7 minhigh
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
AD RMS relies on a non-rotatable 255-year SLC private key accessible to the local AD RMS Service Group, enabling offline decryption of all protected documents without Domain Admin privileges. AD RMS protects documents using AES content keys sealed to a Server Licensor Certificate (SLC) private key. The SLC key is valid for 255 years and cannot be rotated without orphaning existing protected documents. Any domain user can discover the cluster and enumerate templates; AD RMS Service Group members can extract the SLC private key to decrypt all protected content offline.
Sens:7d
IOCs4
2file path2registry key
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Add AD RMS Service Group to privileged-group monitoring and alerting rules
- Audit AD RMS Service Group membership for unauthorized accounts
- Restrict network access to RMS admin endpoints to known admin workstations
- Monitor SQL Server access to the RMS configuration database for non-service accounts
Key Takeaways
- AD RMS is fully supported through Windows Server 2025 despite deprecation guidance.
- The SLC private key is valid for 255 years (2002-2258) and cannot be rotated.
- Any authenticated domain user can discover the RMS cluster and read rights-policy templates via SOAP.
- AD RMS Service Group membership, not Domain Admin, gates access to the SLC private key.
- SharpRMS is a custom C# tool that automates RMS SOAP enumeration and key extraction.
Attack Chain
- Reconnaissance: Any domain user queries AD SCP to discover the RMS cluster URL and SOAP endpoints
- Enumeration: Domain user reads rights-policy templates and SLC certificate chain via SOAP without admin rights
- Privilege Escalation: Attacker obtains AD RMS Service Group membership via compromised service account or member server admin
- Key Extraction: Service Group member queries key protection info and extracts SLC private key from config database
- Offline Decryption: SLC private key unseals content key, unwraps package key, and decrypts document body offline
Affected Systems
- Windows Server 2025 with AD RMS role
- Windows Server 2022 with AD RMS role
- Windows Server 2019 with AD RMS role
- Windows Server 2016 with AD RMS role
- Microsoft Office documents using RMS protection
- Exchange email using IRM protection
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | SharpRMS execution and SOAP calls visible but registry/DPAPI access may not alert by default. |
| Network Visibility | Medium | SOAP over HTTP to RMS endpoints is visible but may blend with legitimate RMS client traffic. |
| Detection Difficulty | Hard | Template enumeration and SCP queries use legitimate RMS protocols indistinguishable from normal client activity without behavioral baselining. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Domain users querying SCP for MSRMRootCluster then accessing admin SOAP endpoints indicate reconnaissance for RMS key extraction (T1018, T1046). | LDAP queries, HTTP access logs for /_wmcs/admin | Reconnaissance | Medium — legitimate RMS clients may query SCP during normal operations |
| Processes reading DPAPI-protected RMS caches in LOCALAPPDATA indicate credential theft for RMS identity impersonation (T1552.001). | EDR file access events, DPAPI access logging | Credential Access | Low — only RMS client and attackers read these caches |
| Service Group members querying keyprotection or clusterinfo endpoints indicate preparation for SLC private key extraction (T1552). | IIS logs for /admin/ endpoints, EDR process command lines | Discovery | Low — admin actions are infrequent and should be baselined |
| Files with OLE headers (D0 CF 11 E0) with .docx extensions on network shares indicate RMS-protected documents being staged for exfiltration (T1005, T1074). | File access logs, EDR file read events | Collection | Medium — legitimate RMS users create and access these files normally |
Required Log Sources
- AD RMS IIS logs
- Windows Security Event Log
- DNS query logs
- LDAP query logs
- SQL Server access logs
- EDR process telemetry
Key Behavioral Indicators
- SharpRMS.exe executing with enum or admin operation arguments
- Processes accessing HKLM\SOFTWARE\Microsoft\MSIPC\ServiceLocation registry key
- HTTP requests to /_wmcs/admin/ endpoints from non-admin workstations
- Domain users requesting template lists via TemplateDistribution.asmx
- Processes reading %LOCALAPPDATA%\Microsoft\DRM\ directory
- Files with .docx extension but OLE compound file magic bytes (D0 CF 11 E0)
