AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.
Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.
- AD RMS ships and remains fully supported through Windows Server 2025 despite deprecation guidance favoring AIP.
- Reconnaissance from an ordinary domain account can enumerate RMS clusters and read rights-policy templates.
- Server Licensor Certificate is valid 2002–2258 with no mechanism to rotate its private key.
- Four independent key-extraction paths were found; encrypted documents can be decrypted fully offline.
- Configuration database stores the SLC, templates, and user keys, concentrating crown jewels including backups.
- Tags
- active-directoryad-rmsdigital-rights-managementkey-extractionmicrosoftreconnaissancewindows-server
- Organizations
- SANS
From the original article
14 min read at huntress.comActive Directory Rights Management Services still ships in Windows Server 2025, years after Microsoft began steering customers to the cloud, and it remains fully supported on-premises.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.