AD RMS Client Requirements
Applies To: Windows Server 2008, Windows Server 2008 R2
Working with the AD RMS Client
The Active Directory Rights Management Services (AD RMS) client is included with the Windows Vista®, Windows® 7, Windows Server® 2008, and Windows Server® 2008 R2 operating systems. If you are using Windows XP, Windows 2000, or Windows Server 2003 as your client operating system, a compatible version of the AD RMS client is available for download from the Microsoft Download Center Web site.
The AD RMS client can be used with the AD RMS server role included in Windows Server 2008 and Windows Server 2008 R2 or with previous versions of RMS running on Windows Server 2003.
The AD RMS client creates a machine certificate, which is used to identify the lockbox that stores the key pair for the current user. You can verify the presence of the AD RMS client on a computer by finding the msdrm.dll file on the computer. This file is protected by Windows Resource Protection in Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 and cannot be modified except through official Microsoft updates.
Note
The lockbox contains the computer’s private key and is the core client-side security component for encryption and decryption. The machine certificate contains a corresponding public key for the computer. The lockbox is originally created when the client is activated. When the lockbox is loaded, it will perform its functions only if it determines that the client system has not been altered to a significant degree. For example, if the client’s clock has been moved backward or forward, the lockbox will fail to unlock protected content. If the client systems hardware has changed to any significant degree, the lockbox will also fail. In such cases, the lockbox will be marked damaged, and the client will have to reactivate the computer. For more information about lockboxes, see Lockboxes (https://go.microsoft.com/fwlink/?LinkId=153480) in the ADRMS SDK in the MSDN Library.
Applications can use the AD RMS client to incorporate rights management features. For example, Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, and Windows Mobile 6 use the AD RMS client to support the information rights management features that provide rights management for documents, e-mails, spreadsheets, and slide presentations.
AD RMS Client Requirements
Beginning with Windows Vista and Windows Server 2008, the name of the AD RMS client has changed to Active Directory Rights Management Services (AD RMS) client and is integrated into the operating system so that a separate installation is not required. In earlier versions of Windows, the client is named Microsoft Windows Rights Management Services (RMS) client and is available from the Microsoft Download Center as a separate downloadable component. The RMS client can be installed on the Windows 2000, Windows XP, and Windows Server 2003 operating systems.
The AD RMS client requires little interaction from the client computer administrator. However, in more complex environments, it might be necessary to adjust the default AD RMS client configuration. A later section of this topic contains more information about configuration.
The RMS client supports three different architectures: x86, x64, and Itanium. The following table summarizes the client requirements depending on operating system and architecture.
Windows AD RMS Client
| Operating System | Requirement |
|---|---|
Windows 7, all editions Windows Server 2008 R2, all editions except Core Editions Windows Vista, all editions Windows Server 2008, all editions except Core Editions |
None (already includes AD RMS Client) |
Windows XP SP3 32-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 - x86 (https://go.microsoft.com/fwlink/?LinkID=153244) |
Windows XP SP3 64-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 – x64 (https://go.microsoft.com/fwlink/?LinkID=153470) |
Windows Server 2003 with SP1 32-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 - x86 (https://go.microsoft.com/fwlink/?LinkID=153244) |
Windows Server 2003 with SP1 64-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 – x64 (https://go.microsoft.com/fwlink/?LinkID=153470) |
Windows Server 2003 for Itanium-based systems with SP1 |
Microsoft Windows Rights Management Services Client with Service Pack 2 – IA64 (https://go.microsoft.com/fwlink/?LinkID=153471) |
Windows Server 2003 R2 32-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 - x86 (https://go.microsoft.com/fwlink/?LinkID=153244) |
Windows Server 2003 R2 64-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 – x64 (https://go.microsoft.com/fwlink/?LinkID=153470) |
Windows Server 2003 R2 for Itanium-based systems |
Microsoft Windows Rights Management Services Client with Service Pack 2 – IA64 (https://go.microsoft.com/fwlink/?LinkID=153471) |
Windows Small Business Server 2003 32-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 - x86 (https://go.microsoft.com/fwlink/?LinkID=153244) |
Windows Server 2000 SP4 32-bit Edition |
Microsoft Windows Rights Management Services Client with Service Pack 2 - x86 (https://go.microsoft.com/fwlink/?LinkID=153244) |
AD RMS Service Discovery
Active Directory Rights Management Services (AD RMS) client service discovery is the method by which the AD RMS client discovers an AD RMS cluster. There are several ways in which this can occur:
Active Directory Domain Services (AD DS) service connection point (SCP) automatic service discovery. This is the recommended way to deploy an AD RMS environment. In this scenario, an SCP is created in the Active Directory forest where the AD RMS cluster is installed. When the AD RMS client attempts user activation on the computer, it queries the SCP to find the AD RMS cluster and download the rights account certificate (RAC). With automatic service discovery, no additional configuration is required on the AD RMS client.
