 See also
* 4 References
* 5 External links

## Attacks against policy enforcement capabilities

In April 2016, an alleged attack on RMS implementations (including Azure RMS) was published and reported to Microsoft.[4][5] The published code allows an authorized user that has been granted the right to view an RMS protected document to remove the protection and preserve the file formatting. This sort of manipulation requires that the user has been granted rights to decrypt the content to be able to view it. While Rights Management Services makes certain security assertions regarding the inability for unauthorized users to access protected content, the differentiation between different usage rights for authorized users is considered part of its policy enforcement capabilities, which Microsoft claims to be implemented as "best effort", so it is not considered by Microsoft to be a security issue but a policy enforcement limitation. Previously the RMS SDK enforced signing of code using the RMS capabilities in order to provide some level of control on which applications interacted with RMS, but this capability was later removed due to its limited ability to restrict such behaviors given the possibility to write applications use the web services directly to obtain licenses to decrypt the content.[6]

In addition, using this same technique, a user that has been granted rights to view a protected document can manipulate the content of the document without leaving traces of the manipulation. Since Azure RMS is not a non-repudiation solution and, unlike document signing solutions, does not claim to provide anti-tampering capabilities, and since the changes can only be made by users that are granted rights to the document, Microsoft does not consider the later issue to be an actual attack against the claimed capabilities of RMS.[7] The researchers provide a proof of concept tool, to allow evaluation of the results, via GitHub.[8]

## Software support

RMS is natively supported by the following products:

* Microsoft Office 2003 and later: Word, Excel, PowerPoint, Outlook, InfoPath[9]
* Microsoft Office for Mac 2011 and later: Word, Excel, PowerPoint, Outlook
* SharePoint 2007 and later
* Exchange Server 2007 and later
* XML Paper Specification (XPS)

Third-party solutions, such as those from Secure Islands (acquired by Microsoft), GigaTrust and Liquid Machines (acquired by Check Point) can add RMS support to the following:

* SharePoint 2003[10][11][12]
* Microsoft Visio
* Microsoft Project[10][12]
* Adobe Acrobat[13][14][12][15]
* Internet Explorer
* IIS 6.0

## See also

* Microsoft Servers

## References

1. ↑ Microsoft Windows Rights Management Services Client with Service Pack 2 - x86
2. ↑ "RMS Viewer | Mobile Rights Management for iPhone, iPad, Android and Blackberry". http://www.rmsviewer.com/.
3. ↑ "GigaTrust for iOS Devices – Expanding the Security for Smart Mobile Devices". http://www.gigatrust.com/ios-devices.shtml.
4. ↑ Mainka, Christian; Grothe, Martin (2016-08-01). "How to Break Microsoft Rights Management Services". Network and Data Security Chair Ruhr-University Bochum. https://web-in-security.blogspot.de/2016/07/how-to-break-microsoft-rights.html.
5. ↑ Mainka, Christian; Grothe, Martin (2016-08-04). "How to Break Microsoft Rights Management Services". USENIX Security Symposium. https://www.usenix.org/conference/woot16/workshop-program/presentation/grothe.
6. ↑ "Creating a Rights Management Manifest". Microsoft. https://msdn.microsoft.com/en-us/library/cc530456(v=vs.85).aspx.
7. ↑ "AD RMS FAQ". Microsoft. 29 July 2013. https://msdn.microsoft.com/en-us/library/cc747757(v=ws.10).aspx.
8. ↑ Mainka, Christian; Grothe, Martin (2016-07-07). "MS-RMS-Attacks". GitHub. https://github.com/RUB-NDS/MS-RMS-Attacks.
9. ↑ "Plan Information Rights Management in Office 2013". https://technet.microsoft.com/en-US/en-en/library/cc179103(v=office.15).aspx.
10. ↑ 10.0 10.1 "Secure Islands - Home". http://www.secureislands.com/.
11. ↑ "Secure Islands - SharePoint Classification and Protection". http://www.secureislands.com/solutions/sharepoint-classification-and-protection.html.
12. ↑ 12.0 12.1 12.2 "GigaTrust Announces Availability of Adobe® Rights-Management Protector for Microsoft® Office SharePoint Server 2007 (MOSS 2007)". http://www.gigatrust.com/news/rms_protect_pdf_files.shtml.
13. ↑ "Secure Islands - IQProtector for Files". http://www.secureislands.com/products/iqprotector-file-protection.html.
14. ↑ "GigaTrust Launches New RMS Desktop PDF Client for Adobe with Comprehensive Reporting, Auditing and Compliance Capability" (Press release).
15. ↑ "PDF Editor Download - Edit Files Online for Free". http://www.foxitsoftware.com/products/rms/.

