A Good Reputation

Microsoft Office 2003 Cannot Open Documents Protected with AD RMS

tonytri — Wed, 30 Dec 2009 19:58:00 GMT

The issue of the inability to open AD RMS protected documents with Microsoft Office 2003 has been resolved with a hotfix. You can obtain the hotfix at the following locations:

Office Client – KB978551

Word Viewer – KB978558

Excel Viewer – KB978557

A High-Level Discussion of AD RMS

tonytri — Wed, 09 Dec 2009 18:26:00 GMT

Enrique Saggese, a Microsoft Senior Consultant, recently gave a lecture where he explained, from a high level, how AD RMS functions and how it protects content. We have edited that lecture into a series of videos that we are in the process of releasing on TechNet Edge.

So far, we've released the following short video clips:

How it works: Active Directory Rights Management Services - an introductory overview of how AD RMS protects content
AD RMS Certificates and Licensing on the Client and the Server - a discussion about certificates
AD RMS Certificate Hierarchy and the Protection Process - more about certificates and licenses

Kim Cameron discusses OpenID Prototype

tonytri — Fri, 20 Nov 2009 21:07:00 GMT

I enjoy reading Kim Cameron's blog. He has an interesting discussion of the use of identity "cards" on the Internet in a recent post.

Yesterday at the OpenID Summit hosted by Yahoo, Microsoft’s Mike Jones and Ariel Gordon showed some of the work their team has been doing to help figure out how this kind of capability could work. What’s cool is that the client they were showing is completely optional - without it, OpenID continues to work as it currently does. But with it, experience improves and the dangers are greatly reduced. I agree with them that demand for a better and safer OpenID user experience will drive selector adoption, which will in turn enable scenarios at higher levels of assurance than are possible with OpenID today.

Ariel Gordon, the main UX designer, told me, “I see it as a starting point for joint work with others in the community - definitely not a finished solution or product.”

It is consistent with the Information Card metaphor:

- Your OpenIDs are shown as visual cards
- You select an OpenID by clicking
- The OpenID last used at the site is the default selection

New OpenIDs can be added on the fly, by picking one from a list suggested by the site, or by typing the provider’s URL.

Protecting a Word Document with AD RMS

tonytri — Mon, 09 Nov 2009 22:13:00 GMT

I'm making a few short videos for the Windows Server 2008 "How Do I?" site. They are specifically meant to highlight AD RMS technology and demonstrate it for a customer who's never used it. The first video was recently posted:

This video introduces you to AD RMS by showing you how an end user can protect and assign specific permissions to a Word document using AD RMS.

Integrate Information Rights Management into Windows SharePoint Services ( WSS ) 3.0

tonytri — Fri, 30 Oct 2009 21:33:00 GMT

I thought this was a really interesting and detailed article:

Microsoft Office SharePoint Server (MOSS) 2007 ships with protectors based on the Information Rights Management (IRM) framework. These provide Microsoft Office users with the benefit of SharePoint integration with Active Directory Rights Management Services (AD RMS). Unfortunately, Windows SharePoint Services ( WSS ) 3.0 does not include IRM protectors out of the box. However, there is a solution. If you browse the sample applications and code snippets on the MSDN Code Gallery, among the gems you'll find is the Microsoft Office File Format Protectors source code, which Microsoft published in August 2008. The source code comes with a non-exclusive, worldwide, royalty-free "as-is" Microsoft Public License (Ms-PL). This is a great find because it means you can compile the source code and add these components to WSS 3.0 as well. In this way, you can benefit from AD RMS-based security and compliance features in any SharePoint environment.

Why is Information Security So Difficult?

tonytri — Wed, 28 Oct 2009 18:15:00 GMT

"...because sensitive information is always moving and transforming."

The quotation is from a webcast (a little over twenty minutes long) recently posted on the RSA Website.

Several months back, I wrote about a partnership between Microsoft and RSA to provide a data-loss-prevention solution. In the the webcast, representatives from Microsoft and RSA discuss the difficulties organizations face when they try to protect their data, and specifically how Microsoft and RSA seek to address those difficulties via the partnership.

How Do I Share Protected Documents with People Outside my Organization?

tonytri — Tue, 27 Oct 2009 23:27:00 GMT

GigaTrust's (a Microsoft partner) Enterprise Trust solution has a nice feature for doing that:

Automated, persistent content protection is a necessary element of complete enterprise security architecture that seamlessly complements existing perimeter security solutions with content protection. GigaTrust Enterprise Plus provides the tools to automate the protection of your sensitive documents and intellectual property, and allows you to share those documents with colleagues as well as your business and supply chain partners regardless of where they are.

Jason Tyler, who does product support for AD RMS, also has some nice things to say about Gigatrust's products.

AD RMS in the Press

tonytri — Mon, 26 Oct 2009 18:15:00 GMT

AD RMS was recently highlighted in an article on the Softpedia Website. The article discusses some of the new documentation available, highlighted on the AD RMS product team blog, to help developers and IT professionals implement and administer AD RMS in their organization.

