· When you open the app, it would prompt you for signing in for using edit / create functionalities. Or you can choose to skip signing in. This would open app only to view the files/documents.

· In case you want to use full features of app, you can activate it using your O365 E3 account or buy subscription.

· To activate the Office App, click on Activate option in the app. You would see screen to “Activate or buy subscription”

· To activate, select Activate by Signing in.

· As seen in the next screenshot, the app would prompt you for email address which was created for your Office 365 E3 plan. Please enter your official email ID.

· Please key in the password for your account and press “Sign in”

· When your password is set, you would see the screen as depicted below.

· Now you can start using PowerPoint, Word or Excel with all the functionalities.

How many times you receive mails that you thought can be easily identify mails which were sent to you in TO field and marked to you in CC...so that you can read the ones with you in TO on priority to those in CC.

Outlook allows you to organize the mails and color them based on who sent it or what word the mail had or if you were in TO or CC or explicitly to you etc.

This was available in Outlook 2007 under Organize option...but it is really difficult to search this option in Outlook 2010.

So I have created a doc that allows you to set this option in Outlook 2010............

Color coding the mails.docx

Data Classification Toolkit for Windows Server 2008 R2 (Beta) helps organizations consistently identify, classify, and protect data across multiple file servers. The Toolkit contains classification knowledge and scripted processes that help automate the file classification process and help make file management more efficient.

Data Classification Toolkit for Windows Server 2008 R2 uses Windows Server 2008 R2 File Classification Infrastructure to classify files based on predefined knowledge contained within the toolkit. The toolkit also contains predefined automation tasks that can be used to help manage files based on their classification.  The toolkit includes predefined reports that can be viewed using Microsoft® Office Excel® 2010. The toolkit can also help organizations quickly create their own file classification solutions.

The best part is - Post the classification of data automatically by the Toolkit, the solution can trigger RMS protection of data based on templates defined. This means, that the data would not only be classified but also protected :)

You can refer to FCI + RMS integration details on knowing how to deploy this integration.

You can access the beta download from below mentioned link -

https://technet.microsoft.com/en-us/library/hh204743.aspx

For example – if Amol is Asst. GM in a organization, then there could be 2 accounts for Amol to work on -

1. one is Amol AD account and mailbox…for Amol as an individual.
2. Second is AGM AD account and mailbox….for AGM role/position. This account would be provided to next person would comes on this role when I get transfer or promoted to different position.

Usually, AGM account would be used by secretaries for scheduling and filtering the information and passing on to their respective superiors. Where the Amol account would be used by Amol without any delegation…

In order to cut down the requirement to log off and log on to access different mailboxes, IT usually configures Outlook profiles for both mailboxes and select prompt option so that the user is prompt which mailbox to use when opening outlook. This allows the high post individuals to swap between mailboxes without having to log-off and log-on to AD with different accounts.

RMS issues

The above scenario does not work seamlessly for RMS. As RMS uses AD credentials when CLC and EUL are created based on who the user is logged on as.

That is, when I logon as AMOL to the desktop using domain authentication, and open Outlook using AMOL profile (personal mailbox), I would be able to open the mails which are RMS protected easily as CLC and EUL would be downloaded for AD account AMOL.

When I switch the mailbox to AGM…and try to open the RMS protected mail, I would not be able to open the message and would encounter “unexpected error”. This would not be work as CLC/EUL would be still in AMOL’s name and the mail would not have assigned access to AMOL rather would have assigned access to AGM account based on role.

This means the user would have to log off from AMOL’s account and logon to AGM account and then access the RMS protected mail. This would not be an acceptable solution from the end-user perspective.

The challenge is how do we enable the user to access the RMS protected mails when they switch from one profile to another.

