5 Comments on “You need to ensure that the users in west.contoso.com are directed to the AD RMS cluster…”

1. wayne says:

   November 11, 2016 at 9:56 pm

   Answer is B: Configure the Group Policy object (GPO) settings of the users in the west.contoso.com domain.

   Resources:
   http://social.technet.microsoft.com/wiki/contents/articles/710.the-ad-rms-service-connection-point.aspx

   “nly one SCP can exist in your Active Directory forest. If you try to install AD RMS and an SCP already exists in your forest from a previous AD RMS installation that was not properly deprovisioned, the new SCP will not install properly.”

   and

   https://technet.microsoft.com/en-us/library/jj735304(v=ws.11).aspx

   “Create a group in Active Directory and use that for targeting AD RMS client deployment It is recommended that you use GPO to deploy AD RMS client settings and that you only deploy settings as needed. Target settings using the same groups used for client deployment.”

   Hope this helps…

   
   
   
   5

   
   
   
   0
2. den says:

   December 30, 2016 at 5:57 am

   the setup described in the question is NO recommended best practice according to:
   https://technet.microsoft.com/en-us/library/jj735304(v=ws.11)

   I did some research and found these articles giving deeper information about RMS service discovery, maybe they clear up things a little bit more for you:
   https://technet.microsoft.com/en-us/library/cc755112.aspx
   https://technet.microsoft.com/de-de/library/ee221071(v=ws.10).aspx (nearly at the end of this page you find “AD RMS Service Discovery” describing the registry stuff)

   
   
   
   1

   
   
   
   0
   1. den says:

      December 30, 2016 at 6:12 am

      because this topic bugs me a bit I did more research and found further information:
      https://docs.microsoft.com/en-us/information-protection/rms-client/client-deployment-notes#enabling-client-side-service-discovery-by-using-the-windows-registry
      https://technet.microsoft.com/en-us/library/dd772665(v=ws.10).aspx

      to me it looks like quite quirky dirty stuff:
      there are different reg keys, depending on client’s software version, also no explicit GPO settings mentioned anywhere.
      so looks to me if you want to do it right you either have to create your own adm(x) template or hack the desired reg settings into the respective GPO Preference section.

      
      
      
      1

      
      
      
      0
3. User says:

   January 1, 2018 at 12:37 pm

   I believe the correct answer is “B. Configure the Group Policy object (GPO) settings of the users in the west.contoso.com domain”.
   The client will look for AD RMS server by checking first locally its registers then if it does not find anything goes to SCP in the forest then finally checks with Azure Right Mangement Discovery service if previous did respond.

   Since we can only have one SCP per forest, we will have to put the AD RMS server location in a register for the client to use locally.

   https://docs.microsoft.com/en-us/information-protection/rms-client/client-deployment-notes

   
   
   
   1

   
   
   
   0
   1. User says:

      January 1, 2018 at 12:38 pm

      if previous did not respond*

      
      
      
      0

      
      
      
      0