Using Active Directory Rights Management Services (AD RMS) for SharePoint Document Libraries

Active Directory Rights Management Services (AD RMS) is a Data Leak Prevention (DLP) technology that uses Digital Rights Management (DRM) concepts in an attempt to prevent critical data from easily being transferred outside of a company. AD RMS works by encrypting documents, and then only allowing them to be unencrypted if the client application agrees to the terms of the rights policy. For example, the rights policy may dictate that the document cannot be printed, that it can’t be saved in a different format, or that data from it cannot be copied/pasted. It can also dictate that the document expires after a certain period of time.

AD RMS is independent from SharePoint, and runs as a service on a Windows Server 2008 or Windows Server 2008 R2 server. Clients can encrypt files directly from their Office clients, or via Outlook, with or without SharePoint. Where the SharePoint integration comes into place, however, is in SharePoint’s ability to define a rights policy on all documents within a document library and have those rights policies enforced by an AD RMS server in the domain.