Summary
- Windows updates will enforce AD FS Distributed Key Manager (DKM) container ACL hardening to mitigate an elevation-of-privilege vulnerability.
- Organizations running Active Directory Federation Services (AD FS) should validate DKM container permissions while Audit mode is still available.
- Supported Windows Server versions will automatically remediate insecure DKM ACLs unless administrators opt out; Windows Server 2012 and 2012 R2 require manual remediation.
- Admins should review AD FS Admin event logs for Event ID 1132 and update AD FS servers with a current Windows security update before enforcement.
- Microsoft provides guidance for testing and remediation in the linked CVE-2026-56155 documentation.
Microsoft 365 Message Center ID: MC1471963
Primary Service: Windows
Admin Impact: High
User Impact: Low
Release Start: 01 Oct 2026
Release End: 01 Oct 2026
Last Modified: September 15, 2026
Category: Message Center
Tags: New feature
Status: Launched
Products & Platforms: Windows
History
9/14/2026 Item Added to Message Center
Microsoft Message
In October 2026, Windows updates will begin Enforcement mode for AD FS Distributed Key Manager (DKM) container ACL hardening. This hardening change is designed to address the elevation of privilege vulnerability documented in CVE-2026-56155 by automatically remediating insecure DKM container ACL configurations on supported Windows Server versions.
If your organization uses Active Directory Federation Services (AD FS), use the remaining Audit mode period to validate DKM container permissions, identify compatibility issues, and complete preparation before Enforcement mode begins.
Rollout schedule
Enforcement mode begins with the October 2026 Windows security update.
Impact on your organization
Organizations using AD FS might see changes to DKM container permissions when remediation is applied during Enforcement mode. During the October 2026 update, supported Windows Server versions will run remediation by default unless administrators explicitly opt out. Windows Server 2012 and Windows Server 2012 R2 still require manual remediation and will not be automatically remediated.
Action required/recommendations
Organizations using AD FS should:
- Install the July 14, 2026 Windows security update or a later Windows update on AD FS servers.
- Review AD FS Admin event logs for Event ID 1132, which indicates that DKM container permissions require attention.
- Test remediation during the current Audit mode phase and address findings before Enforcement mode begins in October 2026.
- See the guidance in: CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening.