AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

An AD RMS Service Group account exports the AD RMS Server Licensor Certificate private key. That 1172-byte key decrypts every document the deployment ever protected, offline, and keeps doing so after the deployment is rebuilt.