COMMAND EVERYTHING.

Initialize-RmsCryptoMode2

Prepares an AD RMS server for transitioning to Cryptographic Mode 2.

PowerShell · Risk: Critical · Documentation Verified

Last verified: 2026-10-26

Microsoft ADRMSADMIN reference: Prepares an AD RMS server for transitioning to Cryptographic Mode 2. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Initialize-RmsCryptoMode2 -FilePath <String[]> [-CspName <String>] [-Regenerate] [-Force] [-Path] <String[]>
 [-WhatIf] [-Confirm] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Initialize-RmsCryptoMode2. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / ADRMSADMIN · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Confirm: Prompts you for confirmation before running the cmdlet.
-CspName: Specifies the name of the cryptographic service provider (CSP) to use for generating the mode 2 TUD when this cmdlet is executed. This CSP must be of the type PROV_RSA_AES to support mode 2 operation (in contrast to mode 1 keys which use the CSP type PROV_RSA_FULL). The *CspName* parameter is for CSP-based installs only. If a CSP name is specified for a server with a centrally managed key, an error is returned if this parameter is included in the command.
-FilePath (required): Specifies the name and location for the file generated when this cmdlet is executed. This file contains the mode 2 SLC (server licensor certificate) which is exported as part of transitioning a trusted user domain (TUD) to mode operation.
-Force: Forces the cmdlet to save (overwrite) an existing file if one is found to exist under the name and location specified as part of the *FilePath* parameter.
-Path (required): This parameter is for CSP-based installs only. If a CSP name is specified for a server with a centrally managed key, an error is returned if this parameter is included in the command.
-Regenerate: Forces the AD RMS server to generate a new key even if the cmdlet has previously run. This overwrites any previously generated key. Because you can run this cmdlet multiple times, if this parameter is omitted, the same key is exported each subsequent time the cmdlet is run.
-WhatIf: Shows what would happen if the cmdlet runs. The cmdlet is not run.

Prerequisites

Windows with the ADRMSADMIN module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1: Export the SLC

Initialize-RmsCryptoMode2 -Path "." -FilePath "c:\test.tud"

This command exports the server licensor certificate (SLC) for the current AD RMS server to the trusted user domain c:\test.tud for a server that uses centrally managed keys. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/ADRMSADMIN/Initialize-RmsCryptoMode2.md

https://learn.microsoft.com/powershell/module/adrmsadmin/initialize-rmscryptomode2?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands