This guide provides troubleshooting information for Active Directory® Rights Management Services (AD RMS) in
Windows Server® 2008, Windows Server® 2008 R2 and Windows Server® 2012. It is designed to help you identify and resolve problems that may be related to AD RMS.
Author: Eddie Bowers, Senior Support Escalation Engineer, Microsoft
Co-author: Brad Mahugh, Senior Technical Writer, Microsoft
In this guide
This guide explains how to troubleshoot and resolve common problems that can occur when working with AD RMS. If you are not familiar with AD
RMS, you will find it helpful to familiarize yoruself with some of the AD RMS-related product documentation that is already published and available elsewhere in TechNet Library before using this guide.
When to use this guide
Use this guide when:
The following is a list of the top 7 most basic issues that are commonly found to occur across a wide array of AD RMS deployment scenarios. Depending on the symptoms you are seeing, these are often the best place to start
your troubleshooting of an AD RMS related issue.
1) Verify that you can get to the pipeline URLs from an AD RMS client computer.
When an AD RMS cluster is deployed, there are two "pipeline" URLs that are effectively always present and used to effectively Web service AD RMS requests from clients. These are:
If you cannot access these URLs from the AD RMS client computer using Internet Explorer, then AD RMS protection will fail. If your attempt to browse to these URLS fails, note what type of
error is returned so you can best determine your next steps in the troubleshooting process.
2) Make sure that the user at the AD RMS client computer has an email address configured in Active Directory.
When a user or group is created in Active Directory, the
mail attribute is an optional attribute that can be set to include a primary email address for the user or group. For AD RMS to work properly, this attribute must be set because all users must have an email attribute to protect and consume
content. This can be done by setting the email address field in the properties for the user or group using either of the following tools:
You can also use
Active Directory administration cmdlets for Windows PowerShell. For example, to specify an email address for a user include email address value using the
-EmailAddress parameter when creating a new user using the
3) Make sure that the SCP for AD RMS does not have a port specified for it.
The AD RMS service connection point (SCP) is an object in Active Directory that holds the Web address of the AD RMS certification cluster. In earier releases of AD RMS, the enterprise certification
URL included the TCP port number associated with the SCP. Most of the issues regarding Microsoft Office not properly parsing the enterprise certification URL when it has a port number should now be resolved with the latest hotfixes, but it’s better to avoid
the issue by updating your SCP configuration to not include the port number. For more information on SCPs, see
The AD RMS Service Connection Point (SCP), also on TechNet Wiki.
Note If you are using templates that were created when using the port number for the SCP was the default behavior for AD RMS, these templates might still cause the failure and equire updating to eliminate the problem.
4) Verify that when using SSL the certificate is trusted by the AD RMS client.
If when you are browsing the AD RMS "pipeline" URLs in Internet Explorer, the URLs start with "https://..." and resolve as valid and active but there is a warning about the certificate, then AD RMS will fail to work as expected.
The certificate used for SSL communication must be valid and all certificates in its hierachy must also be valid as well. Because Internet Explorer might not warn if the certificate revocation list (CRL) is not resolvable for this certificate, you might need
to check that an SSL certificate is valid or that its hierachy checks out, you can view the SSL certificate in Internet Information Services (IIS) Manager.
To view and verify the SSL Certificate and its hierachy, you can do the following in IIS 6.0 and 7.0:
From the IIS Manager console, select your Web server in the console tree, then click
Server Certificates to open and select the SSL certificate for that server. Once you have
located the SSL certificate in the list, double-click it to view its properties. To view the certificate hierachy, click the
Certification Path tab and then click each certificate in the hierachy to ensure that the status on each is OK.
5) Check that the DRM cache is cleared of any failed installation or configuration changes.
Often after initial install and configuration changes are made at
an AD RMS server, an AD RMS client might fail because the digital rights management (DRM) cache on it contains configuration data from when it previously bootstrapped against the server before the configuration changes were applied. To eliminate the
possibility of this being an issue, you can clear the DRM cache folder at the ADRMS client computer where you are experiencing trouble with AD RMS service connectivity. For Windows 7 and Windows 8 clients, the DRM cache Is located at the %localAppData%\Microsoft\DRM\
folder path. For Windows XP clients, the DRM cache folder is located at %UserProfile\LocalSettings\ApplicationData\Microsoft\DRM.
6) Check that there are not multiple .GIC or .CLC files installed on the AD RMS client.
As described in the
RMS FAQ: Certificates, Keys and Encryption, only one of the following should be present on the client in its local DRM cached folder:
If mulitple copies of these files are present, this usually indicates a problem with the AD RMS Client configuration and all copies should be removed and the client re-installed and re-configured.
7) Verify that the IIS application pool is started.
The IIS application pool used to service AD RMS may fail to function if the service account that it is configured to run under has been disabled or if the password for the service has expired. To verify or update the identity for the AD RMS application pool
in IIS, see
Specify an Identity for an Application Pool (IIS7).
The following are the most commonly identified known issues that can occur when working with AD RMS.
Symptom: You are seeing issues with a site certificate or an error message such as "The service is temporarily unavailable...".
