Active Directory Right Management Service (AD RMS) is a security tool that you can deploy to your users that allow them to determine what kind of access users or groups have to the content that a user generates. A very good question from class is how do you decrypt the data if you need to get access to it when you were not given AD RMS rights. The answer is with the AD RMS Bulk Protection Tool. You can download it from here (http://www.microsoft.com/downloads/details.aspx?FamilyID=F9FBE58F-C175-41D0-AFDC-6F160AB809CD&displaylang=ru&displaylang=en)
Once you download the .msi file, double click it to allow it to install.
Check I accept the terms in the License Agreement and click Next.
Click Finish when the installation completes.
To start using the AD RMS Bulk Protection Tool:
Click Start / All Programs / AD RMS Bulk Protection Tool / AD RMS Bulk Protection Tool
A special command prompt windows will open. Give it a few seconds to finish loading. We need to know the location where the files are that need to be decrypted. The syntax for this operation is:
RMSBulk.exe /decrypt \\ServerName\ShareName
Be aware that I was able to decrypt documents using a standard user account that did not have any AD RMS access rights on the documents to begin with. This is a very powerful tool.
One more note, This has to be ran on a Windows Vista, Windows 7, or Windows Serer 2008 R2 machine.