locked
AD RMS Template Problem RRS feed

  • Question

  • hi,

    I install AD RMS and Additional DC on server 2008 R2. But, my client can't get rms template (Office 2010 Enterprise).

    I create new template and save shared location on the server. And i give full access the shared location.

    Everything looks normal on AD RMS console. And i check scp menu. It's correct.

     But, Clients can't get ad rms template.

    How can i do ?

    Thanks.

    Monday, September 20, 2010 12:12 PM

Answers

  • Unfortunately, as I wrote earlier. If you use %APPDATA% or any environment variable in the path Office 2010 will ignore it. I ran Process Monitor to see what kind of path it is looking for and when I use absolute path (e.g. C:\Users\martinr\AppData\Local\Microsoft\DRM\Templates) without any environment variables it opens the correct place and looks for the templates.

    Unfortunately if I set the registry to %localappdata%\Microsoft\DRM\Templates the system looks up C:\Windows\system32\%localappdata%\Microsoft\DRM\Templates which fails.

    Try to use absolute path without environment variables and you'll see your templates at the correct place.

    Regards

    Martin Rublik


     


    I found what was mine problem. So environment variables work I have used REG_SZ instead of REG_EXPAND_SZ.

    One thing to note, is that if I use Office 2010 Group Policy Administrative Template to assign template locations, it assigns it also through REG_SZ, and of course the path then does not work.

    Regards

    Martin

    Wednesday, September 22, 2010 7:21 AM
  • What I discovered is that the Task Scheduler does not run the "AD RMS Rights Policy Template Management (Automated)" task.

    I am having the same issues as posted above and I was getting no challenge screens for SCP (access to the ADRMS server URLs) and I manually installed the [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM] with value=%localappdata%\Microsoft\DRM\Templates
    What I discovered is that if you logon as a Domain Admin, then the templates will get replicated to the user no problem(it takes a full hour or more). However, when you logon as a Domain User, I was not able to successfully get the templates to come over to the Domain Users profile. Even though I was able to successfully access the \\adrmsserver\rmstemplates share; access the SCP URLs... still no luck. I then started focusing my attention to the Task Scheduler and I ran the "AD RMS Rights Policy Template Management (Automated)" and proceeded to the ADRMS web server logs to see if the task ran on the server. I did not see any logs and so I then ran the second task called "AD RMS Rights Policy Template Management (Manual)" and that task immediately showed up in the inetpub web server logs on the RMS server, as well as populating the "%localappdata%\Microsoft\DRM\Templates" folder. I deleted the templates and reran and BOOM!, they were there immediately!!

    So long story short... check that the "AD RMS Rights Policy Template Management (Automated)" task is running correctly. I still do not have it working correctly. I will post as I get this solution, or maybe someone else will update this post.

    Kirk

    Friday, December 30, 2011 12:40 AM
  • Checked that as well it still cannot see my custom templates on Word, Excel, Outlook, etc. I can see the templates are being copied correctly because if I remove them from the localappdata path it copies them back from the ADRMS share/server. So - according to the Technet ADRMS articles all should be well in ADRMS land but yet I cannot see those custom templates on my Office application - only the default templates.

    Also looking at this blog (http://blogs.technet.com/b/amolrb/archive/2009/05/26/creating-and-using-templates.aspx) there is some very confusing information. For starters I thought for Vista and upwards one only needs to configure the 'Specify Permission Policy Path' and specify the localappdata path and NOT the share containing the templates. Furthermore the document also instructs the reader to use the 'URL for location of document templates displayed when applications do not recognize rights-managed documents' options and specifiy the localappdata folder. Why? 

    I have tested this on various clients of Windows 7 and Office and it is always the same - local template directory is populated but Office application display only the build-in one. Is there no way of tracing this from a Office application side to see why it does not display the templates?



    Wednesday, June 6, 2012 3:52 PM
  • The permission policy path in the ADMX file is setup to use EDITTEXT (Regular Reg_sz), instead of EXPANDABLETEXT (REg_Expand_Sz). This is important if you are using environment variables in your values. The way the policy template is setup out of the box expects a static path (i.e. c:\templates, and cannot use %localappdata%\Microsoft\DRM\Templates)

    So you need to look through the ADMX file and modify it to change EDITTEXT for AdminTemplatePath to EXPANDABLETEXT.

