Huntress: AD RMS root key (SLC) never expires and cannot be rotated — theft enables permanent, offline decryption of all protected documents

Huntress's two-part research (2026-09-08 and 2026-09-10) shows an ordinary domain account can recon AD RMS deployments and, via four independent server-side paths, extract the Server Licensor Certificate private key — valid 2002–2258 with no rotation…

Huntress published a two-part research series on Active Directory Rights Management Services (AD RMS). Part 1 (2026-09-08) maps the architecture: AD RMS still ships in and remains fully supported through Windows Server 2025 despite Microsoft's deprecation guidance favoring migration to Azure Information Protection, and an ordinary domain account can enumerate RMS clusters and read rights-policy templates. Part 2 (2026-09-10) details the attack: four independent server-side paths extract the Server Licensor Certificate (SLC) private key, which is reachable only by members of the Service Group via the administrative surface and the configuration database (which also stores templates, user keys, and backups). The SLC key is the root of trust for every document a deployment protects, is valid from 2002 to 2258 (255 years), and has no expiry or key-rotation mechanism, so its compromise is permanent and retroactive: the attacker can decrypt all protected content fully offline, indefinitely. Huntress frames SLC compromise as comparable in impact to KRBTGT or the DPAPI domain backup key, while noting it is not equivalent to domain compromise. A tool, SharpRMS, was released, unifying the 2016 DisARMS client-side attacks with the new server-side key extraction and offline decryption capabilities.

• AD RMS ships in and remains fully supported through Windows Server 2025, despite deprecation guidance favoring migration to Azure Information Protection (Huntress, 2026-09-08).
• Reconnaissance from an ordinary domain account can enumerate RMS clusters and read rights-policy templates (Huntress, 2026-09-08).
• The Server Licensor Certificate (SLC) private key is the root of trust for every document an AD RMS deployment protects (Huntress, 2026-09-10).
• The SLC certificate is valid 2002–2258 (255 years) and has no expiry or key-rotation mechanism; compromise is permanent and retroactive.
• Four independent server-side paths can extract the SLC key; only Service Group members can reach the admin surface where the key resides.
• The AD RMS configuration database stores the SLC, rights-policy templates, user keys, and backups, concentrating crown-jewel material.
• A recovered SLC key enables fully offline decryption of protected documents — total persistent decryption access, not domain compromise.
• Huntress compares SLC compromise to KRBTGT and the DPAPI domain backup key in impact, while explicitly noting it is not equivalent to domain compromise.