Some users must enter their credentials when they access rights-protected messages even though you have deployed the Rights Management Services (RMS) prelicensing agent on an Exchange Server 2007 SP1-based server

In a Microsoft Exchange Server 2007 Service Pack 1 (SP1) environment, you can deploy a Rights Management Services (RMS) prelicensing agent. Therefore, you expect that Outlook users can access rights-protected messages directly instead of having to provide their credentials after they have already logged on to their mailboxes. However, some users must still provide thier credentials when they access the right-protected messages.

During the original prelicensing process, the RMS prelicensing agent tries to use the value of the msExchMasterAccountSID fields to find the home forest for each recipient and to find the address for the each recipient's RMS certification server. This issue occurs when the value msExchMasterAccountSid fields for some users are set to "S-1-5-10" or "self." When this is true, the corresponding checks are not successful. Therefore, the home forest is not returned, and the user cannot be prelicensed on the computer.

To resolve this problem, download Update Rollup 4 for Exchange 2007 Service Pack 1. Then, install Update Rollup 4 on the Exchange server. For more information about Update Rollup 4 for Exchange Server 2007 Service Pack 1, see the following Exchange Help topic: For more information about how to obtain the latest Exchange service pack or update rollup, see the following Exchange Help topic:

For more information about the RMS prelicensing agent, visit the following Web site:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.