Q: Can I apply Windows Rights Management Services (RMS) protection to PDF files? Can the Rights Protected Folder (RPF) Explorer tool help?

A: The RMS protection that's bundled with Windows and Microsoft Office can by default be applied only to certain file formats. Out-of-the-box, you can add RMS protection only to file types that are accessed from Word, Excel, PowerPoint, InfoPath, and XML Paper Specification (XPS) applications. You can buy software extensions to apply RMS protection to other file formats (including .pdf, but also .cad and other file types) from Microsoft partners such as GigaTrust, Foxit, or Liquid Machines (now part of Check Point Software Technologies).

Microsoft recently released the RPF Explorer tool, which offers another option for protecting file types that don't support RMS natively on the application level. You can use RPF Explorer to create a Rights Protected Folder. The RPF Explorer really offers a workaround for protecting these file types with RMS: It lets you wrap an RMS-protected folder around files.

You can compare an RPF to an RMS-specific ZIP file. An RPF controls access to the files it contains, no matter where the folder is located. Using the RPF Explorer, you can securely store or send files to your selected authorized users and control which users can access the files in the RPF. An important limitation is that the RPF Explorer controls only the users who can extract files from an RPF; it can't control access to files after they're extracted from the folder.

To use RPF Explorer, you must have a working Active Directory Rights Management Services (AD RMS) installation in your Active Directory (AD) forest. RPF Explorer leverages the RMS policies that are defined in your AD. These are the same RMS policies you can select from within applications such as Word, Excel, or Outlook to protect documents, spreadsheets, or messages. When you create a new RPF with RPF Explorer, you select an RMS policy to protect the contents of the RPF, or you can create your own custom policy. The RPF Explorer tool (RPFExplorer.exe) can be used for creating RPFs both from the Windows GUI and from the command line. For more information on how to use RPF Explorer, I refer you to the Microsoft TechNet article "Rights Protected Folder Explorer."

You can install RPF Explorer on a Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 machine. To use RPF Explorer, your Windows computer must have the AD RMS client 2.0 and the .NET Framework 4.0 (or later) software installed. You can download RPF Explorer from the Microsoft Download Center: Rights Protected Folder Explorer.