Huntress found four paths to an AD RMS root key that cannot be rotated

Persistence is the property Microsoft's own documentation keeps returning to: the protection travels with the file no matter where it goes or how it is transported ^[9]. A holder of the cluster's private key inherits that property. The gold padlock on an old non-forwardable Outlook message and the SharePoint library that hands out already-encrypted downloads ^[16] both resolve against that one key.

Nothing in the product is malfunctioning, so there is no CVE here and no patch. Microsoft's threat model for RMS lists what the system deliberately does not stop: a recipient photographing their screen, retyping content by hand, malware capturing plaintext once an authorized user has opened the file ^[10]. Those are enforcement-boundary problems. Huntress argues that the design took the server's own signing key for granted, on the assumption that the servers holding it and the accounts with access to it would be guarded like privileged assets ^[11].

Part 1 lays out the map; the extraction work is held for Part 2 ^[14]. The one route named so far is service-group membership ^[4]. That moves remediation out of the patch pipeline and into group review: on the research's account, whoever sits in the AD RMS service group can reach a private key with no rotation path behind it ^[4][5]. The only outside review named to date is feedback from Aaron Margosis and Sean Metcalf on the post itself ^[17].

One number wobbles. The stated endpoints, 2002 and 2258, span 256 years, a year more than the 255-year validity the post gives ^[12]. It changes nothing either way, since the research states an extracted private key decrypts content past the certificate window regardless ^[5].

The claim that the role is still everywhere is an argument built from reasons, not a tally. Huntress supports it with the reasons admins stay put: AD RMS still works, still ships supported on the current server OS ^[7], and migration is expensive and risky ^[13]. No deployment figure appears in the post ^[15]. Whether this reaches a given estate is answered by that estate's role inventory. That inventory is cheap, and so is the next step after it: locating a cluster and reading the templates that describe what the organization considered worth protecting needs nothing more than an ordinary domain account ^[8].