Microsoft Windows Rights Management Services (RMS).ppt

* The SCP record is added to the AD Configuration container, as e.g. CN=SCP,CN=RightsManagementServices,CN=Services,CN=Configuration,DC=contoso,DC=com The SCP record has an attribute “ServiceBindingInformation” whose value is the URL that was specified as the Cluster URL during the provisioning of the Root Certification cluster. * The client also adds the lockbox (secrep.dll) file to %systemroot%\system32, but this occurs during the activation step not during the initial installation of the RMS client. Once the necessary files are installed, the RMS Client will call the actmachine.exe utility to attempt to activate the client machine (more on this on the next slide). * The RMS Client will also attempt this step at the end of the client installation, but if that fails, or if the client machine needs to be re-activated at any time after the initial install, only these steps will occur (and not the installation as well). The RMS Client service discovery will first search the local registry, then the AD (if available), then it will attempt the UDDI lookup for the MSN activation service. HWID (hardware ID) includes unique data such as hard drive geometry, memory size, network interface address. * The user does not have to have special rights or permissions on the client or the server – just a simple Domain User is sufficient. [This assumes that the Certification.asmx page has not been re-ACLd to limit Domain Users from accessing the page.] RAC = RM Account Certificate (aka “GIC” or Group Identity Certificate). This is an XrML file that contains user’s RMS credentials. The “Passport/Windows” question may not be presented to the user if either (a) the option to use Passport has been disabled (e.g. HKCU\Software\Microsoft\Office\11.0\Common\DRM\DisablePassportCertification) or (b) there is no Enterprise RMS server. * Note: Office System 2003 will also request a Client Licensor Certificate (CLC) at this time. * IRM is an Office Professional Edition 2003 feature, so