Solution

• Since the user is logs on with one AD account and needs to access mails that are intended for another AD user, it is important that the user be prompted for authentication again. So that the appropriate credentials be put in.
• So, in the Internet Explorer => Options => Security Tab, remove RMS URL from the Intranet or Trusted Zone. This would enable RMS to prompt users for credentials.
• When the user authenticates to RMS, the CLC and EUL is generated. If user swaps the Outlook profile and tries to access RMS protected mail for another AD account, the CLC and EUL would be checked and credentials would clash with them. Hence there would be error opening the mail.
• So we need to clear the DRM folder.
• Create a batch file with following command =>

del %userprofile%\AppData\Local\Microsoft\DRM\* /F /Q

echo “cache cleared….you are set to go”

• User needs to be run this batch file so that all the certificates are cleared. When user opens personal mailbox and tries to access RMS protected mail – he/she would be prompted for AD credentials. He/She needs to enter their individual AD account.
• When the user swaps the Outlook profile to position based mailbox, they need to run the batch file again.

The solution works well…only additional step of running the batch file is involved when swapping between Outlook profile.

String (Indexable)

• Refresh the schema.
• In the HR inbound rule –

Map Status => estatus

• In the AD Outbound Sync rule
  • Go to Outbound attribute mapping tab

IIF(customexpression(Eq(estatus,”Active”)),512,514)èuseraccountcontrol

• Ensure that the useraccountcontrol attribute mapping is not selected as “initial flow”.

Whenever the status in HR is changed i.e. no more active, it would disable the account on AD.

• Similarly, update the outbound sync rules for other applications to reflect the status of employee in HR.

The value in estatus can be whatever the HR is sending across. It could be active or 001 or anything.

You can download the eval copy from

https://technet.microsoft.com/hi-in/evalcenter/cc872861.aspx

Prerequisites

• AD RMS deployed and running
• RMS Client deployed on end-user machines
• MS Office document should get RMS protected.
• Windows 2008 R2 Server being used as File Server (Shared Folders) which is joined in to the AD Domain
• RMS Bulk Protection tool downloaded.
• RMS Templates created and distributed. At least, a template should exists that allow access to employees (from example perspective).

Configuring the File Server for FCI

Installing the AD RMS bulk protection tool

1. Log on to the File Server as Administrator.

2. Navigate to where you downloaded the tool and double-click rmsbulk.msi. This will bring up the Rights Management Services Bulk Protection Tool Setup wizard.

3. On the Welcome to the Rights Management Services Bulk Protection Tool Setup Wizard screen, click Next.

4. On the End-User License Agreement screen, read the EULA, click I accept the terms in the License Agreement and click Next.

5. On the Destination Folder screen, click the Change button and navigate to C:\Windows\SysWOW64 and click OK. Verify the path is now SysWOW64 and click Next.

6. On the Ready to install Rights Management Services Bulk Protection Tool screen, click Install.

7. On the Completed the Rights Management Services Bulk Protection Tool Setup Wizard screen, click Finish

Grant FCI Machine Account Read and Execute Permissions

Step to grant the FCI machine account read and execute permissions to the ServerCertification.asmx page. This is required because it allows the AD RMS Bulk Protection Tool to run under the local system account on the FCI server.

1. Log on to AD RMS Server as Administrator

2. Click Start, select Computer, double-click Local Disk (C:), double-click inetpub, double-click wwwroot, double-click _wmcs, double-click certification, right-click ServerCertification.asmx and select Properties. This will bring up the ServerCertification.asmx Properties.

3. On the ServerCertification.asmx properties, select the Security tab, and then click Edit. This will bring up the Permissions for ServerCertification.asmx.

4. On the Permissions for ServerCertification.asmx screen, click Add. This will bring up the Select Users, Computers, or Groups screen.

5. On the Select Users, Computers, or Groups screen, to the right, click the Object Types… button. This will bring up the Object Types screen.

6. On the Object Types screen, place a check in Computers and click Ok. This will close the Object Types screen.

7. On the Select Users, Computers, or Groups screen, under Enter the object names to select, enter the user/groups you want and click Check Names. This should resolve with an underline. Click Ok.