    -Jason

    Wednesday, June 6, 2012 4:34 PM

All replies

  • Have you checked that

    1. Scheduled task "AD RMS Rights Policy Template Management (Automated)" is enabled (http://technet.microsoft.com/en-us/library/cc771971(WS.10).aspx), if using Vista SP1 or Windows 7 (if using XP you'll need to either set registry to shared location or copy the templates manualy through logon script)

    2. Registry information is correct HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM\AdminTemplatePath points to %LocalAppData%\Microsoft\DRM\Templates

    Regards

    Martin

    Monday, September 20, 2010 12:27 PM
  • and i change "ad rms template managment (Automated)" disiable to enable. after than run this task.

    and i read log on history tab.

     it give an error message. The message :

    Task Scheduler failed to start instance "{d0559f02-4b78-45be-bf3c-efe444c3c4d9}" of "\Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)" task for user "YBS\orcunu" . Additional Data: Error Value: 2147798851.

     

    Monday, September 20, 2010 12:27 PM
  • Hi,

    can you open https://RMSSERVERURL/_wmcs/licensing/TemplateDistribution.asmx with Internet Explorer? Does it prompt for username / password?

    If so try to add https://RMSSERVERURL to intranet sites and check whether you can access the URL without entering credentials (using Windows integrated authentication). Afterwards delete the registry key HKEY_CURRENT_USER\Software\Microsoft\MSDRM\TemplateManagement and run the scheduled task again.

    HTH

    Martin

    Monday, September 20, 2010 12:51 PM
  • system opens without prompting the user name for (https://adrms.tikle.com/_wmcs/licensing/TemplateDistribution.asmx)

    and i delete the registry key. After than i try run sheduled task again. But i get same error again.

    Tuesday, September 21, 2010 6:05 AM
  • ok. i restart computer and task  complated. But, i can't look template on Word.
    Tuesday, September 21, 2010 6:50 AM
  • The task is probably completed but the client did not download any templates due the fact that registry settings indicated that the previous attempt to download templates was short time ago.

    Please check whether exists the directory %LocalAppData%\Microsoft\DRM\Templates and if it contains any XML files.

    Do you have any errors in RMS server's log and client's event log? Is there a proxy or firewall between the client and the server?

    Martin

    Tuesday, September 21, 2010 7:10 AM
  • yes. folder and key is not created. But i created Folder and copy xml file from AD RMS Server.

    I add new String key on  "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM"

    name : AdminTemplatePath

    Value  : %LocalAppData%\Microsoft\DRM\Templates

    But, i can't look template on Office 2010

    Tuesday, September 21, 2010 7:45 AM
  • I can confirm that :(, looks like you need to specify the path without ENV variables. E.g.

    C:\Users\martinr\AppData\Local\Microsoft\DRM\Templates 

    Could anyone else confirm this?

    Martin

    • Edited by Martin Rublik Tuesday, September 21, 2010 8:42 AM typo
    Tuesday, September 21, 2010 8:29 AM
  • Tempaltes have under Review >> restirict Editing tab ?

    Do  I look wrong tab ?

    Tuesday, September 21, 2010 9:52 AM
  • Tuesday, September 21, 2010 10:15 AM
  • but, i can't see rms template on restrict Permission  and no log on ad rms server.

    Tuesday, September 21, 2010 10:40 AM
  • ok. i checked "%LocalAppData%\Microsoft\DRM\Templates" folder and I see come to Template XML files.  (install certificate on trust root)

    But, I can't see templates on Word and other Office Programs.

    Tuesday, September 21, 2010 11:34 AM
  • Most likely you have the wrong registry string type in your Office hive.

    In HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM

    you need to create a reg_expand_sz and set it to %localappdata%\Microsoft\DRM\Templates.

     Make sure you close your Office app before testing again.

