다음을 통해 공유

AD RMS How To: Disable IRM Functionality for Some Office Applications

  • 아티클

An interesting question was posed to me. "How can I disable DRM for all my Office 2010 applications except for Outlook?" My initial reaction was that this is not possible. I know how to disable it for all Office applications on a client but not pick and choose. A few minutes with Bing and conferring with a peer and I found two possible solutions.

Note: I've not tested these to any great extent. Please test.

Solution One: Disable IRM functionality for all Office applications

Per Office Registry Settings on TechNet, there is a value to disable IRM for all of the installed Office applications.

The registry location depends on the version of Office (e.g. 2016) and the architecture (x86 or x64). For my example here I am using the generic HKCU\Software\Microsoft pathing. Please see the TechNet article for the specifics.

Disable all RMS functionality

To disable IRM, both creation and consumption, for all Office applications on the client set the following registry value.

HKCU\Software\Microsoft\Office\16.0\Common\DRM

Name:  Disable

Type:  DWORD

Value: 0/1

0 = No functionality affected by this registry key

1 = All IRM functionality is removed; IRM is disabled

To disable just the creation of IRM documents for all Office applications on the client set the following registry value.

HKCU\Software\Microsoft\Office\16.0\Common\DRM

Value Name:  DisableCreation

Value Type:  DWORD

Value Data: 0/1

0 = No functionality affected by this registry key

1 = IRM protection options are removed; you can still consume protected files.

These options exist in the Office Templates with the following names:

IRM Disable User Interface disables the ability to consume OR create protected content. (completely disabled)

Prevent Users from Changing Permissions prevent users from creating protected content, but consumption is allowed.

Solution Two: Disable IRM in the GUI for specific Office applications

This solution allows specific applications to have IRM functionality disabled in the GUI. These settings may be managed via GPO or the registry. End users should either see greyed out buttons or they may be hidden.

Download the appropriate guide for the version of Office in use. Locate the appropriate GUI options for disabling. My limited (quick) research discovered the following settings for Word, Excel, and PowerPoint.

To disable IRM GUI for the desired Office application set the following registry values. Note, these may be used with the Office group policy templates or via a group policy pushing out registry preferences. When doing the manual preferences note that the values are written to the Policies key under Software.

  • HKCU\Software\Policies\Microsoft\Office\14.0\Word\DisabledCmdBarItemsList
  • HKCU\Software\Policies\Microsoft\Office\14.0\Excel\DisabledCmdBarItemsList
  • HKCU\Software\Policies\Microsoft\Office\14.0\PowerPoint\DisabledCmdBarItemsList

  • Value Name: TCID1

    Value Type: REG_SZ

    Value Data: 7990

TCID 7990 disables the items on the flyout menu of File / Info / Protect Document / Restrict Access option.

TCID 195519 removes the whole Protect Document option.

Refer to the Office interface control identifiers documentation to find other values.

Solution Three: Exclude the applications on the RMS server

This solution does not require any client-side management. Use the Exclude Applications feature in the AD RMS console. Enable the feature and add the desired applications to be excluded. NOTE: This only prevents the consumption of protected files in the specified application. It doesn't impact creation or hide any options from the client.

See Also