AD RMS Decommissioning Step-by-Step Guide

Applies To: Windows Server 2008, Windows Server 2008 R2

About This Guide

This step-by-step walks you through the process of decommissioning Active Directory Rights Management Services (AD RMS) in your organization. Removing AD RMS requires that all rights-protected content that you want to be able to use be decrypted before all servers are removed from the AD RMS cluster.

Once complete, you can use the test lab environment to learn about AD RMS decommissioning on Windows Server® 2008 and assess how it might be deployed in your organization.

As you complete the steps in this guide, you will:

  • Decommission an AD RMS cluster.

  • Verify the removal of AD RMS functionality after you complete the configuration.

This guide assumes that you previously completed the steps in the Windows Server Active Directory Rights Management Services Step-by-Step Guide (, and that you have already deployed the following components:

  • An AD RMS server

  • An AD RMS database server

  • One AD RMS-enabled client

  • One Active Directory domain controller

What This Guide Does Not Provide

This guide does not provide the following:

  • An overview of AD RMS. For more information about the advantages that AD RMS can bring to your organization, see

  • Guidance for setting up and configuring AD RMS in a production environment.

  • Complete technical reference for AD RMS.

Deploying AD RMS in a Test Environment

We recommend that you first use the steps provided in this guide in a test lab environment. Step-by-step guides are not necessarily meant to be used to deploy Windows Server features without additional deployment documentation and should be used with discretion as a stand-alone document.

Upon completion of this step-by-step guide, you will have a decommissioned AD RMS infrastructure. You can then test and verify AD RMS functionality by opening a rights-protected document and ensuring that the document is decrypted.

The test environment described in this guide includes four computers connected to a private network and using the following operating systems, applications, and services:

Computer Name Operating System Applications and Services


Windows Server 2008

AD RMS, Internet Information Services (IIS) 7.0, World Wide Web Publishing Service, and Message Queuing


Windows Server 2008 or Windows Server 2003 with Service Pack 2 (SP2)

Service Pack 2 for Windows Server 2003 is not required but will be used for the purposes of this guide.

Active Directory or Active Directory Domain Services (AD DS), Domain Name System (DNS)


Windows Server 2003 with SP2


Service Pack 2 for Windows Server 2003 is not required but will be used for the purposes of this guide.

Microsoft SQL Server® 2005 Standard Edition with Service Pack 2 (SP2)


Service Pack 2 for SQL Server 2005 Standard Edition is not required but will be used for the purposes of this guide.


Windows Vista®

Microsoft Office Word 2007 Enterprise Edition


For more information about the system requirements for installing AD RMS, see

The computers form a private intranet and are connected through a common hub or Layer 2 switch. This configuration can be emulated in a virtual server environment if desired. This step-by-step exercise uses private addresses throughout the test lab configuration. The private network ID is used for the intranet. The domain controller is named CPANDL-DC for the domain named The following figure shows the configuration of the test environment: