AD RMS file bulk decryption using PowerShell

Question

We’re in the process of trying to do a bulk decryption of Office files that were encrypted by AD RMS. We've identified a potentially effective PowerShell command, "Unprotect-RMSFile," that could address our decryption needs. We expected this command to be included with the Azure Information Protection Client or the AzureInformation Protection PowerShell module as Microsoft documentation indicates it but it appears to be missing as seen in the screenshot below when we tried to test it. Can you help us find a way or let us know what is the module required to run the command and its requirements?

thumbnail_image001.png

Answer 1

That's an old cmdlet, likely the module version you downloaded does not contain it. Try using the Set-AIPFileLabel cmdlet instead: https://learn.microsoft.com/en-us/powershell/module/azureinformationprotection/set-aipfilelabel?view=azureipps

Answer 2

I’ve successfully managed to address this issue using PowerShell!

The key was utilizing the Azure Information Protection (AIP) client, which provides powerful cmdlets to manage sensitivity labels and file protection. Specifically, I used the Remove-FileLabel cmdlet to remove both sensitivity labels and protection in bulk.

Steps and Explanation

Install the AIP Client Download and install the Microsoft Purview Information Protection client from here. This client provides the necessary tools to manage file protection.

Command: Remove-FileLabel I used the Remove-FileLabel cmdlet to remove labels and decrypt files. Here’s an example:

Remove-FileLabel .\file.docx -RemoveProtection -RemoveLabel -JustificationMessage "Removing labels for migration"

• -RemoveProtection: This parameter removes Rights Management Services (RMS) protection from the file. It’s essential for decrypting AD RMS-encrypted files.
  • -RemoveLabel: Removes any applied sensitivity label. While RMS protection and labels are separate, they often coexist.
    • -JustificationMessage: Adds a message to document the reason for removing protection and labels. This is useful for audit purposes or team transparency.
    Bulk Processing For batch operations, I created a PowerShell script that processes all files in a directory. The script generates reports both before and after the operation, ensuring visibility into the changes. Testing and Validation I used the Get-FileStatus cmdlet to validate the file's status before and after running the Remove-FileLabel command. This ensured that protection and labels were fully removed.

GitHub Repository

I’ve documented the entire process, including example commands, scripts for automation, and detailed explanations, in a GitHub repository. You can find everything you need to replicate this solution there: GitHub Repository: Sensitivity Label Removal with AIP

Feel free to explore the repository, ask questions, or contribute!