AD RMS Recon Shows How Domain Users Can Map Protected Content and Service-Group Boundaries
Summary
Part 1 examines AD RMS architecture and shows how ordinary domain users can discover clusters, inspect templates, and identify protected files, while AD RMS Service Group membership exposes the administrative surface tied to the cluster’s long-lived root key.
Key points
- AD RMS remains supported in Windows Server 2025 despite Microsoft recommending migration to Azure Information Protection.
- The Server Licensor Certificate (SLC) private key underpins access to documents protected by an AD RMS deployment; the article says the key has no rotation mechanism.
- An ordinary authenticated domain user can discover the cluster, retrieve its public certificate chain, probe endpoints, and read rights-policy templates.
- Protected Office files use an OLE Compound File format, and their readable publishing licenses can reveal the licensing server, owner, policy, and related metadata.
- AD RMS Service Group membership—not Domain Admin status—is the boundary for the administrative surface described in the lab.
- The article identifies SharpRMS as a tool for enumerating clusters, retrieving templates, and interacting with administrative endpoints.
- The article focuses on discovery and architecture; SLC key extraction and offline document decryption are reserved for Part 2.
Article Details
- Attack Vectors
- A domain user can discover the AD RMS cluster from its Service Connection Point (SCP) in Active Directory and retrieve the cluster location from the RMS client registry.
- An authenticated domain user can probe the cluster's SOAP endpoints and read rights-policy templates through the licensing pipeline; administrative endpoints require AD RMS Service Group membership.
- A member of the AD RMS Service Group can access the administrative SOAP surface. The article describes this as the boundary for reaching the software-protected SLC private key held in the configuration database.
- An attacker with SQL access to the logging database could use license-request records to identify frequent users, machines, and accounts of interest.
- A user-context compromise may expose cached RMS identity material and use licenses protected by user-scope DPAPI.
- Protected Office files can be identified by their OLE Compound File signature, and their publishing licenses reveal metadata such as the licensing server, owner, and applied policy.
- Defensive Notes
- Treat AD RMS Service Group membership as privileged access to the cluster and monitor it explicitly; standard privileged-group monitoring may not include it.
- Protect the configuration database and every backup as sensitive assets because they contain the SLC and other deployment data.
- Where supported by the deployment, use hardware protection for the SLC private key; the article says the described software-based configuration is extractable.
- Review RMS logging for unfamiliar accounts or hosts and unusual license-request volume.
- Protect workstations and user contexts that hold RMS caches, including the DPAPI-protected identity material and cached use licenses.
MITRE ATT&CK
T1018 · Remote System DiscoveryDiscovering the AD RMS cluster by querying its Active Directory Service Connection Point or reading the cluster location from the RMS client registry.T1046 · Network Service DiscoveryProbing the cluster's SOAP endpoints to determine which endpoints are reachable and observe the privilege boundary.T1083 · File and Directory DiscoverySearching shares or mailboxes for RMS-protected files by identifying Office files with the OLE Compound File signature.
People
Vendors
Products
AD RMSThis multi-part series is a practitioner's guide to AD RMS from the ground up. Part 1 explains AD RMS and maps its trust model, showing what a plain domain user can discover from a foothold alone. Later parts show whatAzure Information ProtectionMicrosoft deprecated it in favor of Azure Information Protection but still ships it in Windows Server 2025 for backward compatibility, and it keeps getting security fixes for the life of the OS.Microsoft PurviewThis series covers on-premises AD RMS. It does not apply to Azure Information Protection or Microsoft Purview, whose tenant key is cloud-held, out of reach of the on-premises compromise this series describes. TheWindows ServerMicrosoft deprecated it in favor of Azure Information Protection but still ships it in Windows Server 2025 for backward compatibility, and it keeps getting security fixes for the life of the OS.
Tools
DisARMSPrior work worth naming: DisARMS (Grothe, Mainka, Rösler & Schwenk, WOOT '16, MSRC Case 33210) covered client-side protection removal via the MSIPC SDK, a different surface from the server-side key extraction thisSharpRMSBoth routes mean speaking the RMS SOAP protocol by hand, which is where SharpRMS comes in. SharpRMS is a custom C# post-exploitation tool that speaks the AD RMS SOAP protocol directly, the same web-service calls the RMS