The AD RMS client retrieves the service location URL from the issuance license and performs a SOAP request to the server, using the service location URL, to obtain the licensing URL. If the request fails, the client performs a SOAP request to obtain the certification URL. Subsequently, the certification URL is modified by replacing /certification with /licensing to retrieve the licensing URL.
AD RMS client registry overrides. In complex AD RMS deployment topologies, more specific control of the AD RMS client is required. For versions of the Rights Management Services (RMS) client running on Windows XP, Windows 2000, or Windows Server 2003, these overrides are required for topologies where multiple Active Directory forests are deployed. Another example of where client registry overrides can be used is to support extranet users. In these cases, client registry overrides are created on the AD RMS client to force either certification or licensing of rights-protected content from an AD RMS cluster that is different from the one published in the SCP. The AD RMS client registry overrides used to override the SCP are created in:
For x86 clients: HKEY_LOCAL_MACHINE\Software\Microsoft\MSDRM\ServiceLocation.
For x64 and Itanium-based clients: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\MSDRM\ServiceLocation.
The client registry override keys are the following:
Activation. This key is used to override the default AD RMS certification service that is configured in the SCP. The syntax for this key is http(s)://<your cluster>/_wmcs/certification where <your cluster> is the URL of the root cluster that should be used for certification.
x86 Example HKLM\Software\Microsoft\MSDRM\ServiceLocation\Activation REG_SZ: default Value: <http(or https)://RMS_Cluster_Name/_wmcs/Certification>EnterprisePublishing. This key is used to override the default AD RMS licensing service to which the AD RMS client connects. The syntax for this key is http(s)://<your cluster>/_wmcs/licensing where <your cluster> is the URL of the licensing-only cluster.
HKLM\Software\Microsoft\MSDRM\ServiceLocation\EnterprisePublishing REG_SZ: default Value: < http(or https)://RMS_Cluster_Name /_wmcs/Licensing>
Note
The client registry overrides are configured as registry keys. The value of these registry keys should be added to the default entry of the registry key of type REG_SZ.
- If the AD RMS client computer is connecting by using a federated trust, you must configure the federation home realm. The registry key is:
**For x86 Clients: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MSDRM\\Federation**
**For x64 and IA64 Clients: HKEY\_LOCAL\_MACHINE\\Software\\Wow6432Node\\Microsoft\\MSDRM\\Federation**
When you use Active Directory Federation Services to allow access to protected documents from a trusted domain or forest, registry keys can set the federation home realm of the client computers in that forest. It must be set to the client’s home AD FS server FQDN and path in clients on the Accounts side of a federation trust.
Within this registry key create a registry entry named FederationHomeRealm of type REG\_SZ. The value of this registry entry is the federation service URI.
<!-- end list -->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDRM\Federation
REG_SZ: FederationHomeRealm
Value: < the federation service URI>
Note
If you use the Federation key, you do not need the MSDRM Service Location keys illustrated above. If you have all three of these registry keys on a single client, this is not supported.
- Active Directory is queried for the certification URL and the URL is modified by replacing /certification with /licensing to retrieve the licensing URL.
For additional information about client deployment, see AD RMS Client Deployment and Usage Considerations (https://go.microsoft.com/fwlink/?LinkId=153481).