8. On the Permissions for ServerCertification.asmx screen, select the newly added Domain_name\FCI$ and verify it has a check in Read & execute. Click Apply Click Ok. This will close the Permissions for ServerCertification.asmx screen.

9. On the ServerCertification.asmx properties, click Ok. This will close the ServerCertification.asmx properties.

Grant AD RMS Service Group Read and Execute Permissions

This step is to grant AD RMS Service Group read and execute permissions to the ServerCertification.asmx page. This is required because it allows the AD RMS Bulk Protection Tool to run under the local system account on the FCI server.

1. Log on to AD RMS Server as Administrator

2. Click Start, select Computer, double-click Local Disk (C:), double-click inetpub, double-click wwwroot, double-click _wmcs, double-click certification, right-click ServerCertification.asmx and select Properties. This will bring up the ServerCertification.asmx Properties.

3. On the ServerCertification.asmx properties, select the Security tab, select New, and click Edit. This will bring up the Permissions for ServerCertification.asmx.

4. On the Permissions for ServerCertification.asmx screen, click Add. This will bring up the Select Users, Computers, or Groups screen.

5. On the Select Users, Computers, or Groups screen, under Enter the object names to select, enter ADRMS\AD RMS Service Group and click Check Names. This should resolve with an underline. Click Ok.

6. On the Permissions for ServerCertification.asmx screen, select the newly added AD RMS Service Group and verify it has a check in Read & execute. Click Apply Click Ok. This will close the Permissions for ServerCertification.asmx screen.

7. On the ServerCertification.asmx properties, click Ok. This will close the ServerCertification.asmx properties.

8. Restart the AD RMS server.

Create the shared folder on File Server

It’s assumed that you already have the shared folder, but just in case you don’t you can create using the following steps –

1. Log on to File Server as Administrator

2. Click Start, click Computer, and then double-click Local Disk (C:).

3. Click File, point to New, and then click Folder.

4. Type SharedDocuments for the new folder, and then press ENTER.

5. Right-click SharedDocuments, click Share with, and then click Specific people.

6. On the File Sharing window, in the box under Type a name and then click Add, or click the arrow to find someone select Everyone, then and click Add. The Everyone group should now appear in the box below. Under Permission Level, select Read/Write.

7. Click Share. The window should change and you should now see Your folder is shared.

8. Click Done.

Assign Send As rights to FCI Server (file server)

This step would enable organizations to grant the FCI machine account the Send As right on the Administrator account. This will allow the FCI machine to send e-mail notifications as the Administrator when documents are rights protected

1. Log on to the AD Server as Administrator.

2. Click Start, select Administrative Tools, and click Active Directory Users and Computers.

3. At the top, select View and then select Advanced Features from the drop-down.

4. On the left, expand domain_name.com click the Users organizational unit. On the right, right-click Administrator and then select Properties. This will bring up the Administrator Properties window.

5. On the Administrator Properties screen, select the Security tab and click Add. This will bring up the Select Users, Computers, or Groups screen.

6. On the Select Users, Computers, or Groups screen, to the right, click the Object Types… button. This will bring up the Object Types screen.

7. On the Object Types screen, place a check in Computers and click Ok. This will close the Object Types screen.

8. On the Select Users, Computers, or Groups screen, under Enter the object names to select, enter domain_name\FCI and click Check Names. This should resolve with an underline. Click Ok.

9. Under Groups or user names: make sure FCI (Domain_name\FCI$) is select.

10. On the Permissions for FCI locate Send As and select Allow. Click Apply Click Ok. This will close the Administrators Properties screen.

11. Close Active Directory Users and Computers

·

Configure FCI for email notification

This section allows FCI machine account the Send As right on the Administrator account. This will allow the File Server to send e-mail notifications as the Administrator when documents are rights protected.

1. Log on to File Server as Administrator

2. Click Start, click Administrative Tools, and click File Server Resource Manager.

3. In the File Server Resource Manager, on the right, under Actions, click Configure Options. This will bring up the File Server Resource Manager Options.

