Breadcrumbs

Initial Configuration of Active Directory Rights Management Services

The following example only describes a basic configuration and should be adjusted to your requirements.

  1. In the Server Manager Window, the flag shows a warning after the installation. Select the flag and click on Perform additional configuration.

tmpyhn8yqvc.png

Server Manager - Post-deployment Configuration of AD RMS

  1. In the AD RMS Configuration Wizard, go through the single configuration steps. It is important that you select Cryptographic Mode 2 (RSA 2048-bit-keys/SHA-256 hashes) in the step Cryptographic Mode.

tmpk66evjbm.png

AD RMS Configuration - Cryptographic Mode

  1. In the step Cluster Key Storage, select the option Use CSP key storage.

tmp02_ol6e1.png

AD RMS Configuration - Cluster Key Storage

  1. In the step Cluster Key CSP, select the CSP Utimaco CryptoServer RSA and AES CSP. If you want to use an existing key in the HSM, you can select one. If you want to create a new key, select the option Create a new key with the selected CSP (recommended).

tmpxte5t47m.png

AD RMS Configuration - Cluster Key CSP

  1. At the end of the wizard, please check your configuration. If everything is satisfactory, click on Install.

tmpmzei9109.png

AD RMS Configuration - Confirmation

  1. If the configuration was successful, you will get a confirmation that the role AD RMS was installed successfully.

tmpbacwr7mf.png

AD RMS Configuration - Results

  1. You can now check if the key has been created and stored successfully in the HSM. To do this, start the PowerShell command line interface and issue the command cngtool listkeys. If you see a key similar to the following output, the key is stored and available inside the HSM.


 
PS C:\> cngtool listkeys
------------------------------------------------------------
Provider : Utimaco CryptoServer Key Storage Provider
Device : 10.17.72.53
Group : RMS
Mode : External Key Storage
------------------------------------------------------------
Index AlgId Size Group Name Spec
-----------------------------------------------------------------
1 RSA 2048 RMS _DRMS:Mode2:MS-GUID:{b8c4c...8f741} 1

For any further configuration for AD RMS refer to the Microsoft TechNet website.