从 FSRM 任务运行时出现 AD RMS PowerShell 错误 - 2012R2

Question

尝试运行 FCI PowerShell 脚本时遇到问题。请参阅下面的错误。

我创建了一个精简版的脚本，基本上只包含Protect-RMSFile cmdlet，并得到与上述相同的错误。这适用于本地 ADRMS。当我从File Server Resource Manager > File Management Tasks > [Task] > Run File Management Task Now 运行任务时，调试日志显示错误。我将任务作为本地系统运行。我读过可能需要将一些 ipsec* DLL 复制到各种文件夹中，并且这样做了。

如果我直接从 PowerShell 运行 Protect-RMSFile，它会完美执行并按预期保护文件。如果将相同的命令作为文件管理任务运行，则会出错。

[2017-05-16T08:53:44.5232269-07:00] [INFORMATIONAL] [214] Logging location : C:\Users\Default\AppData\Local\Microsoft\MSIPC\pscmdlet\Logs\debug.log ["C:\\Users\\Default\\AppData\\Local\\Microsoft\\MSIPC\\pscmdlet\\Logs\\debug.log"]
[2017-05-16T08:53:44.6638518-07:00] [INFORMATIONAL] [215] Working directory : C:\Windows\TEMP\RMSProtection\4o1gco3x.xjl ["C:\\Windows\\TEMP\\RMSProtection\\4o1gco3x.xjl"]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] Calling IpcInitialize... ["Calling IpcInitialize..."]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] Calling IpcSetStoreName... ["Calling IpcSetStoreName..."]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] IpcSetStoreName successful... ["IpcSetStoreName successful..."]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] IpcInitialize successful ["IpcInitialize successful"]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] +IpcSetApplicationId ["+IpcSetApplicationId"]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] +IpcSetApplicationId ["+IpcSetApplicationId"]
[2017-05-16T08:53:44.6638518-07:00] [VERBOSE] [401] Client mode already initialized ["Client mode already initialized"]
[2017-05-16T08:53:44.6794764-07:00] [INFORMATIONAL] [301] Starting Protection Version : 2.0.0.0 ["Protection","2.0.0.0","2017-05-16 15:53:44Z"]
[2017-05-16T08:53:44.6794764-07:00] [VERBOSE] [401] Starting 2.0.0.0 Version : 2017-05-16 15:53:44Z ["Starting 2.0.0.0 Version : 2017-05-16 15:53:44Z"]
[2017-05-16T08:53:44.6794764-07:00] [INFORMATIONAL] [212] Component : 'File1-415e47b19d2b.pdf' moved from 'New' to 'Protected' ["File1-415e47b19d2b.pdf","New","Protected"]
[2017-05-16T08:53:44.6794764-07:00] [VERBOSE] [204] Protecting : File1-415e47b19d2b.pdf ["File1-415e47b19d2b.pdf"]
[2017-05-16T08:53:44.6794764-07:00] [VERBOSE] [205] Encrypting : C:\PROTECTED\2\OUTPUT\File1-415e47b19d2b.pdf ["C:\\PROTECTED\\2\\OUTPUT\\File1-415e47b19d2b.pdf"]
[2017-05-16T08:53:44.6794764-07:00] [VERBOSE] [401] Calling IpcfEncryptFile ["Calling IpcfEncryptFile"]
[2017-05-16T08:53:44.6951020-07:00] [VERBOSE] [401] Calling IpcCreateLicenseFromTemplateId... ["Calling IpcCreateLicenseFromTemplateId..."]
[2017-05-16T08:53:44.7263515-07:00] [INFORMATIONAL] [212] Component : 'File1-415e47b19d2b.pdf' moved from 'Protected' to 'Errored' ["File1-415e47b19d2b.pdf","Protected","Errored"]
[2017-05-16T08:53:45.0232260-07:00] [ERROR] [504] Error protecting File1-415e47b19d2b.pdf with error: The system cannot find the file specified. HRESULT: 0x80070002
at Microsoft.InformationProtectionAndControl.SafeNativeMethods.ThrowOnErrorCode(Int32 hrError)
at Microsoft.InformationProtectionAndControl.SafeNativeMethods.IpcCreateLicenseFromTemplateId(String templateId)
at RMSProtection.Core.Protection.FileProtection.BuildLicense(FileProtectionConfig config)
at RMSProtection.Core.Protection.FileProtection.<>c__DisplayClass3.<Protect>b__1()
at RMSProtection.Core.Protection.FileProtection.EncryptFile(Func`1 action, FileSystemInfo sourceFile)
at RMSProtection.Core.Protection.Protector.ProtectFile(Component component, FileSystemInfo file, FileProtectionConfig options)
at RMSProtection.Core.Protection.Protector.Protect(Component component, FileProtectionConfig options) ["File1-415e47b19d2b.pdf","The system cannot find the file specified. HRESULT: 0x80070002","   at Microsoft.InformationProtectionAndControl.SafeNativeMethods.ThrowOnErrorCode(Int32 hrError)\r\n   at Microsoft.InformationProtectionAndControl.SafeNativeMethods.IpcCreateLicenseFromTemplateId(String templateId)\r\n   at RMSProtection.Core.Protection.FileProtection.BuildLicense(FileProtectionConfig config)\r\n   at RMSProtection.Core.Protection.FileProtection.<>c__DisplayClass3.<Protect>b__1()\r\n   at RMSProtection.Core.Protection.FileProtection.EncryptFile(Func`1 action, FileSystemInfo sourceFile)\r\n   at RMSProtection.Core.Protection.Protector.ProtectFile(Component component, FileSystemInfo file, FileProtectionConfig options)\r\n   at RMSProtection.Core.Protection.Protector.Protect(Component component, FileProtectionConfig options)"]
[2017-05-16T08:53:45.0232260-07:00] [LOGALWAYS] [602] Id : 1, Type : FileLeaf, Description : File1-415e47b19d2b.pdf, Location : File1-415e47b19d2b.pdf, TempFilePath: C:\PROTECTED\2\OUTPUT\File1-415e47b19d2b.pdf, Error : Failed to protect ["1","FileLeaf","File1-415e47b19d2b.pdf","File1-415e47b19d2b.pdf","C:\\PROTECTED\\2\\OUTPUT\\File1-415e47b19d2b.pdf","Failed to protect"]
[2017-05-16T08:53:45.0232260-07:00] [VERBOSE] [401] 1 ["1"]
[2017-05-16T08:53:45.0232260-07:00] [INFORMATIONAL] [302] Completed Protection after '0:00:00.3480937', successfully completed processing of 0 of 1 items, failed processing 1 of 1 ["Protection","0:00:00.3480937",0,1,1]

Answer 1

这不适用于 AD RMS。错误“系统找不到指定的文件”与丢失的 RMS 策略模板文件有关。 FSRM 任务作为本地系统、本地服务或网络服务运行 - 这些帐户无法根据 MSIPC 客户端引导以按预期使用 AD RMS 策略模板。

以下是我的建议： - 使用最新 AIP 预览客户端的 AIP Powershell cmdlet - 查看“IntegratedAuth”功能（目前仅预览）https://docs.microsoft.com/en-us/powershell/module/azureinformationprotection/Set-RMSServerAuthentication?view=azureipps。这应该在服务器模式下运行命令（作为计算机帐户，必须在每个 AD RMS 服务器上的 ServerCertification.asmx 上获得授权）