4. Under SMTP server name or IP address, enter xxx.domain_name.com.

5. Under Default administrator recipients, enter administrator@ domain_name.com.

6. Under Default “From” e-mail address, enter administrator@ domain_name.com.

7. Click OK.

Important

You can test this by using the Send Test E-mail button that is provided on the File Server Resource Manager Options page.

Change Timeout on Certification Path Validation Settings

This section enables changing the default path validation cumulative retrieval timeout from 20 seconds to 2 seconds. This is required because the servers do not have access to the internet. If this GPO setting is not changed then the AD RMS Bulk Protection Tool will fail when attempting to activate the FCI server. This is only required because the server does not have internet access.

1. Log on to the AD Server as Administrator.

2. Click Start, select Administrative Tools, and click Group Policy Management.

3. Expand Forest: Forest.com, expand Domains, expand Domain_name.com, right-click Default Domain Policy, and then select edit. This will bring up the Group Policy Management Editor.

4. On the left, expand Computer Configuration, expand Windows Settings, expand Security Settings, and click Public Key Policies.

5. On the right, right-click Certificate Path Validation Settings and click Properties. This will bring up the Certificate Path Validation Settings Properties.

6. On the Certificate Path Validation Settings screen, click the Network Retrieval tab.

7. On the Network Retrieval screen, place a check in Define these policy settings and in the middle, change Default path validation cumulative retrieval timeout (in seconds) to 2.

8. Click Apply and Ok. This will close the Certificate Path Validation Settings.

9. Close Group Policy Management.

Refresh the policy on the FCI server

· 1. Log on to the File Server as Administrator · 2. Click Start, and click Command Prompt. This will open a command prompt window. · 3. From the command prompt, type gpupdate /force and hit Enter. Once this is complete is should say that the user and computer policies were updated successfully. · 4. Close the Command Prompt.

Create Business Impact Classification Property

This section enables creation of the Business Impact Classification Property. Classification properties are used to assign values to files. There are many property types that you can choose from, and you can define them based on the policies your organization wants to enforce. This will be an ordered list property. A value of High will indicate that the document has a high business impact, while a value of Low will represent a low business impact.

1. Log on to File Server as Administrator

2. Click Start, click Administrative Tools, and click File Server Resource Manager.

3. In the File Server Resource Manager, on the left, expand Classification Management, and right-click Classification Properties, and select Create Property. This will bring up the Create Classification Property Definition window.

4. Under Property name, enter Business Impact.

5. Under Description, enter Describes the impact to the business if this file were to be disclosed to the public. Valid values are High and Low..

6. Under Property type, enter Ordered List.

7. Down under Value enter High. This will add a row below the value we just entered.

8. Under the High value we just added, enter Low.

9. Click OK.

Create dateEncrypted Classification Property

· Steps to create the dateEncrypted Classification Property. It allows for tracking which files have already been encrypted and do not need to be encrypted again. This will be a Date-Time property. It will indicate when the file was last encrypted.

·

1. Log on to File Server as Administrator

2. Click Start, click Administrative Tools, and click File Server Resource Manager.

3. In the File Server Resource Manager, on the left, expand Classification Management, and right-click Classification Properties, and select Create Property. This will bring up the Create Classification Property Definition window.

4. Under Property name, enter dateEncrypted.

5. Under Description, enter When this document was encrypted..

6. Under Property type, enter Date-Time.

7. Click OK.

·

Create LBI Classification Rule

Steps to create the LBI Classification Rule. This rule will classify all of our documents with an LBI property value. Later the HBI Classification Rule will override these LBI values if the documents match the criteria in the HBI Classification rule.

1. Log on to File Server as Administrator

2. Click Start, click Administrative Tools, and click File Server Resource Manager.

3. In the File Server Resource Manager, on the left, expand Classification Management, and right-click Classification Rules, and select Create a New Rule. This will bring up the Classification Rule Definitions window.

