Error message that you may receive when you access AD RMS protected content
The following is an example of an error message that you may receive when you try to access AD RMS protected content.
If you use the Rights Management Add-on for Internet Explorer, you may receive the following error message if the manifest is expired:
You cannot open this document because we cannot set up your computer to open documents that have restricted permission.
If you click
Advanced Information in the error message, you may see one of the following error messages:
The Rights Management client returned the following result code: 0x80004005(-2147467259).
The Rights Management client returned the following result code: E_DRM_SERVICE_NOT_FOUND.
The Rights Management client returned the following result code: E_DRM_BIND_VALIDITY_TIME_VIOLATED.
After you apply this update, the manifest expiry feature is removed. Therefore, the AD RMS client applications will no longer have to renew their manifests. This also eliminates the possibility of having manifests expire accidentally.
Note This update is effective for both new and existing AD RMS products. AD RMS applications will still need a manifest. AD RMS Independent Software Vendor (ISV) partners will still need a production certificate issued by Microsoft for creating this manifest.
More information about AD RMS and the legacy application manifest expiry feature
Capabilities of AD RMS
AD RMS is used to protect sensitive data. AD RMS applications that also handle sensitive data share the responsibility of protecting this data.
AD RMS provides two main capabilities:
- AD RMS providespersistent, cryptographically-protected access control at the file level. This prevents unauthorized access to content.
- AD RMS provides usage policy enforcement that can specify particular rights or restrictions on access to content. For example, "read-only" or "do not forward."
To provide the usage policy enforcement capability, AD RMS restricts access to protected content. Only trusted AD RMS applications that can enforce this usage policy may access this protected content.
Mechanism of the application manifest expiry feature
Microsoft issues an application signing certificate to developers who create AD RMS applications. The developer uses this certificate to sign an application manifest for each AD RMS application. Each AD RMS application that creates or that accesses AD RMS protected content contains this signed application manifest. This application manifest verifies that the application has a trusted state. The AD RMS client checks both the signed application manifest and the application signing certificate before it enables the application to create or to access protected content.
The application signing certificate contains an expiration date. When this expiration date has passed, the AD RMS client no longer recognizes the trust state of the AD RMS application. Therefore, the AD RMS client does not enable the AD RMS application to create or to access the protected content. This expiration date is a legacy mechanism that is used to verify the trust status of an application. Previously, new application signing certificates and new signed application manifests were distributed with application updates. This occurred especially in updates that involved patching vulnerabilities. This legacy mechanism would then prevent an attacker from using older or un-patched applications in order to access the protected content.
A feature that enables the AD RMS system administrator to control application the trust state instead of relying on expiration dates replaces this legacy mechanism. An AD RMS administrator can specify particular AD RMS applications or particular versions of AD RMS applications as untrustworthy. An application that is set as untrustworthy cannot be used to create or to access AD RMS protected information.
