RMS SP1 Addresses Barriers to Deployment

RMS SP1, released in Apr. 2005, addressed some potential barriers to deployment, particularly in highly secure environments, with the following improvements:

Offline enrollment. Previously, an enterprise had to activate its primary (root) RMS server by connecting over the Internet to Microsoft and receiving a signed certificate. In addition, each RMS client had to be activated by connecting to a Microsoft-hosted service through the RMS server; this service generates a machine certificate and a lockbox (software-based secure storage for encryption keys). However, for security reasons, some customers might want to use RMS in a completely closed system that lacks Internet access.

SP1 addresses these problems. RMS server activation can occur via removable media—one PC can retrieve the RMS certificate over the Internet from Microsoft, then this certificate can be transferred to an RMS server in a closed system via disc. Client activation is no longer necessary at all with SP1—instead, each RMS SP1 client is delivered with the lockbox already included, with all the logic necessary to generate, store, and digitally sign the machine’s credentials.