AD RMS Team Blog

RMS PowerShell cmdlets - preview release

2013-05-02T19:16:00Z

Hello Folks,

The RMS team has been hard at work and now have our first preview release of a set of PowerShell cmdlets using AD RMS SDK.

Microsoft.Protection PowerShell cmdlets are designed for developers, IT pros and products who like to script with AD RMS SDK without directly integrating with AD RMS SDK 2.1 package. Microsoft.Protection cmdlets provide all the rich functionalities provided by AD RMS SDK 2.1.

In this CTP1 release package, we provide:

Microsoft.Protection cmdlet binaries
Install and Uninstall ps1
Readme.docx for the install instructions and the list of cmdlets in CTP1 release
Extensive cmdlet help by running Get-Help on each cmdlet.

Microsoft.Protection cmdlets are work in progress. We will update rapidly based on your feedback for feature requests and bugs.

To give our cmdlets a try, go to - https://connect.microsoft.com/site1170/Downloads/DownloadDetails.aspx?DownloadID=49294 and download the package.

NOTE: If you haven’t registered on Microsoft Connect, then: go to www.connect.microsoft.com, sign in with your Microsoft Account > Directory> Search for Rights Management Services > Join.

Enjoy them and let us know about your experience.

Dan

New Videos: Watch "Enabling RMS Everywhere", check out new Information Protection channel on Channel 9 @ MSDN

2013-03-27T23:51:00Z

Hi folks,

We in the Information Protection team have been super busy answering your toughest and hardest questions and trying to create content that will help you better understand the value and possibilities of all the good new work going on right now in the RMS space.

To that end, we on the Information Protection team have launched our very own Channel 9 video channel at http://channel9.msdn.com/Series/Information-Protection where we are are starting to post a series of Webinar videos that will help show all the cool things starting to come online here.

The first video is out now. It's called "Enabling RMS Everywhere" and covers the updated RMS story end-to-end. Customers who have seen or heard this talk have been telling us they are LOVING this new story. The video is a bit long even for a full-fledged Webinar (1 hour and 45 minutes) but given how much we have to cover to address all of the various permutations for customers (from those who are cloud-ready to those who are cloud-adverse) it does start out gently and quite generally and then gradually builds from being a 100-level talk to a 300+ level talk.

We've done a ton of work to address the issues that customers have most complained about over the years with RMS, which include application reach (not enough apps support it), device reach (it's not usable on the full breadth of devices widely used), and other challenges in enabling key scenarios.

But it does help to remind folks that right now you can…

Turn on RMS in Office 365 in less than 30 seconds (for E3 and E4 plan purchasers).
Use the Office 2013 protection features with your E3/E4 seats
Securely collaborate with other Office 365 tenants
Enable Exchange DLP to protect files
Enable SharePoint Online 'Secure Libraries'
Consume protected content on the following platforms:

Windows (Office).
Windows 8 Mail client (new!)
Samsung Android
iOS/Android via TouchDown

..and there's plenty more coming soon from where all of the above came from -- so stay tuned here and remember to catch us on Channel 9 as well!

Thanks,
Dan

Cross-post: Announcing AD RMS SDK 3.0 beta for rights-enabling of Android, iOS and Windows RT devices

2013-03-08T03:41:00Z

Hi folks,

It's been a busy time this past couple months in the IP team here at Microsoft. We've introduced a new cross-platform developer tool set for enabling Android, iOS and Windows RT devices. Future blog posts will further elaborate on these new SDKs and how they enable clean and simple rights-enablement for device solution developers.

For more details check out the full details on our AD RMS Developer's Corner blog on MSDN:
http://blogs.msdn.com/b/rms/archive/2013/03/01/announcing-ad-rms-sdk-3-0-beta-rights-enabling-andoid-ios-and-windows-rt.aspx

Thanks,
Dan

Cross-post: AD RMS SDK 2.1 now out and available for download

2013-03-06T19:27:00Z

Hi folks,

Just a few months back we announced that we had released the AD RMS SDK 2.0 for developers. Well, today we've introduced the Release Candidate (RC) of our AD RMS SDK 2.1 which now includes File API. and several other significant updates that make life easier and application development better for handling documents of different file types (Office documents, PDF, text, image and others), and to be able to quickly protect and unprotect documents.

