AD RMS Client Requirements

Applies To: Windows Server 2008, Windows Server 2008 R2

Working with the AD RMS Client

The Active Directory Rights Management Services (AD RMS) client is included with the Windows Vista®, Windows® 7, Windows Server® 2008, and Windows Server® 2008 R2 operating systems. If you are using Windows XP, Windows 2000, or Windows Server 2003 as your client operating system, a compatible version of the AD RMS client is available for download from the Microsoft Download Center Web site.

The AD RMS client can be used with the AD RMS server role included in Windows Server 2008 and Windows Server 2008 R2 or with previous versions of RMS running on Windows Server 2003.

The AD RMS client creates a machine certificate, which is used to identify the lockbox that stores the key pair for the current user. You can verify the presence of the AD RMS client on a computer by finding the msdrm.dll file on the computer. This file is protected by Windows Resource Protection in Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 and cannot be modified except through official Microsoft updates.

Applications can use the AD RMS client to incorporate rights management features. For example, Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, and Windows Mobile 6 use the AD RMS client to support the information rights management features that provide rights management for documents, e-mails, spreadsheets, and slide presentations.

AD RMS Client Requirements

Beginning with Windows Vista and Windows Server 2008, the name of the AD RMS client has changed to Active Directory Rights Management Services (AD RMS) client and is integrated into the operating system so that a separate installation is not required. In earlier versions of Windows, the client is named Microsoft Windows Rights Management Services (RMS) client and is available from the Microsoft Download Center as a separate downloadable component. The RMS client can be installed on the Windows 2000, Windows XP, and Windows Server 2003 operating systems.

The AD RMS client requires little interaction from the client computer administrator. However, in more complex environments, it might be necessary to adjust the default AD RMS client configuration. A later section of this topic contains more information about configuration.

The RMS client supports three different architectures: x86, x64, and Itanium. The following table summarizes the client requirements depending on operating system and architecture.

Windows AD RMS Client

AD RMS Service Discovery

Active Directory Rights Management Services (AD RMS) client service discovery is the method by which the AD RMS client discovers an AD RMS cluster. There are several ways in which this can occur:

• Active Directory Domain Services (AD DS) service connection point (SCP) automatic service discovery. This is the recommended way to deploy an AD RMS environment. In this scenario, an SCP is created in the Active Directory forest where the AD RMS cluster is installed. When the AD RMS client attempts user activation on the computer, it queries the SCP to find the AD RMS cluster and download the rights account certificate (RAC). With automatic service discovery, no additional configuration is required on the AD RMS client.

• The AD RMS client retrieves the service location URL from the issuance license and performs a SOAP request to the server, using the service location URL, to obtain the licensing URL. If the request fails, the client performs a SOAP request to obtain the certification URL. Subsequently, the certification URL is modified by replacing /certification with /licensing to retrieve the licensing URL.

• AD RMS client registry overrides. In complex AD RMS deployment topologies, more specific control of the AD RMS client is required. For versions of the Rights Management Services (RMS) client running on Windows XP, Windows 2000, or Windows Server 2003, these overrides are required for topologies where multiple Active Directory forests are deployed. Another example of where client registry overrides can be used is to support extranet users. In these cases, client registry overrides are created on the AD RMS client to force either certification or licensing of rights-protected content from an AD RMS cluster that is different from the one published in the SCP. The AD RMS client registry overrides used to override the SCP are created in:

  For x86 clients: HKEY_LOCAL_MACHINE\Software\Microsoft\MSDRM\ServiceLocation.

  For x64 and Itanium-based clients: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\MSDRM\ServiceLocation.

  The client registry override keys are the following:

  • Activation. This key is used to override the default AD RMS certification service that is configured in the SCP. The syntax for this key is http(s)://<your cluster>/_wmcs/certification where <your cluster> is the URL of the root cluster that should be used for certification.

    x86 Example
    HKLM\Software\Microsoft\MSDRM\ServiceLocation\Activation
    REG_SZ: default
    Value: <http(or https)://RMS_Cluster_Name/_wmcs/Certification> 
    

  • EnterprisePublishing. This key is used to override the default AD RMS licensing service to which the AD RMS client connects. The syntax for this key is http(s)://<your cluster>/_wmcs/licensing where <your cluster> is the URL of the licensing-only cluster.

    HKLM\Software\Microsoft\MSDRM\ServiceLocation\EnterprisePublishing
    REG_SZ: default 
    Value: < http(or https)://RMS_Cluster_Name /_wmcs/Licensing> 
    

  - If the AD RMS client computer is connecting by using a federated trust, you must configure the federation home realm. The registry key is:  
      
    **For x86 Clients: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MSDRM\\Federation**  
      
    **For x64 and IA64 Clients: HKEY\_LOCAL\_MACHINE\\Software\\Wow6432Node\\Microsoft\\MSDRM\\Federation**  
      
    When you use Active Directory Federation Services to allow access to protected documents from a trusted domain or forest, registry keys can set the federation home realm of the client computers in that forest. It must be set to the client’s home AD FS server FQDN and path in clients on the Accounts side of a federation trust.  
      
    Within this registry key create a registry entry named FederationHomeRealm of type REG\_SZ. The value of this registry entry is the federation service URI.  
      

<!-- end list -->

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDRM\Federation
         REG_SZ: FederationHomeRealm
         Value: < the federation service URI>

• Active Directory is queried for the certification URL and the URL is modified by replacing /certification with /licensing to retrieve the licensing URL.

For additional information about client deployment, see AD RMS Client Deployment and Usage Considerations (https://go.microsoft.com/fwlink/?LinkId=153481).