    Jason

    Tuesday, September 21, 2010 1:47 PM
  • ok. I edit the key. But nothing happend. I can't see template on Word (Restrict Permission tab)
    Tuesday, September 21, 2010 2:11 PM
  • Can you export your registry key to a .reg file, then copy and paste the results here?
    Tuesday, September 21, 2010 2:15 PM
  • Ok. it is as follows;

    Windows Registry Editor Version 5.00

    [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM]
    "CachedCorpLicenseServer"="https://adrms.tikle.com/_wmcs/licensing"
    "AdminTemplatePath"=hex(2):25,00,4c,00,6f,00,63,00,61,00,6c,00,41,00,70,00,70,\
      00,44,00,61,00,74,00,61,00,25,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,\
      6f,00,66,00,74,00,5c,00,44,00,52,00,4d,00,5c,00,54,00,65,00,6d,00,70,00,6c,\
      00,61,00,74,00,65,00,73,00,00,00

    [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM\LicenseServers]
    "https://adrms.tikle.com/_wmcs/licensing"=dword:00000000

    Tuesday, September 21, 2010 2:31 PM
  • Your key is correct.

    Did you close your office apps (making sure they are actually closed via the processes tab in Task Manager) and try again, after setting this value?

     

    I assume if you go to Start>Run and just put

    %localappdata%\Microsoft\DRM\Templates

    it opens without issue, correct?

    -Jason

    Tuesday, September 21, 2010 2:44 PM
  • Your key is correct.

    Did you close your office apps (making sure they are actually closed via the processes tab in Task Manager) and try again, after setting this value?

     

    I assume if you go to Start>Run and just put

    %localappdata%\Microsoft\DRM\Templates

    it opens without issue, correct?

    -Jason

    Unfortunately, as I wrote earlier. If you use %APPDATA% or any environment variable in the path Office 2010 will ignore it. I ran Process Monitor to see what kind of path it is looking for and when I use absolute path (e.g. C:\Users\martinr\AppData\Local\Microsoft\DRM\Templates) without any environment variables it opens the correct place and looks for the templates.

    Unfortunately if I set the registry to %localappdata%\Microsoft\DRM\Templates the system looks up C:\Windows\system32\%localappdata%\Microsoft\DRM\Templates which fails.

    Try to use absolute path without environment variables and you'll see your templates at the correct place.

    Regards

    Martin Rublik


     

    Wednesday, September 22, 2010 6:09 AM
  • %localappdata%\Microsoft\DRM\Templates is correct.

    it open up ("C:\Users\orcunu\AppData\Local\Microsoft\DRM\Templates") open When I write %localappdata%\Microsoft\DRM\Templates on run window.

    And i try change key value as "C:\Users\orcunu\AppData\Local\Microsoft\DRM\Templates" but it doesn't anything happened.

    Wednesday, September 22, 2010 7:09 AM
  • Unfortunately, as I wrote earlier. If you use %APPDATA% or any environment variable in the path Office 2010 will ignore it. I ran Process Monitor to see what kind of path it is looking for and when I use absolute path (e.g. C:\Users\martinr\AppData\Local\Microsoft\DRM\Templates) without any environment variables it opens the correct place and looks for the templates.

    Unfortunately if I set the registry to %localappdata%\Microsoft\DRM\Templates the system looks up C:\Windows\system32\%localappdata%\Microsoft\DRM\Templates which fails.

    Try to use absolute path without environment variables and you'll see your templates at the correct place.

    Regards

    Martin Rublik


     


    I found what was mine problem. So environment variables work I have used REG_SZ instead of REG_EXPAND_SZ.

    One thing to note, is that if I use Office 2010 Group Policy Administrative Template to assign template locations, it assigns it also through REG_SZ, and of course the path then does not work.

    Regards

    Martin

    Wednesday, September 22, 2010 7:21 AM
  • @ Martin. I always have to modify the Office adm file to allow this. ;)

    @ oulutas. I'm not sure what the problem is. If you open a support issue, I can easy assist into your machine and help you figure it out. 

    Wednesday, September 22, 2010 1:45 PM
  • Did you manage resolve Oulutas RMS problem?


    Schalk V
    Friday, December 9, 2011 8:48 AM
  • Hi ADRMS Gurus,

    I have 3 servers:

    1. DC+Exchange+CA

    2. ADRMS

    3. Windows 7 with MSoffice pro plus 2010.

     

    -with all softwares activated with MS.

