Copilot is your AI companion
Always by your side, ready to support you whenever and wherever you need it.
RMS Client 2.1 is software designed for your client computers to help protect access to and usage of information flowing through applications that use RMS services in Azure Information Protection and AD RMS on-premises
Important! Selecting a language below will dynamically change the complete page content to that language.
-
File Name:
setup_msipc_x86.exe
setup_msipc_x64.exe
The Rights Management Services Client 2.1 is software designed for your client computers to help protect access to and usage of information flowing through applications that use AD RMS on-premise and with Azure Information Protection.
The RMS Client ships as an optional download which can be, with acknowledgment and acceptance of its license agreement, freely distributed with your third-party software to enable client access content that has been rights protected by use and deployment of RMS services in your environment.
-
Supported Operating Systems
Windows 10, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 11
The following list identifies client and server platforms that can install Active Directory Rights Management Services Client2.1:
- Windows 11
- Windows 10
- Windows Server 2022
- Windows Server 2019
- Windows Server 2016
- Windows Server 2012 R2
-
The RMS Client is contained in a Windows Installer package (.msi) file called Setup.msi. Once downloaded on to your local computer, it can be installed using either of the following installation methods
• Silent mode. By using the /qn switch as part of the command-line options of the Microsoft Windows Installer Tool (Msiexec.exe) you can silently install the RMS Client on client computers.
For example, the following example command shows the silent mode installation (assuming the RMS Client installer package is already downloaded to C:\Downloads) msiexec /qn c:\downloads\setup.msi
• Interactive mode. Alternately, you can install the RMS Client on client computers using the GUI-based interactive setup provided by the RMS Client Installation Wizard. To launch this type of installation you need only double-click on the RMS Client installer package (Setup.msi) in the folder to which it was copied or downloaded on your local computer.
AD RMS Client 2.1 installation package will upgrade RMS Client 2.0 if AD RMS Client 2.0 was already installed on the machine.
From Wikipedia, the free encyclopedia
Active Directory Rights Management Services (AD RMS, known as Rights Management Services or RMS before Windows Server 2008) is a server software for information rights management shipped with Windows Server. It uses encryption and a form of selective functionality denial for limiting access to documents such as corporate e-mails, Microsoft Word documents, and web pages, and the operations authorized users can perform on them. Companies can use this technology to encrypt information stored in such document formats, and through policies embedded in the documents, prevent the protected content from being decrypted except by specified people or groups, in certain environments, under certain conditions, and for certain periods of time. Specific operations like printing, copying, editing, forwarding, and deleting can be allowed or disallowed by content authors for individual pieces of content, and RMS administrators can deploy RMS templates that group these rights together into predefined rights that can be applied en masse.
RMS debuted in Windows Server 2003, with client API libraries made available for Windows 2000 and later. The Rights Management Client is included in Windows Vista and later, is available for Windows XP, Windows 2000 or Windows Server 2003.[1] In addition, there is an implementation of AD RMS in Office for Mac to use rights protection in OS X and some third-party products are available to use rights protection on Android, Blackberry OS, iOS and Windows RT.[2][3]
Attacks against policy enforcement capabilities
[edit]
In April 2016, an alleged attack on RMS implementations (including Azure RMS) was published and reported to Microsoft.[4][5] The published code allows an authorized user that has been granted the right to view an RMS protected document to remove the protection and preserve the file formatting. This sort of manipulation requires that the user has been granted rights to decrypt the content to be able to view it. While Rights Management Services makes certain security assertions regarding the inability for unauthorized users to access protected content, the differentiation between different usage rights for authorized users is considered part of its policy enforcement capabilities, which Microsoft claims to be implemented as «best effort», so it is not considered by Microsoft to be a security issue but a policy enforcement limitation.