4. Under Rule name:, enter Low Business Impact.

5. Under Description, enter Classify all documents with low business impact by default.

6. Under Scope, click Add and browse to SharedDocuments. Click OK

7. At the top, click the Classification tab.

8. Under Choose a method to assign the property value, select Folder Classifier from the drop-down.

9. Under Choose a property value to be assigned, select Business Impact Classification Property from the drop-down.

10. Under Property value to be assigned, select Low from the drop-down.

11. Click OK.

Restrict Files to Organization’s Employees

Steps to demonstrate how to create a file management task to restrict access of low business impact files to Organizations employees. This task will apply the Organization Confidential rights policy template to all of the documents that have been classified with a Low property and that have not already been encrypted. The original owner of the file will retain full control of the AD RMS protection, unless the owner is not registered in Active Directory. In that case, the Administrator will gain full control of the AD RMS protection on the file. It will also send an e-mail message to the owner of each file when it is encrypted.

1. Log on to File Server as Administrator 2. Copy the script from Appendix A into notepad and save it as c:\windows\system32\MarkLBIandProtect.ps1. 3. Click Start, click Administrative Tools, and click File Server Resource Manager. 4. In the File Server Resource Manager, on the left, right-click File Management Tasks, and select Create File Management Task. This will bring up the Create File Management Task window. 5. Under Task name:, enter Restrict files to employees of Organization. 6. Under Description, enter Apply Organization Confidential rights policy. 7. Under Scope, click Add and browse to SharedDocuments. Click OK 8. At the top, click the Action tab. 9. Under Type, select Custom from the drop-down. 10. Under Executable, select Browse and navigate to c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe. 11. Under Arguments, enter -File c:\windows\system32\MarkLBIandProtect.ps1 [Source File Path] [Source File Owner Email] administrator@domain_name.com. 12. Under Run the command as:, select Local System. 13. At the top, click the Condition tab. 14. Click Add. This will bring up the Property Condition window. 15. On the Property Condition window, make sure Property: is set to Business Impact, set the Operator: to Equals, and for the Value: select Low from the drop-down. Click Ok. 16. Click Add. This will bring up the Property Condition window. 17. On the Property Condition window, make sure Property: is set to dateEncrypted, and select not exist for the condition. Click OK. 18. At the top, click the Notification tab. 19. Click Add. This will bring up the Add Notification window. 20. Set the Number of days before the task is executed to send notification to 0. 21. Check Send e-mail to the following administrators: 22. In the box, enter administrator@Domain_name.com. 23. Check Send e-mail to the user whose files are about to expire. 24. Under Subject: enter File encrypted. 25. Click OK. 26. At the top, click the Schedule tab. 27. On the Schedule tab, click Create. This will bring up the Schedule window. 28. On the Schedule window, click New. 29. Except the defaults and click Ok. This will close the Schedule window. · 30. Click OK. This will close the Create File Management Task window.

Important

After the installation of PowerShell, the execution of scripts is disabled by default.
You must enable your system to run the scripts. This can be done by using the following command: Set-Executionpolicy Unrestricted.
Alternatively, the execution policy can be set to signed and the script can be signed. For more information about this topic, please see  Running Windows PowerShell Scripts (https://go.microsoft.com/fwlink/?LinkID=119588).

MarkLBIandProtect Windows Powershell Script

· PowerShell Script to restrict access to employees

-------------------------------------------------------------------------------------------

# execute bulk tool

$encryptfile = '"' + $args[0] + '"'

$owneremail = $args[1]

if ($owneremail -eq "[Source")

{

$owneremail = $args[5]

}

$r = start-process –Wait –PassThru –FilePath C:\Windows\SysWOW64\RmsBulk.exe –ArgumentList “/encrypt”, $encryptfile, “\\xxxx.Domain_name.com\ADRMSPublic\Organization_Confidential.xml”, $owneremail, “/log”, “C:\Documents\RmsLog.log”, “/append”, “/preserveattributes”

if ($r.ExitCode –eq 0)

{

$c = new-object –com Fsrm.FsrmClassificationManager

$d = (get-date).toFileTimeUTC()

$d = $d - ($d % 10000000)

$c.SetFileProperty($args[0], “dateEncrypted”, $d.ToString())

}

-------------------------------------------------------------------------------------------

· Where \\xxxx.Domain_name.com\ADRMSPublic\Organization_Confidential.xml is the path for Organization confidential template.