For more details, see the full post on the AD RMS Developer's Corner Blog on the MSDN blogs site here:

http://blogs.msdn.com/b/rms/archive/2013/03/06/announcing-ad-rms-sdk-2-1.aspx

UPDATE 03-12-2013: We've also just added a new Data Leak Prevention (DLP) sample application that leverages the File API. For more details, see http://blogs.msdn.com/b/rms/archive/2013/03/12/data-leak-protection-dlp-sample-using-ad-rms-sdk-2-1-rc.aspx

Thanks,
Dan

Cross-post: New interop layer for AD RMS SDK 2.0 eases application development

2012-12-05T02:52:00Z

Hi folks,

There is a lot of great work that is happening to support and enable AD RMS in the developer tools space and our latest post on the AD RMS developer's corner blog will really help those who have been wondering how to get started with rights-enabling their managed code (ex. C#) applications.

Check it out and feel free to pass the word on to any of your friends and associates who might be interested in developing AD RMS applications.

http://blogs.msdn.com/b/rms/archive/2012/12/04/interop-layer-for-ad-rms-sdk-2-0-or-how-do-i-access-ad-rms-sdk-2-0-with-managed-code.aspx

Thanks,
Dan

Protect everything: using FCI to protect files of any type with Windows Server 2012

2012-11-09T21:38:00Z

Hey folks,

We once again have a guest for today's AD RMS Team blog. Today's post is brought to you by Andrey Moskvitin. Andrey is a Technical Solutions Professional who specializes in Security for our Microsoft Russia subsidiary and he's going to help you see how to use File Classification Infrastructure along with our Rights Protected Folder Explorer and an additional third-party tool, the PDF protector offered by our friends at Foxit Software, to protect files of any type using Windows Server 2012.

I'm sure you will enjoy learning how to use these tools together to automate protecting of documents based on classification rules. While this is, as Andrey points out, not a totally new feature scenario, it has become an easier and richer one to explore with recent updates and new functionality that have come about around the release of Windows Server 2012.

Thanks,
Dan

Hi, I am Andrey and today I want to highlight how AD RMS and Windows Server 2012 can assist you in making the world a more secure place by automating protection of documents.

Certainly you have encountered a strong desire (or demand) to protect with RMS all files within a folder or maybe just files with a certain content. Some possible scenarios include:

Access to all documents on file server must be limited to active employees of the company, even when files are copied to local storage or a former employee made copies on a USB-drive prior to the layoff.
Apply RMS-policy "Finance read-only” must be applied to all files containing more than 10 credit card numbers or other PII.
Apply RMS-policy "Sales Managers Only" to all Excel files larger than 10 MB containing PII and contract numbers being created by the CRM system.

With the Windows Server File classification Infrastructure (FCI) feature you can identify sensitive files and encrypt them with RMS. FCI crawls file shares for files meeting certain criteria and tag them based on the results. Tags are stored in the file attributes and
persist even after moving files to another NTFS storage. Once files are tagged, you can automatically apply the "RMS Encryption" action to files with certain tags, and select one of the existing RMS templates in your organization or define a custom RMS policy.

While when people think of “documents” they often associate that with Microsoft Office documents, IT admins know well that’s not all that it’s out there. PDF files, CAD drawings and other types of files account for a significant portion of the sensitive data out there, and protecting it is essential to reduce the risks of data leakage. So when we protect data with FCI it is very valuable to be able to protect any type of file in the best available way.

Integrating FCI and AD RMS was possible before (as it was well documented in the past), but with Windows Server 2012 we got a plethora of new functionality:

No need for AD RMS Bulk protection tool or creating your own scripts – RMS protection of Office files is available in the FSRM feature of File and Storage Services server role.
Protecting files "on the fly" - a newly created or modified file is immediately classified and protected.
Ability to define ad-hoc policies in addition to the option of using Rights Policy Templates.
Detect a certain number of pattern matches, for more flexibility in the identification of sensitive content.

There are lot of classification criteria including file path, extension, size, date of creation, author, specific content, etc. The most interesting one is analyzing the content of a file for matches against custom regex-filters allowing you to search for example for:

Certain words or word combinations
Base of word, neglecting word forms, suffixes or prefixes
Specifically formatted data, for example credit card numbers, phone numbers, SSNs, PII, contract numbers, etc.
Amount of data above threshold such as more than 10 credit card numbers in one file

Basically, you can identify anything that can be expressed with a regular expression, which can go from an easy Social Security Number to formatted or unformatted credit card numbers from all the most common providers. Of course, you don’t need to be an expert in writing Regular Expressions, as there are plenty of regex libraries on the Internet.

And could you ever imagine that you can scan not only text files but also TIFF images? Here is the list of supported file formats that can be scanned with FCI.

With FCI you can perform different actions on files you identify as sensitive. One of them is to use the in-box RMS protection capability. But you can also perform custom tasks. This comes in handy because the in-box RMS protection action only supports Office files. You can support other types of files trough two options:

Putting files in encrypted container using Rights Protected Folder Explorer (RPFe)
Triggering specific RMS protectors for certain types of files, such as PDF, CAD or images, supported with partner solutions

Of course, the latter option is preferred whenever possible, but RPF is a great fallback solution when a file is in a format for which you don’t have a native protector.

