AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

This research (Part 1) maps how Active Directory Rights Management Services (AD RMS) deployments can be discovered and enumerated by any domain user, how rights-policy templates and licensing endpoints are exposed, and how membership of the AD RMS Service Group enables administrative SOAP calls that reveal the location and extractability of the Server Licensor Certificate (SLC) private key; Part 2 promises the extraction and offline decryption method. The paper highlights a critical design/operational weakness: many deployments store a software-based SLC private key with no practical rotation, often protected in a configuration database or backups, meaning that once the SLC is obtained it can decrypt all historically protected documents indefinitely, even after domain remediation.