AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
Huntress, Thursday, September 10th, 2026
Exporting the Server Licensor Certificate private key enables offline decryption of protected documents.
The second part of Huntress's AD Rights Management Service research shows how an account in the AD RMS Service Group can export the Server Licensor Certificate private key, enabling offline decryption of protected documents across the deployment.
The key cannot practically be rotated, which is what makes the finding severe: once extracted, it remains valid indefinitely and decryption leaves no trace on the RMS infrastructure.
Organizations still running AD RMS for document protection should review who holds membership in that service group as a priority.