MC1506287 Low
AD FS Distributed Key Manager (DKM) container ACL hardening begins today
Summary AI-generated
Automatic remediation of insecure AD FS Distributed Key Manager container ACLs starts with October 2026 Windows security update to address CVE-2026-56155.
Suggested actions AI-generated
- Install July 14, 2026 or later Windows security update on AD FS servers
- Review AD FS Admin event logs for Event ID 1132
- Resolve DKM container permission and compatibility issues
- Verify readiness for default remediation or opt out
- Consult CVE-2026-56155 guidance
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1456735 60-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
- MC1442510 90-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
- MC1471963 30-Day Reminder: AD FS DKM container ACL hardening begins in October 2026
- MC1254512 (Updated) Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
- MC1388721 30-Day Reminder: Final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update
- MC1279830 Second deployment phase for Kerberos RC4 hardening begins with the April 2026 Windows security update
Original post from Microsoft
What and why
Beginning with the October 2026 Windows security update, AD FS Distributed Key Manager (DKM) container access control list (ACL) hardening enters Enforcement mode. These protections address the elevation of privilege vulnerability described in CVE-2026-56155 by automatically remediating insecure DKM container ACL configurations on supported versions of Windows Server.
Rollout schedule
Enforcement mode starts with the October 2026 Windows security update.
Impact on your organization
After you install the October 2026 Windows security update, supported Windows Server versions apply remediation by default unless administrators explicitly opt out. This remediation can modify DKM container permissions in AD FS environments. Windows Server 2012 and Windows Server 2012 R2 require manual remediation and don’t receive automatic remediation.
Action required/recommendations
Organizations using AD FS should:
- Install the July 14, 2026 Windows security update or a later Windows update on AD FS servers.
- Review AD FS Admin event logs for Event ID 1132, which indicates that DKM container permissions need attention.
- Resolve any outstanding DKM container permission or compatibility issues identified during Audit mode.
- Verify that your environment is prepared for default remediation or explicitly opt out if necessary.
- See the guidance in: CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.
Compliance considerations
No compliance considerations are identified. Review as appropriate for your organization.