AD FS: DKM container ACL hardening now enforced with October 2026 update (CVE-2026-56155)

Summary

With the October 13, 2026 Windows security update, Microsoft moved the ACL (access control list) hardening of the AD FS Distributed Key Manager (DKM) container into Enforcement mode. It addresses the elevation of privilege vulnerability CVE-2026-56155. On supported Windows Server versions, AD FS remediates insecure ACLs automatically unless administrators opted out. Windows Server 2012 and 2012 R2 require manual remediation. The change is live.

What changes?

After the update, AD FS checks the DKM container ACL at service start and every 24 hours and, if it is insecure, rewrites it. Only Domain Admins, Enterprise Admins, System and the AD FS service account keep access; inheritance is disabled and other explicit Allow entries are removed. Setups that relied on other permissions may break. Check the AD FS Admin event log: 1133 = secure, 1132 = insecure (remediation follows), 1134 = detection error, 1135 = remediation successful, 1136 = remediation failed, 1137 = ownership change failed (service account lacks WriteOwner/WriteDacl, mostly on farms created on Windows Server 2012/2012 R2).

Affected

• Windows Server 2016, 2019, 2022 and 2025 with AD FS and the update from October 13, 2026 or later: automatic remediation
• Windows Server 2012 and 2012 R2 (ESU): no automatic remediation, manual remediation required
• The DKM container is one AD object shared by all servers in the farm
• Related article: KB5121391

Preparation and temporary exceptions

1. Opting out is not recommended because it leaves the DKM container ACL insecure.
2. If required for compatibility, set the DWORD value RemediateDkmAcl to 0 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS on every AD FS server in the farm before installing the update.
3. If one server has the value missing or nonzero, that server can still remediate the shared container.
4. For Event ID 1137: grant the AD FS service account explicit Allow rights WriteOwner and WriteDacl on the DKM container (steps in KB5121391), then restart the AD FS service or wait up to 24 hours.

Check and complete

Enforcement mode began on 2026-10-13. Install the update on all AD FS servers and verify the result via Event IDs 1133 or 1135. After Event ID 1135, save the previous ACL (SDDL) from the correlated Event ID 510 entries, as event logs can roll over.

Recommendation

Install the October 2026 or later update on all AD FS servers, check the AD FS Admin log for events 1132 to 1137 and test AD FS sign-in. Save the previous SDDL after successful remediation. Remediate Windows Server 2012 and 2012 R2 manually. Do not opt out without a documented reason.

Timeline

1. 14 Jul 2026First hardening phase (Audit mode): automatic detection of insecure DKM container ACLs and opt-in remediation.
2. 13 Oct 2026Enforcement mode: AD FS remediates insecure DKM container ACLs by default unless RemediateDkmAcl is set to 0.

Sources

• Windows message center: AD FS DKM container ACL hardening begins today Vendor · support.microsoft.com
• KB5121391: CVE-2026-56155 AD FS DKM container ACL hardening Vendor · support.microsoft.com
• CVE-2026-56155 Vendor · msrc.microsoft.com

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:15.