Control Gaps
- Standard privileged-group monitoring excludes AD RMS Service Group by default
- AD RMS SOAP traffic over HTTP blends with legitimate client activity
- DPAPI-protected RMS caches lack specialized access monitoring
- RMS template enumeration by non-admin users is not alerted on
- SLC key extraction from config database has no built-in alerting
False Positive Assessment
Medium — RMS client activity and administrative actions use the same SOAP endpoints and protocols as attacker reconnaissance, requiring behavioral baselining to distinguish.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Migrate from AD RMS to Azure Information Protection where feasible
- Enable hardware security module (HSM) protection for the SLC private key if available
- Enforce HTTPS for all RMS SOAP endpoints instead of HTTP
- Segment RMS server and SQL server network access to limit lateral movement
User Protection
- Monitor for credential theft targeting DPAPI-protected RMS caches
- Restrict local administrator rights on RMS member servers
- Deploy EDR rules for SharpRMS and similar RMS enumeration tools
- Audit file shares for RMS-protected documents accessed by unexpected users
Security Awareness
- Train administrators on AD RMS Service Group sensitivity and access risks
- Document incident response procedures for SLC key compromise
- Brief security teams that Domain Admin does not equate to RMS content access
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping21 techniques
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Exfiltration
Tactic
Impact
Plain-Language Summary
Active Directory Rights Management Service (AD RMS) is a Microsoft system that encrypts sensitive documents so only authorized people can read them. The system relies on a single master key that lasts 255 years and cannot be changed. If an attacker gains access to a specific local group on the RMS server, they can steal this master key and decrypt every protected document offline. Organizations using AD RMS should monitor this group and plan migration to Azure Information Protection.
Additional IOCs
- Ips:
10[.]0[.]1[.]40- Lab RMS server VESUVIO IP address10[.]0[.]1[.]60- Lab SQL server BARONE hosting config DB with SLC key10[.]0[.]1[.]10- Lab domain controller BADABING IP address
- Domains:
vesuvio[.]newjersey[.]sopranos[.]local- Lab RMS cluster server hostnamenewjersey[.]sopranos[.]local- Lab Active Directory domain FQDN
- Urls:
hxxp://vesuvio[.]newjersey[.]sopranos[.]local/_wmcs/certification/server.asmx- Endpoint returning SLC certificate chain to any domain userhxxp://vesuvio[.]newjersey[.]sopranos[.]local/_wmcs/licensing/TemplateDistribution.asmx- Template distribution endpoint readable by any domain user
- Registry Keys:
HKLM\SOFTWARE\Microsoft\MSIPC\ServiceLocation- Stores RMS cluster certification and licensing URLs on clientHKCU\Software\Microsoft\Office\*\Common\DRM- Holds RMS client state and DRM configuration per user
- File Paths:
%LOCALAPPDATA%\Microsoft\DRM\- Caches user RAC identity certificate and private key (DPAPI-protected)%LOCALAPPDATA%\Microsoft\MSIPC\- MSIPC client cache including cached use licenses
- Command Lines:
- Purpose: Enumerate RMS cluster info as a domain user | Tools:
SharpRMS.exe| Stage: Reconnaissance |SharpRMS.exe enum - Purpose: Retrieve cluster configuration as Service Group member | Tools:
SharpRMS.exe| Stage: Reconnaissance |SharpRMS.exe admin /operation:clusterinfo - Purpose: Check SLC private key protection status | Tools:
SharpRMS.exe| Stage: Reconnaissance |SharpRMS.exe admin /operation:keyprotection - Purpose: Enumerate rights-policy templates via admin endpoint | Tools:
SharpRMS.exe| Stage: Reconnaissance |SharpRMS.exe admin /operation:templates
- Purpose: Enumerate RMS cluster info as a domain user | Tools:
- Other:
DRMS_Config_vesuvio_newjersey_sopranos_local_80- Configuration database storing SLC key and templatesDRMS_Logging_vesuvio_newjersey_sopranos_local_80- Logging database tracking all license requests with user and host data
Showing defanged values
- file_path%LOCALAPPDATA%\Microsoft\DRM\Caches user RAC identity certificate and private key (DPAPI-protected)
- file_path%LOCALAPPDATA%\Microsoft\MSIPC\MSIPC client cache including cached use licenses
- registry_keyHKCU\Software\Microsoft\Office\*\Common\DRMHolds RMS client state and DRM configuration per user
- registry_keyHKLM\SOFTWARE\Microsoft\MSIPC\ServiceLocationStores RMS cluster certification and licensing URLs on client