    -ADRMS template url is opening

    -Templates are coping perfectly

    I don't see any other issue but I can't see the template showing up in outlook.. Any suggestion will be appreciated

    Monday, December 12, 2011 10:57 PM
  • Hi Prabhat,

    Need to open a seperate thread for this really :)

    Have used GPO based Template distribution ? Settings to be configured from office14.ADM via

    Manage Restricted Permissions >

    Download link

    Plus have a read thru ..  How to Deploy AD RMS Policy Templates


    Blog Link: http://blogs.cyquent.ae | Follow us on Twitter: @cyquent | ADRMS Wiki Portal: Technet Wiki

    • Proposed as answer by Adnan Syddieki Friday, December 16, 2011 4:35 PM
    Tuesday, December 13, 2011 7:20 AM
  • Did you use the Office 2010 ADM to configure this? What's you template location?


    Schalk V
    • Proposed as answer by Kirkster2001 Friday, December 30, 2011 12:24 AM
    • Unproposed as answer by Kirkster2001 Friday, December 30, 2011 12:24 AM
    Tuesday, December 13, 2011 7:24 AM
  • What I discovered is that the Task Scheduler does not run the "AD RMS Rights Policy Template Management (Automated)" task.

    I am having the same issues as posted above and I was getting no challenge screens for SCP (access to the ADRMS server URLs) and I manually installed the [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM] with value=%localappdata%\Microsoft\DRM\Templates
    What I discovered is that if you logon as a Domain Admin, then the templates will get replicated to the user no problem(it takes a full hour or more). However, when you logon as a Domain User, I was not able to successfully get the templates to come over to the Domain Users profile. Even though I was able to successfully access the \\adrmsserver\rmstemplates share; access the SCP URLs... still no luck. I then started focusing my attention to the Task Scheduler and I ran the "AD RMS Rights Policy Template Management (Automated)" and proceeded to the ADRMS web server logs to see if the task ran on the server. I did not see any logs and so I then ran the second task called "AD RMS Rights Policy Template Management (Manual)" and that task immediately showed up in the inetpub web server logs on the RMS server, as well as populating the "%localappdata%\Microsoft\DRM\Templates" folder. I deleted the templates and reran and BOOM!, they were there immediately!!

    So long story short... check that the "AD RMS Rights Policy Template Management (Automated)" task is running correctly. I still do not have it working correctly. I will post as I get this solution, or maybe someone else will update this post.

    Kirk

    Friday, December 30, 2011 12:40 AM
  • Checked that as well it still cannot see my custom templates on Word, Excel, Outlook, etc. I can see the templates are being copied correctly because if I remove them from the localappdata path it copies them back from the ADRMS share/server. So - according to the Technet ADRMS articles all should be well in ADRMS land but yet I cannot see those custom templates on my Office application - only the default templates.

    Also looking at this blog (http://blogs.technet.com/b/amolrb/archive/2009/05/26/creating-and-using-templates.aspx) there is some very confusing information. For starters I thought for Vista and upwards one only needs to configure the 'Specify Permission Policy Path' and specify the localappdata path and NOT the share containing the templates. Furthermore the document also instructs the reader to use the 'URL for location of document templates displayed when applications do not recognize rights-managed documents' options and specifiy the localappdata folder. Why? 

    I have tested this on various clients of Windows 7 and Office and it is always the same - local template directory is populated but Office application display only the build-in one. Is there no way of tracing this from a Office application side to see why it does not display the templates?



    Wednesday, June 6, 2012 3:52 PM
  • The permission policy path in the ADMX file is setup to use EDITTEXT (Regular Reg_sz), instead of EXPANDABLETEXT (REg_Expand_Sz). This is important if you are using environment variables in your values. The way the policy template is setup out of the box expects a static path (i.e. c:\templates, and cannot use %localappdata%\Microsoft\DRM\Templates)

    So you need to look through the ADMX file and modify it to change EDITTEXT for AdminTemplatePath to EXPANDABLETEXT.

    -Jason

    Wednesday, June 6, 2012 4:34 PM
  • I have done those changes via GPO registry replacement - but will test this as well.
    Wednesday, June 6, 2012 11:00 PM