Previously the RMS SDK enforced signing of code using the RMS capabilities in order to provide some level of control on which applications interacted with RMS, but this capability was later removed due to its limited ability to restrict such behaviors given the possibility to write applications use the web services directly to obtain licenses to decrypt the content.[6]
In addition, using this same technique, a user that has been granted rights to view a protected document can manipulate the content of the document without leaving traces of the manipulation.
Since Azure RMS is not a non-repudiation solution and, unlike document signing solutions, does not claim to provide anti-tampering capabilities, and since the changes can only be made by users that are granted rights to the document, Microsoft does not consider the later issue to be an actual attack against the claimed capabilities of RMS.[7]
The researchers provide a proof of concept tool, to allow evaluation of the results, via GitHub.[8]
RMS is natively supported by the following products:
- Microsoft Office 2003 and later: Word, Excel, PowerPoint, Outlook, InfoPath[9]
- Microsoft Office for Mac 2011 and later: Word, Excel, PowerPoint, Outlook
- SharePoint 2007 and later
- Exchange Server 2007 and later
- XML Paper Specification (XPS)
Third-party solutions, such as those from Secure Islands (acquired by Microsoft), GigaTrust and Liquid Machines (acquired by Check Point) can add RMS support to the following:
- SharePoint 2003[10][11][12]
- Microsoft Visio
- Microsoft Project[10][12]
- Adobe Acrobat[13][14][12][15]
- Internet Explorer
- IIS 6.0
- Microsoft Servers
- ^ Microsoft Windows Rights Management Services Client with Service Pack 2 — x86
- ^ «RMS Viewer | Mobile Rights Management for iPhone, iPad, Android and Blackberry». Archived from the original on 2013-10-16. Retrieved 2013-10-14.
- ^ «GigaTrust for iOS Devices – Expanding the Security for Smart Mobile Devices». Archived from the original on 2012-10-31. Retrieved 2013-10-14.
- ^ Mainka, Christian; Grothe, Martin (2016-08-01). «How to Break Microsoft Rights Management Services». On Web-Security and -Insecurity. Network and Data Security Chair Ruhr-University Bochum. Retrieved 2016-08-04.
- ^ Mainka, Christian; Grothe, Martin (2016-08-04). «How to Break Microsoft Rights Management Services». WOOT ’16 — 10 USENIX Workshop on Offensive Technologies. USENIX Security Symposium. Retrieved 2016-08-04.
- ^ «Creating a Rights Management Manifest». Microsoft Development Network. Microsoft. Retrieved 2017-10-06.
- ^ «AD RMS FAQ». MicrosoftDocs. Microsoft. 29 July 2013. Retrieved 2017-10-06.
- ^ Mainka, Christian; Grothe, Martin (2016-07-07). «MS-RMS-Attacks». MS-RMS-Attacks. GitHub. Retrieved 2016-08-04.
- ^ «Plan Information Rights Management in Office 2013». TechNet. Retrieved 2015-11-24.
- ^ a b «Secure Islands — Home». Archived from the original on 2013-02-02. Retrieved 2010-07-13.
- ^ «Secure Islands — SharePoint Classification and Protection». Archived from the original on 2013-02-16. Retrieved 2013-01-31.
- ^ a b c «GigaTrust Announces Availability of Adobe® Rights-Management Protector for Microsoft® Office SharePoint Server 2007 (MOSS 2007)». Archived from the original on 2008-05-17. Retrieved 2009-02-18.
- ^ «Secure Islands — IQProtector for Files». Archived from the original on 2013-02-16. Retrieved 2013-01-31.
- ^ «GigaTrust Launches New RMS Desktop PDF Client for Adobe with Comprehensive Reporting, Auditing and Compliance Capability» (Press release).
- ^ «PDF Editor Download — Edit Files Online for Free».
