Event ID 147 — Active Directory Domain Services Availability

  • Article

Applies To: Windows Server 2008

Active Directory Rights Management Services (AD RMS) uses Active Directory Domain Services (AD DS) to regulate access to rights-protected content for all AD RMS users in the AD DS forest. If AD DS is not available, AD RMS cannot grant licenses to publish and consume rights-protected content.

Event Details

Product: Windows Operating System
ID: 147
Source: Active Directory Rights Management Services
Version: 6.0
Symbolic Name: DirectoryServicesCrossForestResolutionFailedEvent
Message: Active Rights Management Services (AD RMS) group membership expansion across forests failed.

Parameter Reference
Context: %1
RequestId: %2
%3
%4

Resolve

Check group expansion pipeline URL

When Active Directory Rights Management Services (AD RMS) users consume rights-protected content that was not protected in the user account's home forest (the Active Directory forest where the user account resides), the AD RMS cluster will contact the AD RMS cluster in the remote forest (an Active Directory forest with AD RMS installed and an AD RMS trust policy established) by using group expansion. The AD RMS group expansion URL must be valid and the AD RMS service account must have access to the AD RMS group expansion pipeline.

To perform these procedures, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

Ensure that AD RMS group expansion URL is correct

To ensure that the AD RMS group expansion URL is correct:

  1. Log on to a server in the AD RMS cluster in the home forest using the home cluster's AD RMS service account credentials.
  2. Click Start, click All Programs, and then click Internet Explorer.
  3. In the address bar, type http(s)://cluster_url/groupexpansion/groupexpansion.asmx where cluster_url is the cluster URL for AD RMS in the remote forest, and then press ENTER.
  4. Verify that the GroupExpansionWebService Web Service Web page appears in the browser window.
  5. If the GroupExpansion WebService Service Web page does not appear, add the AD RMS service account to the AD RMS cluster group expansion pipeline in the remote forest.

Add the AD RMS service account to the cluster group expansion pipeline in the remote forest

To add the AD RMS service account to the cluster group expansion pipeline in the remote forest:

  1. Log on to an AD RMS server in the remote forest.
  2. Click Start, and then click Computer.
  3. Navigate to the IIS home directory. By default, the path to this directory is %systemdrive%:\inetpub\wwwroot where %systemdrive% is the partition on which Windows is installed.
  4. Double-click _wmcs.
  5. Double-click groupexpansion.
  6. Right-click groupexpansion.asmx, and then click Properties.
  7. Click the Security tab.
  8. Click Advanced, and then click Edit.
  9. Click Add.
  10. On the Select Users, Computers, or Groups window, type the name of the AD RMS service account and then click OK.
  11. Click OK and then click OK again.
  12. Repeat steps 1 - 11 for all servers in the AD RMS cluster in the remote forest.

Verify

To perform this procedure, you must be a member of the local Users group, or you must have been delegated the appropriate authority.

Note: Microsoft Office Word 2007 is used as an example in this section. Any AD RMS-enabled application can be used in place of Word 2007.

To verify that AD RMS can access the Active Directory Domain Services forest:

  1. Log on to an AD RMS-enabled client computer.
  2. Click Start, point to All Programs, point to Microsoft Office, and then click Microsoft Office Word 2007.
  3. In the new document type This is a test document.
  4. Click the Microsoft Office Start Button, point to Prepare, point to Restrict Permissions, and then click Restricted Access.
  5. Select the Restrict permissions to this document check box.
  6. Type another AD RMS user's e-mail address in the Read box, and then click OK.
  7. Send this file to the person who was granted access in step 6.
  8. Have this person open the document and verify that he or she cannot do anything else other than read the document, such as print it.

Active Directory Domain Services Availability

Active Directory Rights Management Services