News

Microsoft Issues Hotfix for AD Rights Management

• By Kurt Mackie
• 02/10/2010

IT shops using Microsoft's Active Directory rights management services (AD RMS) will need to install an update before Feb. 22 to avoid expiring permission certificates.

Organizations typically use AD RMS to protect sensitive data in application files. The service enables file-level encryption control by IT pros and lets them specify rights and restrictions, such as making files read-only and preventing the forwarding of files in e-mails.

The AD RMS update, released on Tuesday, removes a legacy feature in the service that was designed to prevent users from using older unpatched applications. The update applies to most Windows versions and can be downloaded at Microsoft's Windows Update page or at the Microsoft Support page here.

If a system using AD RMS is left unpatched, users "will not be able to create or access protected content" on Feb. 22 when certificates expire, according to the Microsoft Forefront team blog.

Any Web-based application using this service will be affected, but it particularly affects Microsoft's Internet Explorer browser. In addition, users will have problems accessing or creating protected content using Microsoft Outlook (versions 2000, 2003 or 2007) and Web viewers for Excel, PowerPoint and Word.

Microsoft explained that this new hotfix is being rolled out as a follow-up to an information rights management certificate problem discovered in Office 2003. In December, Microsoft issued hotfixes for an Office 2003 information rights management problem and subsequently published a support description.

The new AD RMS hotfix removes the application manifest expiry feature of the service. Instead of that relying on that legacy feature, IT pros can use "application exclusion" and "Windows software restrictions policies" in AD RMS to control policies, according to the Forefront team blog. Microsoft claims that this change to AD RMS provides greater control for customers using the service.