When a new AD RMS cluster is provisioned, a method to protect the AD RMS cluster key is chosen. If you chose the default option of using AD RMS cluster key protection, you specified a strong password that was used to encrypt the cluster key in the configuration database. The AD RMS cluster key is used to sign the certificates and licenses granted by the cluster. The cluster key is generated and the password specified during the initial configuration of the AD RMS server role.
If you are running AD RMS in a clustered environment, and you decided to reset the cluster key, it must be completed on every AD RMS server in the cluster. If you do not, those servers will not be able function as they will be unable to decrypt the cluster key in the configuration database.
|
Important |
|
This procedure applies only if you are using AD RMS to centrally manage the cluster key. If you are using either a hardware-based or software-based cryptographic service provider (CSP), consult the documentation of the CSP manufacturer. |
Membership in the AD RMS Enterprise Administrators and the local Administrators group, or equivalent, is the minimum required to complete this procedure.
|
To reset the cluster key password |
-
Log on to a server in the AD RMS cluster.
-
Open the Active Directory Rights Management Services console and expand the AD RMS cluster.
-
In the console tree, expand Security Policies, and then click Change cluster key password.
-
In the Cluster Key Password wizard, type the new password for the cluster key in the Password box.
-
In the Confirm Password box, type the new password again.
-
Click Apply to complete the password reset.
-
Repeat steps 1–6 for each server in the AD RMS cluster.
Additional considerations
- You can also perform the task described in
this procedure by using Windows PowerShell. For more information
about Windows PowerShell for AD RMS, see http://go.microsoft.com/fwlink/?LinkId=136806.