Set up a Super Users Group
Applies To: Windows Server 2008
The AD RMS super user group is a special group that has full control over all rights-protected content managed by the cluster. Its members are granted full owner rights in all use licenses that are issued by the AD RMS cluster on which the super users group is configured. This means that members of this group can decrypt any rights-protected content file and remove rights-protection from it.
The super users group is not enabled and is not assigned a group by default. When you enable the Super Users setting in the Active Directory Rights Management Services console, you can specify an Active Directory Domain Services (AD DS) universal group to use as the super users group for AD RMS. The group must exist in the same forest as the AD RMS installation. Any user accounts that are members of the group that you specify as the AD RMS super users group are automatically granted the permissions of the super users group.
Warning
Enabling the super users group should be done only on an as-needed basis. During normal operations, the super users group should be disabled, unless it is used to provide a trusted application with the ability to decrypt rights-protected content, such as to enable the application to scan the content for malware. It should be enabled only when necessary.
Membership in the local AD RMS Enterprise Administrators, or equivalent, is the minimum required to complete this procedure.
To set up a super users group
Open the Active Directory Rights Management Services console and expand the AD RMS cluster.
In the console tree, expand Security Policies, and then click Super Users.
In the Actions pane, click Enable Super Users.
In the results pane, click Change Super User Group to open the Super Users properties sheet.
In the Super user group box, type the e-mail address of an existing group in the Active Directory forest, or click Browse to navigate through the defined users and groups in the directory.
Click OK.