http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspxTechNet Wiki Betaen-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspxFri, 12 Oct 2012 11:20:35 GMT121679bd-0b80-4fca-85fd-585a9defe68b:653Martin_Sieberhttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsCurrent Revision posted to TechNet Articles by Martin_Sieber on 10/12/2012 4:20:35 AM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles, <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx"> AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx"> AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>As long as the user works with the same Windows account&nbsp;and there is no major change (such as the switch to Mode-2) on the AD RMS cluster,&nbsp;the creator can always open his Office documents with full rights. The default setting of templates ensures that this also applies to protected XPS documents and also after a switch to Mode-2 on the AD RMS Cluster.&nbsp;But you can turn off this feature by by clearing the &#39;Grant owner (author) full control right with no exception&#39; option in the Add User Rights step when creating or editing the template - in this case e.g. the creator of a protected&nbsp;XPS document can&#39;t change the rights of it afterwards.<br /> <br /> If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: Active Directory, AD, AD RMS, adrms, best practices, en-US, rights management, rms, templates</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/6.aspxFri, 12 Oct 2012 11:19:28 GMT121679bd-0b80-4fca-85fd-585a9defe68b:71790Martin_Sieberhttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 6 posted to TechNet Articles by Martin_Sieber on 10/12/2012 4:19:28 AM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles, <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx"> AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx"> AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>As long as the user works with the same Windows account&nbsp;and there is no major change (such as the switch to Mode-2) on the AD RMS cluster,&nbsp;the creator can always open his Office documents with full rights. The default setting of templates ensures that this also applies to protected XPS documents and also after a switch to Mode-2 on the AD RMS Cluster.&nbsp;But you can turn off this feature by by clearing the &#39;Grant owner (author) full control right with no exception&#39; option in the Add User Rights step when creating or editing the template - in this case e.g. the creator of a protected&nbsp;XPS documents can&#39;t change the rights of it afterwards.<br /> <br /> If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, AD RMS, rms, rights management, templates, adrms, AD, en-US</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/5.aspxWed, 06 Jun 2012 05:14:59 GMT121679bd-0b80-4fca-85fd-585a9defe68b:71789Ed Price - MSFThttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 5 posted to TechNet Articles by Ed Price - MSFT on 6/5/2012 10:14:59 PM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles, <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx">AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx">AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>By default, the user that protects a piece of content has full control over it.&nbsp; You can configure the owner to be restricted to the same rights as an end-user by clearing the Grant owner (author) full control right with no exception option in the Add User Rights step when creating or editing the template.</p> <p>If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, AD RMS, rms, rights management, templates, adrms, AD, en-US</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/4.aspxWed, 06 Jul 2011 23:20:53 GMT121679bd-0b80-4fca-85fd-585a9defe68b:57345Ed Price - MSFThttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 4 posted to TechNet Articles by Ed Price - MSFT on 7/6/2011 4:20:53 PM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles, <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx">AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx">AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>By default, the user that protects a piece of content has full control over it.&nbsp; You can configure the owner to be restricted to the same rights as an end-user by clearing the Grant owner (author) full control right with no exception option in the Add User Rights step when creating or editing the template.</p> <p>If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, AD RMS, rms, rights management, templates, adrms</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/3.aspxWed, 06 Jul 2011 23:20:31 GMT121679bd-0b80-4fca-85fd-585a9defe68b:19623Ed Price - MSFThttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 3 posted to TechNet Articles by Ed Price - MSFT on 7/6/2011 4:20:31 PM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx">AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx">AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>By default, the user that protects a piece of content has full control over it.&nbsp; You can configure the owner to be restricted to the same rights as an end-user by clearing the Grant owner (author) full control right with no exception option in the Add User Rights step when creating or editing the template.