Susannah Matt

Huntress found four paths to an AD RMS root key that cannot be rotated

Six weeks of lab work on a role Microsoft no longer develops but still supports on Windows Server 2025 ended with an offline decrypt of a protected document and a private key stamped valid until 2258 that nobody can rotate.