AD FS Distributed Key Manager (DKM) container ACL hardening begins today
What and why
Beginning with the October 2026 Windows security update, AD FS Distributed Key Manager (DKM) container access control list (ACL) hardening enters Enforcement mode. These protections address the elevation of privilege vulnerability described in CVE-2026-56155 by automatically remediating insecure DKM container ACL configurations on supported versions of Windows Server.
Rollout schedule
Enforcement mode starts with the October 2026 Windows security update.
Impact on your organization
After you install the October 2026 Windows security update, supported Windows Server versions apply remediation by default unless administrators explicitly opt out. This remediation can modify DKM container permissions in AD FS environments. Windows Server 2012 and Windows Server 2012 R2 require manual remediation and don’t receive automatic remediation.
Action required/recommendations
Organizations using AD FS should:
- Install the July 14, 2026 Windows security update or a later Windows update on AD FS servers.
- Review AD FS Admin event logs for Event ID 1132, which indicates that DKM container permissions need attention.
- Resolve any outstanding DKM container permission or compatibility issues identified during Audit mode.
- Verify that your environment is prepared for default remediation or explicitly opt out if necessary.
- See the guidance in: CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.
Compliance considerations
No compliance considerations are identified. Review as appropriate for your organization.