- Windows Rights Management Services
- RMS Client downloads
- RMS SDK for RMS-enabling applications
- Troubleshooting Windows Rights Management Services (RMS) — One Root Certification Server Warning Archived 2009-06-21 at the Wayback Machine
- Active Directory Rights Management — In Summary
- Active Directory Rights Management Services SDK 2.0
- Active Directory Rights Management Services — TechNet
- Active Directory Rights Management Services — MSDN
- Secure Islands IQProtector — Information Protection and Control using Microsoft RMS
- Windows RMS Technical Overview
|
Windows Rights Management Services provide the platform for an organizational rights policy management system. Since this server comp
|
2005 download software
Submit Program | Contact
us
Programs in database: 448502
| Home | Latest | about us | contacts |
Newest
µTorrent 3.4.2.31619
z_o_o_m’s File & Image Uploader 6.4.0
Zulu DJ Software 3.26 Beta
ZPT-Free CRM 1.20
Zortam Mp3 Media Studio PORTABLE 17.50
Zortam Mp3 Media Studio 17.90
Zoom Player Professional 8.6.1 / 8.7.0 Beta 33
Zoom Player MAX 9.1.0
Zoom Player Home Free 9.2.0
Zoom Commander 2.0.1
Most rated
SQL Decryptor 1.1.0
EssentialPIM 2.72 (Freeware)
Web Proxy Checker Pro 1.7.12 Build 224
Alchemy Network Monitor 9.1 (Trial)
µTorrent 3.4.2.31619
z_o_o_m’s File & Image Uploader 6.4.0
Zulu DJ Software 3.26 Beta
ZPT-Free CRM 1.20
Zortam Mp3 Media Studio PORTABLE 17.50
Zortam Mp3 Media Studio 17.90
Home »
Others »
Others / Microsoft Windows Rights Management Services Client with Service Pack 2 — x86
|
|
Related
|
Security for Word 2003 (KB917334) 1 |
|
|||||||||
|
Enfish Find 6.0 |
|
|||||||||
|
Office XP : Small Business Tools 2000 |
|
|||||||||
|
Scrape to PDF 1.0 |
|
|||||||||
|
Techdigm Office 2.1 |
|
|||||||||
Privacy Policy
Terms of Use
Google
FAQ
Home
Software extensions
Drivers Grabber
Introduction
Active Directory Rights Management Services (AD RMS) Data leakage is the unauthorized transmission of information – either to people within the organization or people outside the organization – who should not be able to access that information. One of the major advantages of using AD RMS over other security features such as NTFS permission is that AD RMS permission travels along with the documents.
AD RMS integrates with existing Microsoft products and OS including Windows Server, Exchange Server, SharePoint Server, Microsoft Office Suite and Microsoft Azure.
AD RMS can protect data in transit and at rest. For example, AD RMS can protect documents that are sent as email messages by ensuring that a message cannot be opened even if it is accidentally addressed to the wrong recipient.
When to use AD RMS?
For example, you Finance Manager copies a spreadsheet file containing the compensation packages of an organization’s executives from a protected folder on a file server to the Manager’s personal USB drive. During the commute home, the Manager leaves the USB drive on the train, where someone with no connection to the organization finds it. Without AD RMS, whoever finds the USB drive can open the file. With AD RMS, it is possible to ensure that the file cannot be opened by unauthorized users.
AD RMS uses rights policy templates to enforce a consistent set of policies to protect content. When configuring AD RMS, you need to develop strategies to ensure that users can still access protected content from a computer that is not connected to the AD RMS cluster.
You also need to develop strategies for excluding some users from being able to access AD RMS – protected content, and strategies to ensure that protected content can be recovered in the event that it has expired, the template has been deleted, or if the author of the content is no longer available.
Rights policy templates allow you to configure standard methods of implementing AD RMS policies across the organization.
For example, you can configure standard templates that grant view-only rights, block the ability to edit, save, and print, or if used with Exchange Server, block the ability to forward or reply to messages.
AD RMS templates support the following rights:
Full Control: Gives a user full control over an AD RMS – protected document.
View: Gives a user the ability to view an AD RMS – protected document.
