Users were getting the following error message on the citrix environment however they were not getting the errors on the local machine when applying a sensitivity label within word. The fix should also apply if the error is happening on the local machine

First check AIP is not getting blocked by running the following script in powershell:

$request = [System.Net.HttpWebRequest]::Create("https://admin.na.aadrm.com/admin/admin.svc")     
$request.GetResponse()
$request.ServicePoint.Certificate.Issuer

The script should response with the certificate issuer if the machine can communicate with AIP

If the above fails then communication is blocked and needs resolving. Should the devices respond but is still failing to apply a label then action the below

Resolution:

Close all office applications

Delete RMS registry settings for the user 

Open regedit

Navigate to HKCU\Software\Microsoft\Office\XXX\Common\DRM
Delete the DefaultServer and DefaultServerURL values

Navigate to HKCU\Software\Classes\Local Settings\Software\Microsoft\MSIPC

Delete the server name key that corresponds to the RMS server

Ensure both the registry path under MSIPC and the key values within DRM have been removed

Next is to remove the existing licences, GICs etc..

Browse to the users %localappdata%\Microsoft\MSIPC folder and delete the folder

Contents within the folder for reference

Once the folder has been removed, re-open word and try again

This process can be created into a script for automation, please use the below as an example:

REM ***Delete the RMS registry settings for the user. 

reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\DRMC /v "DefaultServer" /f
reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\DRMC /v "DefaultServerUrl" /f


REM ***Find and delete RMS Server/Cluster

for /f "delims=" %%a in (' 
    reg query "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\MSIPC" ^|
    find "rms.eu.aadrm.com"
') do (
     set "regs=%%a"
)

reg delete "%regs%" /f


REM ***Clear the existing licenses, GICs (RACs), and etc.

REM rmdir /S /Q %localappdata%\microsoft\MSIPC 
md %localappdata%\temp_RMS
robocopy %localappdata%\Temp_RMS %localappdata%\Microsoft\MSIPC /mir