And Microsoft, literally call it the DRM flag. DRM doesn't insist on being encrypted.

https://learn.microsoft.com/en-us/windows/client-management/...

And that "simple Windows API" call is pretty much absolute, since it's across the stack.