So let’s say you want to protect all files in a folder that contain five or more Social Security Numbers. You want to protect Office documents, PDF files and also all other files. So in order to do this, at a high level, you will need to:

Install the necessary roles (File Server Resource Manager, RPFe and a PDF protector, these tasks are left behind scenes, but you can get a PDF protection tool from Foxit (http://www.foxitsoftware.com/).
Define new classification property named “Sensitivity” with value “PII”
Create new classification rule via the Classification Management tab in the File Server Resource Manager

Name it “Protect docs with more than 5 SSNs”.
Under Scope select the folders or sets of folders to be scanned.
Under Classification choose classification method “Content classifier”.
Choose a property value to be assigned “Sensitivity” and check the “PII” value.
Click Configure, select the Expression Type “Regular expression” and insert Expression “\d{3}-\d{2}-\d{4}” in Expression
field to look for SSNs. Set the minimum number of occurrences to 5 for rule not to trigger on files containing 4 or less SSNs.
Create 3 file management tasks for Office documents, PDF and all other files
- Scope of each rule will contain all files with the corresponding file extensions (e.g. .docx) that are tagged as “Sensitivity - PII”.
- For the “Office documents” task you will use the in-box “RMS Encryption” to protect the file, choosing a suitable template.
- For the PDF task you will configure a custom action that will use a script to run the Foxit RMS protector command line tool or an equivalent solution. With Foxit, you would use the following command line: RMSProtector.exe /encrypt [Source FilePath] /template TemplateName
- All other files not matching the PDF or Office file extensions will be covered with a task that runs rpfexplorer.exe with arguments described here to put files into encrypted container
- Schedule scans to run on a recurring basis
- Set report properties to receive emails with the updates on sensitive files found and protected

Once you have implemented these three tasks, all files in the destination folder that contain five or more social security numbers will be protected with RMS. Office files will be protected with the in-box RMS
protection capability, PDF files will be protected with the protector from Foxit, and all other files will be converted into a Rights Protected Folder which ensures encryption and access controls.

With this functionality, you can ensure your sensitive files are protected as soon as they are created and saved to a file share. Of course, some organizations will need more advanced capabilities such as enterprise-wide
content detection, advanced pattern matching and context-aware content identification, capabilities often available in high-end DLP solutions (we like to call the capabilities discussed in this post as “DLP-lite”).

Thanks to the ease of integration RMS provides, most high-end DLP solutions today can work with AD RMS. These DLP solutions can often do a great job in detecting sensitive content, and with the ability to
protect files with AD RMS they gain a great deal of flexibility, reducing the impact of false positives and allowing more flexible policies that don’t simply block access. We are working actively to ensure that AD RMS can be integrated seamlessly with any such solution you might want to use. Stay tuned for more on this.

(Update added 12/03/2012) Here's a bit more guidance on how to use FCI + AD RMS with the Foxit RMS protector to classify PDF files.

First of all, classifying PDF files based on file content is possible with the installation on your file server of PDF iFilters from either Adobe (see http://www.adobe.com/support/downloads/detail.jsp?ftpID=2611 ) or Foxit (see http://www.foxitsoftware.com/products/ifilter/) .

After you have set up an FCI + AD RMS infrastructure based on how I described previously in this post, you should have a File Management Task (FMT) that applies only to all PDF (*.pdf) files. A FMT type is a custom action and it will be used to trigger the Foxit RMS Command Line Tool (Foxit CLI Tool).

Extract the Foxit CLI Tool to a local folder on your file server computer and then set the correct permissions. The tool executable file must be set to read-only for any non-administrative users and the folder should also be set to read-only for non-administrative users as well.
Install the AD RMS Client 2.0 as the Foxit CLI Tool relies on it.
In the FMT properties, define the correct path to the Foxit CLI Tool executable.
In the Arguments field enter:
/encrypt [Source File Path] /template <RMS_template_name>
In addition, you can add to the Arguments some keys listed in the Foxit CLI Tool manual, among them is /preserveattributes, which is for
preserving all the original file attributes including Owner, Creation Time, Modified Time, Accessed Time etc.

Your FMT properties should look similar to these:

In addition, Microsoft has created an extension to the existing PDF standard allowing consummation of RMS-encrypted PDFs in third-party readers. Currently, however, only Foxit Software has implemented this standard.

