Mar 12
14
Set up RMS on client side
Once AD RMS is set up on the server, you need to set it up for the end users to actually use the AD RMS functionality. This is a 2-step process:
1. Install/validate RMS client on client machines
2. Use RMS within Office apps (Word, Excel, PowerPoint, and Outlook)
RMS client on client machines
The AD RMS client comes installed out-of-the-box on Microsoft end-user operating systems Vista, Windows 7, and Windows 8 as well as the server operating systems of Windows Server 2008 and Server 2008 R2. However, earlier versions of Windows (i.e. Windows XP or Windows Server 2003) require the manual installation of the RMS client. [Note: the client is actually just one file: msdrm.dll (Microsoft Digital Rights Management -dot – dynamic link library) which can be found in the %windir%/system32 directory.]
If you need to install the AD RMS client manually, first determine the operating system platform, the service pack installed (if any), and the architecture (32-bit or 64-bit) of the machine where you want the client installed, then visit the Microsoft AD RMS client page to download the correct AD RMS client version.
RMS in Office apps on client machines
Once the proper RMS client is installed, you need to set up Office 2010 to use the RMS functionality. Microsoft has posted a helfpul article called Information Rights Management in Office 2010 that covers the process pretty well. Essentially, once RMS is set up, users simply need to click File, Info, and then select the restriction settings they want. Piece of cake. See below for Word 2010 Professional.
Additionally, if you would like to add a ribbon command for Protecting documents in Word 2010, it’s a fairly elaborate process, honestly. Check it out. Some of your users will prefer this method (the ribbon command) while others will prefer the “standard” way of clicking Info from the File menu. Either way, you’ll have covered both of your bases.
These instructions work for both Office 2010 and Office 2007 Professional versions, however, RMS will also work with Office 2003 Professional. For Office 2003 Professional the process is simply to click the File menu, and select Permissions from the dropdown. Then, simply follow the prompts. You will be prompted for which users and/or groups are to have access followed by a screen where you select the individual permissions to be restricted. See below. Piece of cake.
Final
After you have set up the client’s machines for the RMS client and you’ve set up Office 2010 to use RMS functionality, you’ll want to train the users on how to follow the process of protecting their documents, e-mails, spreadsheets, and powerpoints. At that point, you will have completed the AD RMS mission.
After I finally got AD RMS up and running, the next task was then to integrate it with SharePoint 2010. This seemed simple:
1. Go into Central Admin in SharePoint 2010 on a Web Front End (WFE) Server,
2. Click Security,
3. In the section Information Policy, click Configure information rights management,
4. Choose one of the three options:
- Do not use IRM on this server
- Use the default RMS server specified in Active Directory
- Use this RMS server (it then allows you to type in the url for your AD RMS server)
My initial choice was the third option.
I typed in my AD RMS url and then clicked the OK button. It failed. I double-checked the url and it was right. What could be the problem?? After careful reading of Google’s findings on the subject, I chose the second option (“use the default RMS server specified in Active Directory”)… and it failed again. After going back to Google again, I found this article about integrating SharePoint 2007 with IRM which gives the important steps of Permissions – you must enable the SharePoint 2010 WFEs to access the AD RMS server certificate. Got it. Here are the steps from the above article by David Lim which are as relevant to SharePoint 2010 as they were to SharePoint 2007.
- Log on to the AD RMS server as a local administrator
- Click Start, and then click Computer
- Navigate to c:\Inetpub\wwwroot\_wmcs\Certification
- Right-click ServerCertification.asmx, click Properties, and then click the Security tab
- Click Advanced, click Edit, select the Include inheritable permissions from this object’s parent check box, and then click OK two times
- Click Edit
- Click Add
- Click Object Types, select the Computers check box, and then click OK
- Type the name of the SharePoint web front-end server, and then click OK twice.
- Repeat the above three steps for other web front-end servers
- Click OK to close the ServerCertification.asmx Properties sheet. By default the Read & Execute and the Read permissions are configured
- Reset IIS
Now you can go back into Central Admin on a WFE, Security section, Configure information rights management, and select the 2nd option: Use the default RMS server specified in Active Directory.
It should work this time. For me it did.
Final Step: After you take these above steps, site and document library administrators are able to enable IRM on any document library to which they have the appropriate permissions.
Mar 12
12
Website launch
SharePoint in Depth ambitiously attempts to cover a full install of SharePoint 2010, hitting all the high notes and going deeper on occasion. The main purpose of this site is to provide a repository of “gotchas” that I encounter so that I don’t have to remember them all.
Of course, SharePoint 2010 operates on top of Windows Server 2008/R2 and along with IIS 7 and SQL Server 2005/2008. We’ll cover these too. SharePoint 2010 also cooperates really well with AD RMS (Active Directory Rights Management Services) to provide a robust security scheme for your enterprise; I’ll chronicle RMS as well along the way.
Douglas E. Spicer, MCITP
- Sign up for the Robinhood Gold Card!
Click the image below.