Category
stayInformed
Severity
normal
Major change
False
Last modified
2026-08-17 21:01:36
Summary source
Azure OpenAI (gpt-4.1)
Action by (Graph)
—
Action by (AI)
2026-10-01 00:00:00
Services
Windows
Tags
Admin impact
Master tags
Admin, Security
Roadmap IDs
One-line summary
October 2026 Windows updates will enforce AD FS DKM container ACL hardening to address CVE-2026-56155, automatically remediating insecure configs on supported Windows Server versions.
Similar updates
More like thisMC1194065 Latest on Windows quality updates out of the box – now disabled by default
MC1187403 (Updated) Automatic Windows event auditing configuration now available for unified sensors (V3.x)
MC1193628 The December 2025 Windows security update is now available
MC1191556 Windows news you can use: November 2025
MC1192217 Secure Boot AMA: Ask Microsoft Anything on December 10
MC1191616 Microsoft Secure Score: New recommendations for Microsoft Defender for Endpoint
Details
Body (from Message Center)
What and why
Windows updates released in October 2026 will begin Enforcement mode for AD FS Distributed Key Manager (DKM) container ACL hardening. This hardening change is designed to address the elevation of privilege vulnerability documented in CVE-2026-56155 by automatically remediating insecure DKM container ACL configurations on supported Windows Server versions.
Organizations using Active Directory Federation Services (AD FS) should use the remaining Audit mode period to review DKM container permissions, identify compatibility issues, and complete preparation before Enforcement mode begins.
Rollout schedule
Enforcement mode begins with the October 2026 Windows security update.
Impact on your organization
Organizations using AD FS might experience changes to DKM container permissions when remediation is applied during Enforcement mode. With the October 2026 Windows security update, supported Windows Server versions will run remediation by default unless administrators explicitly opt out. Windows Server 2012 and Windows Server 2012 R2 still require manual remediation and will not be automatically remediated.
Action required/recommendations
Organizations using AD FS should:
- Install the July 2026 Windows security update or a later Windows update on AD FS servers.
- Review AD FS Admin event logs for Event ID 1132, which indicates that DKM container permissions require attention.
- Review and test remediation during the current Audit mode phase before Enforcement mode begins in October 2026.
- See the guidance in: CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.
Compliance considerations
No compliance considerations are identified. Review as appropriate for your organization.
Raw JSON (for debugging)
Expand/collapse the full payload below.
Show/hide raw
{
"snapshot_item": {
"action_required_by": null,
"ai_action_required_by": "2026-10-01T00:00:00Z",
"ai_actions": [
"Install July 2026 or later Windows security update on AD FS servers",
"Review AD FS Admin event logs for Event ID 1132",
"Test DKM container remediation in Audit mode before October 2026"
],
"ai_master_tags": [
"Admin",
"Security"
],
"ai_model": "gpt-4.1",
"ai_summary": "October 2026 Windows updates will enforce AD FS DKM container ACL hardening to address CVE-2026-56155, automatically remediating insecure configs on supported Windows Server versions.",
"ai_topics": [
"Windows",
"Entra"
],
"category": "stayInformed",
"details_map": {},
"id": "MC1456735",
"importance": 2,
"is_major_change": false,
"last_modified": "2026-08-17T21:01:36Z",
"ms_products": [
"Windows"
],
"platforms": null,
"roadmap_ids": [],
"services": [
"Windows"
],
"severity": "normal",
"tags": [
"Admin impact"
],
"title": "60-Day Reminder: AD FS DKM container ACL hardening begins in October 2026"
}
}