Edit: Allows a user to modify an AD RMS – protected document.
Save: Allows a user to use the Save function with an AD RMS – protected document.
Export: (Save as). Allows a user to use the Save As function with an AD RMS – protected document.
Print: Allows an AD RMS – the protected document to be printed.
Forward: Used with Exchange Server. Allows the recipient of an AD RMS – protected message to forward that message.
Reply: Used with Exchange Server. Allows the recipient of an AD RMS – protected message to reply to that message.
Reply All: Used with Exchange Server. Allows the recipient of an AD RMS–protected message to use the Reply All function to reply to that message.
Extract: Allows the user to copy data from the file. If this right is not granted, the user cannot copy data from the file.
Allow Macros: Allows the user to utilize macros.
View Rights: Allows the user to view assigned rights.
Edit Rights: Allows the user to modify the assigned rights.
For this Demo, as usual, I still am using my existing small Infrastructure which is DC_Server.NewHelpTech.lk and SUB_Server01.NewHelpTech.lk.
1 – Let’s start by Creating AD RMS Service Account on Domain Server (Service account – Microsoft recommends using a standard domain user account with additional permissions. You can use a managed service account as the AD RMS service account).
2 – On the DC-Server server, open Active Directory User & Computers and Create New OU call Service Accounts.
3 – Next, Create New User call ADRMSVC with the complete password.
4 – Next, Create New Group in Users container call ADRMS_SuperUsers and Create another Group call Executives.
5 – Next, Add few users to Executives group, for this Demo I choose My Four of my HR users to join the Executive group.
6 – Next, still on the DC-Server, Open the DNS Manager and Add New Host call ADRMS with SUB-SERVER-01 IP Address, On the DNS Manager, right-click NewHelpTech.lk and click New Host (A or AAAA).
7 – In the New Host box, enter the following information, and then click Add Host:
- Name: ADRMS
- IP address: 172.16.1.200
Click OK, and then click Done.
Orait, we now successfully Add new ADRMS Users & Groups to the AD and also configure DNS so that New ADRMS resource record created.
8 – Next, log in to SUB-SERVER-01.NewHelpTech.lk to start to Install and configure the AD RMS server role.
Open the Server Manager, click Manage, and then click Add Roles and Features, in the Add Roles and Features Wizard, click Next 3 times.
9 – Then click Next 4 times.
10 – Next, click Install to proceed.
11 – Click Close when installation successful.
12 – Next, on the All Servers Task Details page, click Perform Additional Configuration.
13 – In the AD RMS Configuration: SUB_SERVER-01.NewHelpTech.lk box, click Next.
14 – On the AD RMS Cluster box, click Create a New AD RMS root cluster, and then click Next.
15 – On the Configuration Database box, click Use Windows Internal Database on this server, and then click Next to proceed.
16 – On the Service Account page, click Specify, then in the Windows Security box enter ADRMSVC as a Username and enter the password, then click OK and Next.
17 – On the Cryptographic Mode box, click Cryptographic Mode 2, and then click Next.
18 – On the Cluster Key Storage box, click Use AD RMS centrally managed key storage, and then click Next.
19 – On the Cluster Key Password box, enter the password and then click Next.
20 – On the Cluster Web Site box, verify that Default Web Site is selected, and then click Next.
21 – On the Cluster Address box, provide the following information, and then click Next to proceed :
- Connection Type: Use an unencrypted connection (http://)
- Fully Qualified Domain Name: NewHelpTech.lk
- Port: 80
22 – On the Licensor Certificate box, type NewHelpTech ADRMS, and then click Next.
23 – On the SCP Registration box, click Register the SCP now, and then click Next to proceed.
24 – Click Install, and then click Close when installation successful.
25 – Next, open the Internet Information Services (IIS), Manager.
26 – In Internet Information Services (IIS) Manager, expand Sites\Default Web Site and click _wmcs, then under /_wmcs Home, double-click Authentication.
