As cited
Copy frozen at (site build).
vulnerabilities
AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
Active Directory Rights Management Service (AD RMS) allows a Service Group account to export the Server Licensor Certificate private key, which is 1172 bytes and can decrypt all documents protected by that deployment offline. The key remains valid even after the deployment is rebuilt, creating a persistent decryption capability.
Why it matters: Organizations using AD RMS are exposed to complete offline decryption of protected documents if a Service Group account is compromised; practitioners should audit and restrict Service Group account privileges and assess whether AD RMS remains necessary for their infrastructure.
- Source published
- First seen by Cybersecurity Tracker