Cause: Most likely there is an untrusted certificate or a certificate revocation list (CRL) cannot be resolved.
If there are any warnings when using Internet Explorer to browse and access the AD RMS "pipeline" URLs , then Office applications will fail to be able to contact the AD RMS server. The
reasons for this include the following:
Also, Microsoft Office applications will also fail if the CRL (Certificate Revocation URL) cannot be reached. In this specific case, Internet Explorer might not provide an error or warning message.
Resolution: First, verify that certificate being requested matches the name of the one that is is being used to support the pipeline URLs and that it has not expired or been issued from an untrusted authority. While self-signed certificates
can be used in test deployments for AD RMS, it is recommended they not be used in live production AD RMS deployments that have exposure to external networks or in Internet-facing configurations.
Also, you can as a workaround for CRL issues, disable CRL checking in Internet Explorer. To disable CRL checking, in Internet Explorer, from the
Tools menu, open Internet Options, click the
Advanced tab, scroll to the Security section and uncheck the box for
Warn about security address mismatch, and then click OK.
Symptom: The AD RMS client reports an "unexpected error" message when a user is trying to access IRM functionality.
Cause: Most likely the cause of this is because the
user accessing the content does not have an e-mail address configured using the
mail attribute address in Active Directory, which is required for AD RMS to work as expected.
Resolution: Verify that the user account for the user in Active Directory has the
mail attribute configured with the user's email address.
Microsoft Office applications are having difficulty processing a pipeline URL. The URL has been checked and it appears to have a port number specified within it.
Cause: Some patch levels of Microsoft Office have problems accessing pipeline URLs used by AD RMS clients when there is a port number in the pipeline URL.
Resolution: Ensure that the client computer has been updated to install this fix:
http://support.microsoft.com/kb/2544026. You can also update your AD RMS cluster configuration
to not include the port in pipeline URLs. This is a multi-step process (below).
To remove port numbers from AD RMS pipeline URLS
On the AD RMS server computer, open the AD RMS console.
In the console tree, select the <AD RMS server> and right-click and select
In <AD RMS server> Properties, click the Cluster URLs tab.
Verify that the Licensing URL does not have the port number (":443") appended to it.
Click the SCP tab and then click Remove current SCP.
If you already have an extranet URL and your licensing URLs do not end with the port number (":443"), you can now skip the next three steps and proceed directly to step 9.
Click the Cluster URLs tab again and check the Extranet URLs box.
Type the word 'test' in each of the available text boxes and click
Uncheck the Extranet URLs box and click Apply, then
Close the AD RMS console and re-open it.
In the console tree, select the <AD RMS server> and right-click and select
Click the SCP tab and then click Change SCP to register the current SCP.
Check your AD RMS cluster URL settings and confirm that there is no ":443" appended to the end of any of the URLs.
Next, you will need to update all AD RMS servers in your cluster with the new URLs
To clear and reset all AD RMS servers to use the updated cluster URLs, repeat the following steps at each AD RMS server in the cluster.
Open the Windows Registry Editor (Regedit.exe) and create the following registry value:
Under HKEY_LOCAL_MACHINE\Software\Microsoft\DRMS (Note: On some versions you will have a
\2.0 folder under that key, so create this value at that level if you do)
Open an elevated command prompt and type iisreset and ENTER to issue a reset of the Web server on each server computer.
Finally, you will need to clear cached AD RMS configuration data at the AD RMS client computer. To do so, use the following steps at each client computer.
Delete the %LocalAppData%\Microsoft\DRM folder.
Close all Microsoft Office applications.
Retry the AD RMS client operation.
Note If you have AD RMS rights policy
templates, you will also need to do the following:
Symptom: An attempt to migrate or upgrade from RMS to AD RMS failed and failed and some of the DRMS Logging database tables are missing.
Cause: In a failed migration, your DRMS_Logging database, and your logging components do not get updated.
Warning Make sure you have a backup of your server licensor certificate (SLC) and your trusted publishing domain (TPD) certificate before taking any recovery steps.
Your DRMS logging database will only contain 3 tables (Log_Filter, Log_Detail, and Log_Master) instead of 13 new tables (BadQueueDataLog, Certificate, CertificateType, ErrorDescription, etc.).
There are a couple reasons that your ADRMS upgrade could end up in this state of incompleteness.
When you get ino this state your DRMS_Config database gets updated, but no other databases are updated and the next time you retry the upgradeprocess, it will fail as well. You may also see this error in the event log:
Source: Active Directory Rights Management
Task Category: Logging
"The Active Directory Rights Management Services (AD RMS) logging services could not write to the AD RMS logging database. It will try to write the last message to the AD RMS logging database. All other messages will not be read from the Message
Queuing until the AD RMS logging database is available."
During the upgrade process, AD RMS looks at a value called ADRMSFileVersion in the DRMS_ClusterPolicies table of the DRMS_Config database to see if the upgrade has already been done. If the value is set to 5.2.3790.300 it determines that
it needs to be upgraded. If the version number is newer (higher), AD RMS will not upgrade.
