Event ID 208 — AD RMS Cluster Configuration

Applies To: Windows Server 2008

Servers in an Active Directory Rights Management Services (AD RMS) cluster are configured to both send and receive requests from AD RMS clients, other servers in the AD RMS cluster, and the AD RMS databases.

Event Details

Resolve

Disable anonymous authentication on servicelocator.asmx or enable AD FS UPN and E-mail claims

Use the following sections to disable anonymous authentication on an AD RMS entry point, enable an AD FS UPN claim, and enabled an AD FS E-mail claim.

To perform these procedures, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

Disable anonymous authentication on servicelocator.asmx

To disable anonymous authentication on servicelocator.asmx:

1. Log on to the AD RMS server.
2. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
3. Expand the local computer node, and then expand Sites.
4. Expand Default Web Site, expand _wmcs.
5. Right-click Certification, and then click Switch to Content View.
6. Right-click ServiceLocator.asmx, and then click Switch to Features View.
7. Double-click Authentication.
8. Right-click Anonymous Authentication, and then click Disable.
9. Repeat steps 4 - 8 for each instance of servicelocator.asmx located in the AD RMS virtual directory.
10. Repeat steps 1 - 9 for each server in the AD RMS cluster.

Enable an AD FS UPN Claim

To enable an AD FS UPN Claim:

1. Log on to the AD FS server.
2. Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
3. Expand Trust Policy, and then expand Partner Organizations.
4. Click the account partner, right-click User Prinicipal Name, and then click Properties.
5. Select the Enabled check box.
6. Select the Accept some domain suffixes option.
7. In the Specify accepted domains box, type the domain suffix of each user domain that should be able to consume rights-protected content on a new line, and then click OK.

Enable an AD FS E-mail Claim

To enable an AD FS E-mail Claim:

1. Log on to the AD FS server.
2. Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
3. Expand Trust Policy, and then expand Partner Organizations.
4. Click the account partner, right-click E-mail, and then click Properties.
5. Select the Enabled check box.
6. Select the Accept some domain suffixes option.
7. In the Accepted domains box, type the accepted domain of each user domain that should be able to consume rights-protected content on a new line, and then click OK.

Verify

To perform this procedure, you must be a member of the local Users group, or you must have been delegated the appropriate authority.

Note: Microsoft Office Word 2007 is used as an example in this section. Any AD RMS-enabled application can be used in place of Word 2007.

To verify that AD RMS is configured correctly, do the following:

1. Log on to an AD RMS-enabled client computer.
2. Click Start, point to All Programs, point to Microsoft Office, and then click Microsoft Office Word 2007.
3. In the new document type This is a test document.
4. Click the Microsoft Office Start Button, point to Prepare, point to Restrict Permissions, and then click Restricted Access.
5. Select the Restrict permissions to this document check box.
6. Type another AD RMS user's e-mail address in the Read box, and then click OK.
7. Send this file to the person who was granted access in step 6.
8. Have this person open the document and verify that he or she cannot do anything else with the document such as print it.

Related Management Information

AD RMS Cluster Configuration

Active Directory Rights Management Services