The super user feature is your fallback scenario to ensure that you can inspect and unprotect RMS secured information. The super user always has full owner rights.
Remember the following best practices:
Check that the super user feature is enabled with the following command:
Get-AadrmSuperUserFeatureThe results will be disabled or enabled.
Limit and monitor the administrators who are assigned global administrator rights or in special assigned with the
Add-AadrmRoleBasedAdministratorcommand.You can check the actual configured administrators with the following command:
Get-AadrmRoleBasedAdministrator
If you want to check which users and accounts are assigned to the super users, you can use the command
Get-Aadrm-SuperUser:
To get the log information for all administrative tasks, you can use the
Get-AadrmAdminLog -Path "C:\ActualLog.log"command and you will receive the whole details, as shown in the following example:
We recommend that the super user feature...