A rights account certificate (RAC) can be excluded by specifying either the user's e-mail address or the RAC public key string. When you exclude a user’s RAC, AD RMS adds the excluded key, the user’s account name, as well as the date and time of the exclusion to the DRMS_GicExclusionList table of the configuration database for the root cluster.
This results pane lists all of the excluded users of the AD RMS cluster.