Full Report
Active Directory Rights Management Services still ships in Windows Server 2025, years after Microsoft began steering customers to the cloud, and it remains fully supported on-premises. Part 1 maps the AD RMS trust model (the Server Licensor Certificate, the license flow, the SOAP surface) and shows how to discover an RMS deployment, fingerprint an AD RMS-protected file, and trace the path to that certificate's private key.
Analysis Summary
# Research: AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
## Metadata
- **Authors:** Andrew Schwartz
- **Institution:** Huntress
- **Publication:** Huntress Blog
- **Date:** September 8, 2024
## Abstract
This research provides a comprehensive technical analysis of Active Directory Rights Management Services (AD RMS), a legacy document protection framework still supported in Windows Server 2025. Part 1 of this series maps the AD RMS trust model, detailing how the system utilizes a non-rotatable Server Licensor Certificate (SLC) as its root of trust. The research demonstrates how an attacker with standard domain user privileges can perform reconnaissance to discover RMS deployments, fingerprint protected files, and identify the architectural path to the environment's master private key.
## Research Objective
The research aims to answer:
1. Why does AD RMS persist in modern environments despite the push toward cloud-based Azure Information Protection?
2. How does the AD RMS trust model function at a technical level?
3. How can a standard, unprivileged domain user discover and map an AD RMS infrastructure?
## Methodology
### Approach
The researcher employed a "bottom-up" architectural analysis, starting with a fresh installation of the AD RMS server role in a lab environment. The methodology involved:
- **Deconstruction:** Breaking down the SOAP-based communication and license flow.
- **Reconnaissance Mapping:** Identifying how AD RMS publishes its existence via Active Directory Service Connection Points (SCPs).
- **Reverse Engineering:** Analyzing how file headers (fingerprinting) link back to specific server clusters.
### Dataset/Environment
- A lab environment featuring Windows Server (up to version 2025) and Active Directory.
- Standard domain user accounts (no administrative privileges).
### Tools & Technologies
- Windows Server 2025 (AD RMS Role).
- Active Directory Service Connection Points (SCP).
- SOAP (Simple Object Access Protocol) for web service analysis.
- Cryptographic certificates (XrML/X.509).
## Key Findings
### Primary Results
1. **Persistence of Legacy Tech:** AD RMS remains supported for backward compatibility because migrating encrypted document stores is high-risk and complex.
2. **The "Forever" Key:** The root of trust (Server Licensor Certificate) is valid for 255 years (expiring in 2258) and cannot be rotated without orphaning every document encrypted under it.
3. **Low-Privilege Discovery:** AD RMS servers publish their location in Active Directory, allowing any domain user to locate the cluster and its associated protection templates.
### Supporting Evidence
- The research notes the SLC validity period (2002–2258) as a hardcoded architectural reality in AD RMS deployments.
- Demonstration of SCP queries that return the cluster's certification and licensing URLs without requiring elevated permissions.
### Novel Contributions
- Systematic mapping of the AD RMS "attack surface" from the perspective of a modern threat actor.
- Identification of the "Service Group" as a high-value, often ungoverned target for lateral movement and data exfiltration.
## Technical Details
AD RMS relies on a chain of trust involving:
- **The SLC (Server Licensor Certificate):** The self-signed root certificate for the RMS cluster.
- **The Master Key:** The private half of the SLC key pair. This key is used to sign all other certificates and, ultimately, to protect the content keys of every document in the enterprise.
- **SOAP Interface:** AD RMS exposes several web services (Certification, Licensing, Administration) via IIS. These services handle requests for User Certificates (RACs) and Client Licensor Certificates (CLCs).
## Practical Implications
### For Security Practitioners
- **Visibility:** Practitioners must realize that AD RMS represents a "single point of failure." If the master private key is compromised, all historical and future documents are at risk.
- **Asset Inventory:** Many organizations may have AD RMS running silently; it should be identified and audited.
### For Defenders
- **Service Group Governance:** Monitor and restrict membership in the AD RMS Service Group, as this group typically has the permissions required to access the master key.
- **SCP Monitoring:** Audit lookups to the AD RMS Service Connection Point in Active Directory to detect unauthorized reconnaissance.
### For Researchers
- The study opens avenues for exploring offline decryption tools once the SLC private key is extracted (the focus of Part 2).
## Limitations
- This paper (Part 1) focuses on architecture and discovery; the actual exploitation and key extraction mechanisms are reserved for the subsequent part of the series.
- The research assumes an internal foothold (domain user access).
## Comparison to Prior Work
While AD RMS is an older technology, recent cybersecurity research has largely focused on its successor, Azure Information Protection (AIP). This research fills a gap by applying modern "adversary tradecraft" to a legacy service that is still prevalent in air-gapped or conservative enterprise environments.
## Real-world Applications
- **Incident Response:** Helping IR teams understand how an attacker might have decrypted "protected" files.
- **Red Teaming:** Providing a new vector for data exfiltration that bypasses traditional file-level permissions.
## Future Work
- Analysis of automated tools for SLC private key extraction.
- Methods for offline decryption of Office documents using stolen RMS keys.
- Exploration of vulnerabilities within the SOAP-based web services.
## References
- Microsoft Documentation: AD RMS Overview.
- Related Research: [huntress[.]com/blog/ad-rms-architecture-and-recon]