AD RMS Philosophy.

Question

Hi everyone, how do people work with RMS in the real world?
I’m going to make the presumption that in a company you can’t guarantee people not to steal documents. You can only make it more difficult for people to steal documents. When I say steal I mean that a person that has permission to a document,
simply copies-mails, drop box, etc, this documents to someone outside the company without authorization to read this document.
 Assuming this let’s get to the point.
I have a client who has thousands of documents that are stored of lots of files shares. Inside these file shares there are many folders and subfolders and many of these subfolders have inheritance disabled.
The client wants to protect every existing document and new documents, so that if the documents leave the company, these will be RMS protected.
One simple way to do this is with File Server Resource Manager and File Management Tasks. With these tools you could apply a RMS policy template to the existing files and new files under a certain folder. Not sure of the performance impact
on the file servers for thousands of files. The policy template would have the read, edit,save permisions plus the NTFS permissions (the combination of most restrictive would win). Inside the company the users would work as usual. If someone manages to bypass
company’s protection and steal a document, it would be useless because it has RMS and the RMS server is not published to the internet.
Would this be a correct approach?
Any suggestions greatly appreciated.
Regards,
Ivan Mckenzie

Answer 1

Hi Ivan,
I am not sure about the term "steal documents".
RMS is first of all a way to protect documents regardless if they are in motion or stored on a disk, regardless if the data is in a email , or on a thumb drive. The protection always "travels" with. So that helps honest people to stay honest and a great
way to bring security policies to life. Where it does not help if someone makes a screenshot with a smartphone etc.
You might think again about the whole in the company and remote thing, because you if users send out emails the data is outside of the companies network. One other thing with Exchange and Outlook RMS has also a pre-licensing, what allows users to read emails
they have just received before they left the office on the road. So you would have to disable all this (I call it a convenience feature).
Regards,
Lutz