Cross-post: Announcing AD RMS File API: Development just keeps getting that much easier for RMS-aware applications

2012-11-01T17:44:31Z

Hey folks,

I know that most of you that frequent this blog are IT professionals and so familiarity with the developer experience in working with AD RMS might not be your primary focus, but when we on the Information Protection team rollout something that can really empower the AD RMS developers that you partner with to make a great solution that you can help be a part of bringing about, we want to make sure you are aware of it.

With the release a few months back of both the AD RMS Client 2.0 and the AD RMS SDK 2.0, we have made some real strides forward in simplifying the amount of code that is required to produce AD RMS-aware applications. Building on these recent developer enhancements, I'd like to give you a "heads up" about another cool thing that we have added for AD RMS developers, the RMS File API.

The File API is a new API that allows applications to easily protect and unprotect files in a single operation. With the file API, you pass the file to an API along with the policy you want applied and the API does the rest. It will identify the file’s format, and then protect the file appropriately. If it can’t find a suitable protector it will use the brand new Protected File format to encrypt the file and embed access controls so the file is protected in a generic format. It's a much simpler and effective way to go.

So if you want to know more of the technical details, please check out our recent post on the AD RMS Developer's Corner blog and be sure to let your developer friends who are interested in rights management know about this new API. It's bound to save them time and coding.

http://blogs.msdn.com/b/rms/archive/2012/10/31/announcing-the-rights-management-services-file-api.aspx

Thanks,
Dan

New content: AD RMS Best Practices Guide

2012-10-23T00:47:00Z

Hey folks,

One of the things that we have heard as a request from many of you who work with RMS and AD RMS regularly is "How can I get access to all the best practices and expert guidance that will help me make the best decisions when planning, deploying and supporting my AD RMS infrastructure?"

As some of you might recall, to help address this request and to get this type of knowledge out to customers, our senior PM for customer and community, Enrique Saggese, put together a series of videos for TechNet Edge a couple years back to help provide this type of content. If you're curious about those, you can read more about that in our earlier blog post on that here.

Today, however, I'm pleased to see that much of that content from the videos that Enrique did has been adapted and updated and is also available in a single document on TechNet Library. If you are looking to do some one-stop shopping in gathering up all the "best of" AD RMS best practices, you definitely will want to check out this new guide!

AD RMS Best Practices Guide: http://technet.microsoft.com/en-us/library/jj735304.aspx

Thanks to Enrique, Pat Hoffer and Brad Mahugh who helped to get this guide authored, adapted, reviewed and updated for your enjoyment.

- Dan

Want automated rights management protection for non-Microsoft files? Use FCI with Rights Protected Folder Explorer

2012-10-16T17:59:00Z

Hey folks,

You may recall that a few months back we announced on a previous blog post about the official release of the Rights Protected Folders Explorer (RPFe) tool. As a follow-up to that, I wanted to point out that our friends and internal partners on the Microsoft Storage team who own File Classification Infrastructure (FCI) have just posted a great post on their team blog about how to configure FCI and RPFe to work together.

By using the features within FCI with the RPFe tool options, you can provide automated classification and rights management protection to any document files you have in your enterprise that are in non-Microsoft formats. It's a great way of providing rights protection using scripting and command-line options for documents that AD RMS does not directly support.

For all the details, see the new post by Keerthi Shankar on the Storage team's blog, Automatic RMS protection of non-MS Office files using FCI and Rights Protected Folder Explorer.

Thanks!
- Dan

RMS everywhere: create and consume protected email in iOS

2012-10-10T20:33:00Z

Hi folks,

You may recall that a few months ago we announced the inclusion of IRM capabilities in TouchDown, Nitrodesk’s popular email client for Android devices. TouchDown for Android uses Exchange ActiveSync IRM capabilities to handle protected content, enabling users to view, create and manage protected email in their devices. This has been very well received by users and IT administrators alike, since it means that Android users can now view ALL their email on their devices, including protected email.

We have just received news from Nitrodesk that they have released a version of their TouchDown email client for iOS, and that, of course, it includes all the IRM capabilities you’ve come to expect. This means that iPhone and iPad users can now view all their protected email in their phones and tablets, and they can also create protected emails on the devices, including protecting emails with Rights Policy Templates and Do Not Forward policies.

TouchDown for iOS also uses EAS IRM to handle Rights Management policies at the server, so there’s nothing to configure at the clients, you just get all the IRM functionality in your TouchDown email client by connecting it to an Exchange 2010 SP1 or later server that has EAS IRM enabled.

You can download TouchDown for iOS at http://itunes.apple.com/us/app/touchdown-for-ios/id560596861?mt=8. You can also learn more about TouchDown support for RMS at http://www.nitrodesk.com/irm.aspx or you can contact Nitrodesk support at iossupport@nitrodesk.com.

Thanks,
Dan