AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Huntress, Tuesday, September 8th, 2026
Mapping the AD RMS trust model and showing how an attacker discovers and fingerprints a deployment.
Part one of Huntress's AD Rights Management Service research maps the AD RMS trust model, including the Server Licensor Certificate and the licensing flow, then demonstrates discovery and fingerprinting techniques an attacker would use.
AD RMS is deprecated but remains deployed in many organizations protecting sensitive documents, and deprecated infrastructure is characteristically under-monitored.
The reconnaissance section is useful defensively, since the same queries that let an attacker find an RMS deployment let a defender confirm whether one is still running.