AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

- This research demonstrates that if an on-premises AD RMS deployment stores its Server Licensor Certificate (SLC) key material in software, a Service Group member can extract the SLC (via the TPD export or DB), permanently decrypt any document the cluster has protected, and forge Rights Account Certificates to obtain live use licenses for arbitrary identities. The disclosure details the extraction and forging steps (SharpRMS), explains why the SLC cannot be effectively rotated for already-protected content, enumerates detection/logging limitations, and recommends mitigations: strict governance of the AD RMS Service Group, protecting TPD exports as key material, enforcing TLS/EPA, and using an HSM for the SLC.