Resolution: To force AD RMS to to reset and restart upgrade of all its databases again, remove the AD RMS server role from the server computer and set the value of
ADRMSFileVersion in the DRMS_ClusterPolicies table of the DRMS_Config database to 5.2.3790.300 and then add the AD RMS server role back on the server computer.
Symptom: Clients located over the Internet are unable to access or obtain
service from AD RMS.
Cause: The pipeline URLs for AD RMS must be accessible from the Internet for external users to use AD RMS. External or Internet-based users must also be able to do HTTP POST to these pipeline URLs.
Resolution: When clients are failing in this scenario, you should check the Web server (IIS) logs on the server computer to see if the client traffic is even reaching it. If you find that the traffic is not reaching the web server, check
your web proxy logs to see if the traffic is being rejected there.
If you work your way back to the client, you can gather WinInet logging or run a Fiddler trace to troubleshoot the issue.
A typical WinInet trace command (valid on Windows Vista and later versions of Microsoft Windows) might look like this:
Logman start "wininettrace" -p "microsoft-windows-wininet" -o "c:\wininettrace.etl" –ets
To create a human readable (xml) log file:
tracerpt "wininettrace.etl" –y –o “wininetracelog.xml" –of xml
You are having difficulty getting SharePoint configured to work with AD RMS.
Cause: If you are having difficulty getting SharePoint configured properly to work with AD RMS or are confused by how to go about achieving interoperability between these technologies, it's helpful to ensure you understand how SharePoint
implments IRM support.
Enabling IRM on Sharepoint forces users to use Sharepoint as a distribution method. It does this by only giving rights to the downloading user (and the SharePoint service user account), so the document cannot be forwarded. Even if the document is forwarded
to someone who has rights to it via SharePoint, they will not be able to open it because the IRM rights are only set to the downloading user.
Resolution: Check these prerequisite steps when troubleshooting IRM issues with SharePoint:
You should see Number of User Profiles at a high number to indicate it synchronized.
If it failed to synchronize. Go into Application Management\Manage Services on Server\User Profile Synchronization service (make sure it's started)
Configure Synchronization Connections.
If there isn't a connection already, selcet Create a New Connection.
Go back and Start Profile Synchronization (Start Full Synchronization)
Windows Registry Editor Version 5.00
IRMCheck - Some of the important information that IRMCheck returns is as follows:
The results for the
Certificates section are as follows:
IRM Check also displays the Office registry information for RMS. Essentially, the RMS client automatically discovers where many of the bits and pieces of the RMS organization are stored.
It does this by making a call to DRMGetServiceLocation, documented at
Many of these registry settings allow the client to override this information. Here is the translation of these settings (keys are shown here for Office 2003):
Office Activation Service
This setting is not documented. In the RMS 1.0 RTM version, all clients had to activate themselves by obtaining a lockbox from a Microsoft server on the Internet by proxying the request through the RMS server. The lockbox is basically the component that does
all of the encryption, decryption, validation, signing, etc. With the introduction of RMS 1.0 SP1, this is no longer necessary because the lockbox is shipped with the components and activates itself locally.
Office Enterprise Certification Service
If the SCP is registered in your AD, this setting will override it. Don't set this unless you have a specific reason to do so. If you have the SCP registered, you should let the client discover it automatically.
Office Enterprise Client Enrollment Service
This setting overrides the location from which you obtain the CLC.
Office Cloud Certification Service
This setting is not documented. It overrides the location of the Passport service. If you have RMS 1.0 SP1 or later, don't change this setting. If you have RMS 1.0 RTM, enter the following:
https://licensing.drm.microsoft.com/_wmcs/Certification. If you have RMS 1.0 and don't enter this URL, your RMS client goes out to the Universal Description, Discovery and Integration service (http://uddi.microsoft.com)
and obtains the URL specified above. Specifying the URL saves bandwidth and eliminates a service that your clients need.
Office Cloud Client Enrollment Service
This setting is not documented. It overrides the Passport licensing URL. Leave it at its default registry setting if you are running RMS 1.0 SP1 or later. If you are running RMS 1.0 RTM,
enter the following: https://licensing.drm.microsoft.com/_wmcs/Licensing.
Office RM Client Setup URL
This setting is not documented. If a client gets an RMS-protected document and Office notices that RMS isn't installed, it will try to download the client from the Internet and install it.
If you want Office to search internally, then you can set this key so that Office will go to your internal site to get the pre-downloaded bits. Changing this setting is good for air gap networks or locked-down situations.
Office IRM Disable
Value: 1 (disables) 0 (enables)
This setting will completely disable the RMS support within Office.
Office IRM DisablePassportCertification -
Value: 1 (disables) 0 (enables)
This setting disables the Passport functionality in Office 2003 IRM. This enables organizations to block people from sending RMS-protected mail outside the company using the Passport service.
Office IRM DisableCertificateValidation -
Value: 1 (disables) 0 (enables)
This setting is not documented.
Office IRM Permission Policy Path -
Value: (UNC path or local path of your RMS templates)
This setting establishes the location where Office 2003 looks for the RMS templates. You can set this to a local folder or a UNC share. Unfortunately, Office does not support a web folder
for the template location.
Office Cached Enterprise Client Enrollment Service -
This setting is not documented.
Thanks for article.