MC1442510 Medium
90-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
Summary AI-generated
Starting October 2026, Windows updates will enforce AD FS DKM container ACL hardening to remediate privilege escalation risk (CVE-2026-56155); review permissions now.
Suggested actions AI-generated
- Install July 2026 or later Windows updates on AD FS servers
- Review AD FS Admin logs for Event ID 1132
- Test remediation during Audit mode before October 2026
- Review CVE-2026-56155 guidance
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1456735 60-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
- MC1471963 30-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
- MC1506287 AD FS Distributed Key Manager (DKM) container ACL hardening begins today
- MC1388721 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update
- MC1254512 (Updated) Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
Original post from Microsoft
What and why
Windows updates released in October 2026 will begin Enforcement mode for AD FS Distributed Key Manager (DKM) container ACL hardening. This change is designed to address the elevation of privilege vulnerability documented in CVE-2026-56155 by automatically remediating insecure DKM container ACL configurations on supported Windows Server versions.
Organizations using Active Directory Federation Services (AD FS) should use the current Audit mode period to review DKM container permissions and identify potential compatibility issues before enforcement begins.
Rollout schedule
Enforcement mode begins with the October 2026 Windows security update.
Impact on your organization
Organizations using AD FS might experience changes to DKM container permissions when remediation is applied during Enforcement mode. Starting with the October 2026 update, remediation will run by default on supported Windows Server versions unless administrators explicitly opt out. Windows Server 2012 and Windows Server 2012 R2 require manual remediation and are not automatically remediated.
Action required/recommendations
Organizations using AD FS should:
- Install the July 2026 Windows security update or a later Windows update on AD FS servers.
- Review AD FS Admin event logs for Event ID 1132, which indicates that DKM container permissions require attention.
- Review and test remediation during the current Audit mode phase before Enforcement mode begins in October 2026.
- Review the guidance in: CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.
Compliance considerations
No compliance considerations are identified. Review as appropriate for your organization.