## External links

* Windows Rights Management Services
* RMS Client downloads
* RMS SDK for RMS-enabling applications
* Troubleshooting Windows Rights Management Services (RMS) - One Root Certification Server Warning
* Active Directory Rights Management - In Summary
* Active Directory Rights Management Services SDK 2.0
* Active Directory Rights Management Services - TechNet
* Active Directory Rights Management Services - MSDN
* Secure Islands IQProtector - Information Protection and Control using Microsoft RMS
* Windows RMS Technical Overview

* v
* t
* e

Microsoft Windows components

Management
tools|

* App Installer
* Command Prompt
* Control Panel
* Applets
* Device Manager
* Disk Cleanup
* Disk Defragmenter
* Driver Verifier
* DxDiag
* Event Viewer
* IExpress
* Management Console
* Netsh
* Performance Monitor
* Recovery Console
* Resource Monitor
* Settings
* Sysprep
* System Configuration
* System File Checker
* System Information
* System Policy Editor
* System Restore
* Task Manager
* Windows Error Reporting
* Windows Ink
* Windows Installer
* PowerShell
* Windows Update
* Windows Insider
* WinRE
* WMI

Apps|

* Alarms & Clock
* Calculator
* Calendar
* Camera
* Character Map
* Cortana
* Edge
* Fax and Scan
* Feedback Hub
* File Manager
* Get Help
* Groove Music
* Magnifier
* Mail
* Messaging
* Maps
* Media Player
* Movies & TV
* Mobility Center
* Money
* News
* Narrator
* Notepad
* OneDrive
* OneNote
* Paint
* Paint 3D
* People
* Phone Companion
* Photos
* Quick Assist
* Snipping Tool
* Speech Recognition
* Skype
* Sports
* Sticky Notes
* View 3D
* Store
* Tips
* Voice Recorder
* Wallet
* Weather
* Windows To Go
* Windows Story Remix
* WordPad
* Xbox Console Companion
* Your Phone

Shell|

* Action Center
* Aero
* AutoPlay
* AutoRun
* ClearType
* Explorer
* Search
* Indexing Service
* IFilter
* Saved search
* Namespace
* Special folder
* Start menu
* Taskbar
* Task View
* Windows Spotlight
* Windows XP visual styles

Services|

* Service Control Manager
* BITS
* CLFS
* Multimedia Class Scheduler
* Shadow Copy
* Task Scheduler
* Error Reporting
* Wireless Zero Configuration

File systems|

* CDFS
* DFS
* exFAT
* IFS
* FAT
* NTFS
* Hard link
* Junction point
* Mount Point
* Reparse point
* Symbolic link
* TxF
* EFS
* ReFS
* UDF

Server|

* Domains
* Active Directory
* DNS
* Group Policy
* Roaming user profiles
* Folder redirection
* Distributed Transaction Coordinator
* MSMQ
* Windows Media Services
* Rights Management Services
* IIS
* Remote Desktop Services
* WSUS
* SharePoint
* Network Access Protection
* PWS
* DFS Replication
* Remote Differential Compression
* Print Services for UNIX
* Remote Installation Services
* Windows Deployment Services
* System Resource Manager
* Hyper-V
* Server Core

Architecture|

* Architecture of Windows NT
* Startup process
* NT
* Vista
* CSRSS
* Desktop Window Manager
* Portable Executable
* EXE
* DLL
* Enhanced Write Filter
* Graphics Device Interface
* hal.dll
* I/O request packet
* Imaging Format
* Kernel Transaction Manager
* Library files
* Logical Disk Manager
* LSASS
* MinWin
* NTLDR
* Ntoskrnl.exe
* Object Manager
* Open XML Paper Specification
* Registry
* Resource Protection
* Security Account Manager
* Server Message Block
* Shadow Copy
* SMSS
* System Idle Process
* USER
* WHEA
* Win32 console
* Winlogon
* WinUSB

Security|

* Security and Maintenance
* AppLocker
* BitLocker
* Credential Guard
* Data Execution Prevention
* Family Safety
* Kernel Patch Protection
* Mandatory Integrity Control
* Protected Media Path
* User Account Control
* User Interface Privilege Isolation
* Windows Defender
* Windows Firewall

Compatibility|

* COMMAND.COM
* Virtual DOS machine
* Windows on Windows
* WoW64
* Windows Subsystem for Linux

API|

* Active Scripting
* WSH
* VBScript
* JScript
* COM
* ActiveX
* ActiveX Document
* COM Structured storage
* DCOM
* OLE
* OLE Automation
* Transaction Server
* DirectX
* .NET Framework
* Universal Windows Platform
* Windows Mixed Reality
* Windows Runtime
* WinUSB

Games|

* Solitaire Collection

Discontinued|

| Games|

* 3D Pinball
* Chess Titans
* FreeCell
* Hearts
* InkBall
* Hold 'Em
* Purble Place
* Reversi
* Spider Solitaire
* Solitaire
* Tinker

|

Apps|

* ActiveMovie
* Anytime Upgrade
* Address Book
* Backup and Restore
* Cardfile
* CardSpace
* CD Player
* Contacts
* Desktop Gadgets
* Diagnostics
* DriveSpace
* DVD Maker
* Easy Transfer
* Fax
* Food & Drink
* Help and Support Center
* Health & Fitness
* HyperTerminal
* Internet Explorer
* Journal
* Media Center
* Meeting Space
* Messaging
* Messenger
* Mobile Device Center
* Movie Maker
* MSN Dial-up
* NetMeeting
* NTBackup
* Outlook Express
* Travel
* Photo Gallery
* Photo Viewer
* Program Manager
* Steps Recorder
* Syskey
* WinHelp
* Write

Others|

* ScanDisk
* File Protection
* Media Control Interface
* Next-Generation Secure Computing Base
* POSIX subsystem
* Interix
* Video for Windows
* Windows SideShow
* Windows Services for UNIX
* Windows System Assessment Tool
* WinFS

Spun off to
Microsoft Store|

* DVD Player
* Hover!
* Mahjong
* Minesweeper

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Active Directory Rights Management Services. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Social:Active_Directory_Rights_Management_Services&oldid=4354026"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template