How to fix Test-IRMConfiguration: Failed to acquire a use license.

Question

Issue

Hello everyone!

When running Test-IRMConfiguration on my Exchange Server, I get the following error:

[PS] C:\Windows\system32>Test-IRMConfiguration -Sender ******@DOMAIN.com
Results : Checking Exchange Server ...
              - PASS: Exchange Server is running in Enterprise.
          Loading IRM configuration ...
              - PASS: IRM configuration loaded successfully.
          Retrieving RMS Certification Uri ...
              - PASS: RMS Certification Uri: https://DOMAIN-dc.DOMAIN.com/_wmcs/certification.
          Verifying RMS version for https://DOMAIN-dc.DOMAIN.com/_wmcs/certification ...
              - PASS: RMS Version verified successfully.
          Retrieving RMS Publishing Uri ...
              - PASS: RMS Publishing Uri: https://DOMAIN-dc.DOMAIN.com/_wmcs/licensing.
          Acquiring Rights Account Certificate (RAC) and Client Licensor Certificate (CLC) ...
              - PASS: RAC and CLC acquired.
          Acquiring RMS Templates ...
              - PASS: RMS Templates acquired.
          Retrieving RMS Licensing Uri ...
              - PASS: RMS Licensing Uri: https://DOMAIN-dc.DOMAIN.com/_wmcs/licensing.
          Verifying RMS version for https://DOMAIN-dc.DOMAIN.com/_wmcs/licensing ...
              - PASS: RMS Version verified successfully.
          Creating Publishing License ...
              - PASS: Publishing License created.
          Acquiring Prelicense for '******@DOMAIN.com' from RMS Licensing Uri
          (https://DOMAIN-dc.DOMAIN.com/_wmcs/licensing) ...
              - PASS: Prelicense acquired.
          Acquiring Use License from RMS Licensing Uri (https://DOMAIN-dc.DOMAIN.com/_wmcs/licensing) ...
              - FAIL: Failed to acquire a use license. This failure may cause features such as Transport Decryption,
          Journal Report Decryption, IRM in Outlook Web App, IRM in Exchange ActiveSync and IRM Search to not work.
          Please make sure that the account "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042" representing the
          Exchange Servers Group is granted super user permissions on the Active Directory Rights Management Services
          server. For detailed instructions, see "Add the Federated Delivery Mailbox to the AD RMS Super Users Group"
          at http://go.microsoft.com/fwlink/?LinkId=193400.
          OVERALL RESULT: FAIL

What I Have Done

First, I ensured that I have followed the steps indicated in the error message about adding federated delivery mailbox to ADRMS super users group (Link)

In Active Directory Users and Computers, under Users, I have a distribution group called adrmssuperuser with email ******@domain.com

Subsequently, I added this group as the super user group in the Active Directory Rights Management Services console.

In that group, I added the FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 user. This user is enabled.

Additionally, I have tried the steps listed here, which involves turning off InternalLicensingEnabled, deleting directories C:\ProgramData\Microsoft\DRM\Server, rebooting and then reenabling IRM. This did not work for me.

My Assumptions

Since the other checks for the exchange server has passed, there may not be an issue with the permissions for the files in the ADRMS server, and that ADRMS and Exchange Server are able to communicate.

Could there be an issue with the FederatedEmail permissions? But from what I have read, it just needs to be in the Super Users group for ADRMS.

Has anyone faced a similar issue even after doing the resolution steps? Is there anything I could be missing in my configuration?

Answer 1

Great to know that the issue has already been resolved and thanks for sharing the solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer : )     

--------------   

Issue Symptom: 

Test-IRMConfiguration: Failed to acquire a use license.

 

Resolution: 

Troubleshooting:

• Running Test-IRMConfiguration in EMS fails - Exchange | Microsoft Learn as you have shared
• Setting AD RMS super user as security group
• Recreating federated email user
• Adding the rms service account to the domain admins group [Reference] and adding exchange servers group to ADRMS Super User [Reference]

And finally, as it mentioned in this documentation:

If a super user's group is already configured on an AD RMS cluster, any modifications to the distribution group membership can take up to 24 hours to be refreshed by the AD RMS cluster. This is a result of caching the group membership on the cluster.

The problem disappeared just after waiting one day.

Answer 2

Hi,

This problem can occur if the FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 had been deleted and recreated. After reconfiguring the AD-RMS Super Users Group, the above error will still occur.

To fix this error, you can follow the steps below:

• Turn off IRM. Run the command:

    Set-IRMConfiguration -InternalLicensingEnabled $false
  

• Backup and delete the directories in .C:\ProgramData\Microsoft\DRM\Server(Note: The Server folder is a hidden system folder and you will need to unselect the Hide protected operating system files to view the folder.)
• Reboot.
• Enable IRM. Run the command:

    Set-IRMConfiguration -InternalLicensingEnabled $true
  

• Test IRM.

    Test-IRMConfiguration -sender [******@domain.com]
  

More details you can refer to: Running Test-IRMConfiguration in EMS fails - Exchange | Microsoft Learn

Hope this helps. Please feel free to contact me for any updates.