27 – Then right-click Anonymous Authentication and click Enable.
28 – In the Connections pane, expand _wmcs and click licensing and double-click Authentication.
29 – Right-click Anonymous Authentication and click Enable, then close IIS Manager.
“You must sign out before you can manage AD RMS”
Next, let’s configure AD RMS super users group for SUB_SERVER-01.
30 – In Server Manager, click Tools and then click Active Directory Rights Management Services.
31 – In the Active Directory Rights Management Services console, expand the SUB_SERVER-01 node and then click Security Policies.
32 – In the Security Policies area, under Super Users, click Enable Super User.
33 – In the Super Users box, in the Superuser group text box, type ADRMS_Superusers@NewHelpTech.lk, and then click OK.
34 – Open the Active Directory Rights Management Services console, then click Rights Policy Templates node and then in the Actions pane, click Create Distributed Rights Policy Template.
35 – In the Create Distributed Rights Policy Template Wizard box, on the Add Template Identification information box, click Add.
36 – On the Add New Template Identification Information box, enter the following information and then click Add and click Next to proceed.
- Language: English (United States)
- Name: ReadOnly
37 – On the Add User Rights box, click Add, then on the Add User or Group page, type executives@NewHelpTech.lk and then click OK to proceed.
38 – When executives@NewHelpTech.lk is selected, under Rights, click View. Verify that Grant owner (author) full control right with no expiration is selected, and then click Next.
39 – On the Specify Expiration Policy box, choose the following settings and then click Next:
- Content Expiration: Expires after the following duration (days): 14
- Use license expiration: Expires after the following duration (days): 14
40 – On the Specify Extended Policy box, click Require a new use license every time content is consumed (disable client-side caching), click Next, and then click Finish.
“Next step, let’s Configure the rights policy template Distribution”
41 – On the SUB_Server-01, open Windows PowerShell, and type:
New-Item c:\RMSTemplates -ItemType Directory
42 – Next, type:
New-SmbShare -Name RMSTEMPLATES -Path c:\RMSTemplates -FullAccess NewHelpTech\ADRMSVC
43 – Next type:
New-Item c:\DocShare -ItemType Directory
44 – Next type:
New-SmbShare -Name docshare -Path c:\DocShare -FullAccess Everyone
45 – Open the Active Directory Rights Management Services console, click the Rights Policy Templates node, and in the Distributed Rights Policy Templates area, click Change distributed rights policy templates file location, then in the Rights Policy Templates dialog box, click Enable Export.
46 – Next, in the Specify Templates File Location (UNC), type \\SUB_SERVER-01\RMSTEMPLATES, and then click OK.
47 – Next, open Windows Explorer and navigate to the C:\rmstemplates folder, and verify that ReadOnly.xml are Present.
Now, you have successfully configured AD RMS templates.
Verifying AD RMS Client
1 – Switch and sign in to CLIENT-01 as NewHelpTech\A.
2 – Open the Internet options, click the Security tab, click Local intranet, and then click Sites.
3 – Click Advanced, type http://NewHelpTech.lk in the Add this website to the zone and then click Add.
4 – Open a blank Word 2016 document and then type a Descriptive message in the document.
5 – Click Protect Document using the File tab and navigate to Restrict AccessRestricted Access then Connect to Rights Management Services.
6 – Select the Restrict permission to this Document checkbox in the Permission dialog box, and then type B@NewHelpTech.lk in the Read text box.
7 – Type C@NewHelpTech in the Change text box.
8 – Click OK to close the Permission dialog box.
9 – Switch user as NewHelpTech\B and open File Explorer, and then browse to \\SUB_SERVER-01\ADMSV.
11 – Try to open the Test.docx file. Notice the message that displays.
12 – Click View Permission and verify that B user has the view permission.
Good luck! Just give it try – I’m sure you’ll love it as well. If you have any comments or questions on feel free to contact me.
That’s all for now. 🙂