The configuration database is upgraded without any notification if you use an incorrect cluster key password when you try to join an RMS cluster that is using an earlier version of RMS

Consider the following scenario:

• On a computer that is running Windows Server 2008, you try to join an earlier version Rights Management Services (RMS) cluster. An example of an earlier version RMS cluster is Microsoft RMS Service Pack 2 (SP2).
• You try to join the RMS cluster by using the Add Roles Wizard in Server Manager. In this case, the RMS cluster tries to upgrade to the version for Windows Server 2008.
• Before the upgrade, you enter an incorrect cluster key password. As expected, the upgrade fails, and you receive the following error message:
  
  The private key password is not set or is not valid.

In this scenario, without any notification, the provisioning process upgrades the configuration database before the process fails. This leaves the cluster in an inconsistent state: an upgraded configuration database and an earlier version logging database.

Now, assume that you repeat the upgrade procedure, but this time you enter the correct password. In this situation, the upgrade succeeds. However, the RMS provisioning detects that the computer has the new version of the configuration database. Therefore, the RMS provisioning does not upgrade the logging database. In this state, you cannot track licensing information, document access (failures and successes), and information leaks (such as unauthorized access to documents or e-mail messages).

To resolve this problem before you upgrade the existing Active Directory RMS (AD RMS) cluster, install this update on the computer that is running Windows Server 2008.

How to obtain the update package

The following files are available for download from the Microsoft Download Center:

Update for Windows Server 2008 (KB968817)

Download the Update for Windows Server 2008 (KB968817) package now.

Update for Windows Server 2008 x64 Edition (KB968817)

Download the Update for Windows Server 2008 x64 Edition (KB968817) package now.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Active Directory Rights Management Services (AD RMS) is an information protection technology. This technology works together with RMS-enabled applications (such as Microsoft Office) to protect digital information, such as documents and e-mail messages. AD RMS protects digital information from unauthorized use inside an organization that has other federated identities. AD RMS works together with three databases: Configuration, Directory Services, and Logging.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
For more information about RMS provisioning issues, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/library/cc747638.aspx

For more information about known issues for an RMS-to-AD RMS upgrade, visit the following Microsoft Web site:

http://technet.microsoft.com/pl-pl/library/cc732936.aspx

For more information about AD RMS databases, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/library/cc771792.aspx

For more information about the AD RMS Upgrade Wizard, visit the following Microsoft Web site:

http://technet.microsoft.com/pl-pl/library/cc770876.aspx