1. Perform the RMS protection of documents using command line
2. Decrypt the documents using command line

This utility can allow the desktop level protection of document located in folders…..or on shared folders.

With the integration of FCI, this powerful utility can provide more complex functions like applying RMS protection based on Classification of folder or file.

I would try and post that as my next :)

Demo of RMS Bulk protection tool

Sentillion provides quite well-known products like -

vThere is the world's first packaged desktop virtualization solution designed for enterprise use

Please visit Forefront team blog on how this acquisition aligns with Business Ready Security -

https://blogs.technet.com/forefront/archive/2009/12/10/microsoft-to-acquire-sentillion-for-improved-healthcare-through-streamlined-identity-and-access.aspx

Details on Sentillion – www.sentillion.com

The Product team has released a new RMS Bulk Protection tool that can -

• Rights Protect the file/s on desktop or Server using a defined RMS Template
• Decrypt the rights protected file/s
• Bulk decrypt RMS supported files and items within Outlook PSTs
• Extensible to other file formats via IRM protector implementation or custom plug-ins
• can be used with FCI to classify and rights protect the documents

Much desired and awaited utility that can help thousands of users like us.

File Classification index

Windows 2008 R2 server has the feature called File Classification Index (FCI).

FCI allows organizations to scan the Files/folders for content, pattern, keywords, etc and classify them. For e.g. there are certain folders on the Windows 2008 R2 server.

The folder may have documents related to Project A. FCI can be configured to search the folder for document with keyword “Project A” and classify these files are Project A confidential.

Once the FCI has classified the files, RMS Bulk Protection utility can be executed to rights protect these classified files with relevant RMS Template.

So what do we get – completely automated RMS protection with document classification :)

More details on FCI can be availed at

https://www.microsoft.com/windowsserver2008/en/us/fci.aspx

System Requirements to use the AD RMS Bulk protection tool -

• Windows XP, Windows Vista, Windows 7, and Windows Server 2008 R2
• Note:  The tool requires installation of RMS Client SP2 and .NET Framework 2.0 SP2 on Windows XP
• Outlook 2007 is needed for decrypting items within PST files

Syntax to use AD RMS Bulk protection tool

The syntax to execute the RMS Bulk Protection tool is -

RMSBulk [/decrypt location] [/encrypt location rms_template [owner_email]] [/log log_file [/append] [/simple]] [/preserveattributes] [/silent]

where -

  /decrypt location: Decrypt all RMS protected content under location

  /encrypt location rms_template [owner_email]: Encrypt all content under location to rms_template and grant owner_email OWNER right

  /log log_file: Log output to log_file

  /append: Append output to log_file

  /simple: Simple single-line logging

  /preserveattributes: Preserve all file attributes

  /silent: Disable console output

Example of this commands are available help file….

• RMSBulk.exe /decrypt \\Share\Folder /log RMSBulk.log
• RMSBulk.exe /encrypt C:\Documents\Folder C:\RMSTemplates\Template.xml  /log C:\Logs\RMSBulk.log
• RMSBulk.exe /encrypt \\Share\file.doc ContosoConfidential.xml joe@contoso.com  /log C:\Logs\RMSBulk.log /append /simple /preserveattributes

In coming few days, I am going to put in steps to show you the FCI and RMS Bulk protection tool integration and some video demonstrating the same too.

Keep looking for the update to this blog… :)