AD RMS Support for BlackBerry Smartphones

tonytri — Fri, 23 Oct 2009 18:20:00 GMT

Liquid Machines Extends Its Industry-Leading Support of BlackBerry Smartphones for Microsoft Active Directory Rights Management Services to More Than 400 File Formats

Mobile access to real-time communications and data can increase the risk of a loss of confidential enterprise information such as intellectual property and other trade secrets. To help solve this problem, the Liquid Machines Gateway extends Microsoft® AD RMS information protection to a BlackBerry smartphone in conjunction with the BlackBerry Enterprise Server, enabling customers to persistently protect emails and attachments with encryption and usage controls that travel with the data. This persistent protection ensures that mobile communications, which may include executive and board communications, customer data, intellectual property and human resources information, can only be viewed by authorized users.

Security Software Market Growth Continues

tonytri — Thu, 08 Oct 2009 20:50:00 GMT

I found the following article on Information Week, Security Software Market Remains Strong, to be interesting. Here's an excerpt:

Here's what Ruggero Contu, principal research analyst at Gartner had to say in a statement:

“Although the worldwide security software market is affected by the economic downturn, the growth will continue to be strong in 2009 as security remains a critical area where drastic cuts cannot be afforded,” s the medium term, the greatest growth opportunities will come from software as a service (SaaS), appliance based offering and small and medium businesses (SMBs), which are in security catch-up mode compared with large companies and therefore spend a higher percentage of their budgets on security.”

Information Protection Features in Exchange 2010

tonytri — Tue, 06 Oct 2009 23:12:00 GMT

Exchange 2010 contains some new features that make use of AD RMS technology. Exchange's Information Protection and Control topic highlights some of these features, including transport protections rules, Outlook protection rules, and IRM support in Outlook Web App:

Transport protection rules. when used with Active Directory Rights Management Services (AD RMS), transport protection rules enable an administrator to automatically apply Information Rights Management (IRM) protection to e-mail (including Office and XPS attachments) after a message is sent. This provides persistent protection to the file no matter where it is sent and prevents forwarding, copying, or printing depending on the set of AD RMS Policy Templates available from the AD RMS deployment. Voicemail can also be protected to prevent forwarding to unauthorized persons.

Outlook protection rules. These rules automatically trigger Outlook to apply an RMS template that is based on sender or recipient identities before a message is sent. With Outlook protection rules, administrators can also enable users to turn off protection for non-sensitive e-mail. Also, because the messages are protected at the desktop before they are sent out to Exchange, Outlook protection rules allow your organization to keep third-party service providers or onsite Exchange administrators from viewing sensitive content that is sent between your employees.

Support for IRM in Outlook Web App. Your users can read and reply to (as well as reply-all, forward, block print, cut/copy) IRM-protected messages natively, just as they would in Outlook. IRM-protected messages in Outlook Web App can be accessed through Windows Internet Explorer, Firefox, and Safari (no plug-ins required), and Outlook Web App includes full-text search, conversation view, and preview pane.

New Content: Deploying Active Directory Rights Management Services at Microsoft

tonytri — Thu, 24 Sep 2009 01:48:00 GMT

Since the worldwide implementation of AD RMS at Microsoft, each day, an average of approximately 5,000 documents and e-mail messages are protected to be consumed by 80,000 unique users. These numbers continually grow as an increasing number of users adopt AD RMS technologies as their preferred means of helping to protect their confidential e-mail and documents.

This paper discusses the need that Microsoft IT had for protecting confidential business data, the reasons for deploying RMS over other possible solutions, and how AD RMS works. This paper also offers detailed lessons learned and best practices derived from the RMS server and client deployment and usage experience of Microsoft IT. It assumes that readers are technical decision makers and are already familiar with the fundamentals of both public key cryptography and symmetric key security systems, the benefits that such systems offer, and the components required to implement the systems.

Notes: Provisioning AD RMS on Windows Server 2003

tonytri — Wed, 02 Sep 2009 02:41:00 GMT

I recently provisioned AD RMS on WS 2003 R2 and I made a few notes as I ran into issues. Perhaps these will give you a nudge in the right direction if you are troubleshooting:

First, you must download Windows RMS 1.0 SP2 and install it. The installation won't complete unless you first install IIS, MSMQ, and ASP.NET 1.1 (Add/Remove Windows Components). I found Setting Up a Basic Infrastructure to be helpful.

To provision RMS, you fill out the form on provisioncertification.aspx.

A few issues I ran into:

It couldn't find the SQL Server computer. I had to turn off Windows Firewall on the AD RMS server and the database server.

Login failed. I added my service account to the logins on SQL Server.

CREATE DATABASE permission denied in database 'master'. My service account didn't have correct permissions on the database server.

Technet Edge Video: Rights Management Services and End Users in Exchange 2010

tonytri — Wed, 02 Sep 2009 01:05:00 GMT

I wanted to try a little experiment and embed a video on my blog. The following video is Ed Banti, a program manager for Exchange, discussing RMS features for end users in Exchange 2010. Enjoy.

AD RMS on TechNet Edge

tonytri — Thu, 27 Aug 2009 06:07:00 GMT

Announcing: New video overviews for RMS and Exchange Server 2010 on TechNet Edge!