Situation

Your AD RMS client is a workgroup client, you installed Office 2013 or 2016, and setup the discovery service by registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSIPC\ServiceLocation\EnterpriseCertification
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSIPC\ServiceLocation\EnterprisePublishing

However, you encountered the following error message:

This document is protected, and we couldn't connect to the Internet to check your permission. Please try again when you are online. 

Resolution

This might be because the Office is a 32-bit version but installed on a 64-bit platform. Use the Wow6432Node to setup the client side service discovery.

reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\MSIPC\ServiceLocation\EnterprisePublishing /ve /d https://rms.contoso.com/_wmcs/licensing /f
reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\MSIPC\ServiceLocation\EnterpriseCertification /ve /d https://rms.contoso.com/_wmcs/certification /f

Other tips

• DNS resolution for the RMS server
• Try opening the URLs from IE to see if connectable
• Clear MSIPC cache (by removing both of them below)
  • %LocalAppdata%\Microsoft\MSIPC\Templates
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\MSIPC
• If you are using Office 2013, make sure it is up to date