</p> <p>If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, AD RMS, rms, rights management, templates, adrms</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/2.aspxWed, 06 Jul 2011 23:20:19 GMT121679bd-0b80-4fca-85fd-585a9defe68b:19622Ed Price - MSFThttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 2 posted to TechNet Articles by Ed Price - MSFT on 7/6/2011 4:20:19 PM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx">AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx">AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>By default, the user that protects a piece of content has full control over it.&nbsp; You can configure the owner to be restricted to the same rights as an end-user by clearing the Grant owner (author) full control right with no exception option in the Add User Rights step when creating or editing the template.</p> <p>If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, rms, rights management, templates, adrms</div> http://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices/revision/1.aspxWed, 31 Mar 2010 22:44:09 GMT121679bd-0b80-4fca-85fd-585a9defe68b:19621Micah LaNasahttp://social.technet.microsoft.com/wiki/contents/articles/653.ad-rms-rights-policy-templates-best-practices.aspx#commentsRevision 1 posted to TechNet Articles by Micah LaNasa on 3/31/2010 3:44:09 PM<br /> <p>Rights policy templates enable content authors to quickly apply a standard level of protection for content across your organization.&nbsp; Furthermore, templates offer additional security options that are not available in normal protection.&nbsp; If you are unfamiliar with rights policy templates read the TechNet articles <a href="http://technet.microsoft.com/en-us/library/cc731070(WS.10).aspx">AD RMS Rights Policy Templates Deployment Step-by-step Guide</a> and <a href="http://technet.microsoft.com/en-us/library/dd996658(WS.10).aspx">AD RMS Policy Templates Considerations</a>.&nbsp; The following paragraphs provide some best practices for using rights policy templates in your organization.</p> <p>If you decide that you no longer want to make a template available to your users, do not delete it.&nbsp; Rather, archive the template.&nbsp; This allows users to still access content created by that template, though they will no longer be able to protect content using that template.&nbsp; </p> <p>Use the local Template Administrators group to delegate the rights to manage rights policy templates.&nbsp; Create a corresponding universal security group in Active Directory and add that group to the local Template Administrators group on each server in your AD RMS cluster.</p> <p>When creating a rights policy template, you can define the template name and description in multiple languages.&nbsp; This allows the name and description to appear in the user&#39;s native language.</p> <p>When specifying the users and groups that will have rights over content protected by the created template, you can use <b>anyone</b> to grant permissions to all authenticated users.&nbsp; This means that any user with a valid rights account certificate (RAC) will have the permissions specified.&nbsp; However, we recommend that you create an all company group in Active Directory instead, especially if you have a federated environment or if there is a trust relationship with another company.</p> <p>When specifying the rights that users will have, remember that permissions are cumulative.&nbsp;&nbsp; The Rights Summary will report the rights as you have specified them, not the effective permissions.</p> <p>By default, the user that protects a piece of content has full control over it.&nbsp; You can configure the owner to be restricted to the same rights as an end-user by clearing the Grant owner (author) full control right with no exception option in the Add User Rights step when creating or editing the template.</p> <p>If you need to enable access to Office 2003 content using the Rights Management Add-on client, you must select the option Enable users to view protected content using a browser add-on in the Specify Extended Policy step when creating or editing the template.</p> <p>If you have enabled AD RMS for a specific application you can specify additional rights for that application in the Specify Extended Policy page.&nbsp; The implementation of custom rights is completely up to the application, so they can be anything that can be expressed in XrML.</p> <p>Remember that rights policy templates are dynamically updated.&nbsp; There is no need to reapply a rights policy template to previously protected content after you edit a template.</p> <p>Remember that Microsoft Office SharePoint Server 2007 does not support rights policy templates.&nbsp; In addition, Windows Mobile 6.0 and later users can consume content protected by a rights policy template on their mobile device; however, they are unable to create content using a rights policy template on their mobile device.</p> <p>Remember that Microsoft Office applications can display up to 20 rights policy templates.</p> <p>Use a descriptive naming convention for your templates.&nbsp; The name of the template might be all that the author sees when choosing a template to use.</p> <p>Distribute templates to local machines.&nbsp; Remote users with portable computers might want to protect content with a template while they are working offline.&nbsp; Having a local copy of the templates allows users to protect content with templates, even while they are offline.&nbsp; If you are using Windows Vista SP1 or later this template distribution is performed automatically.</p> <div style="font-size: 90%;">Tags: best practices, Active Directory, rms, rights management, templates, adrms</div>