Microsoft Warns AD FS Admins: Automatic DKM Security Hardening Begins October 13

Microsoft issued an operationally important 90-day reminder on July 29, 2026 for organizations that run Active Directory Federation Services (AD FS). The July Windows security update has already placed AD FS Distributed Key Manager (DKM) access-control hardening into Audit mode. On October 13, 2026, supported Windows Server versions will begin automatically remediating insecure DKM container permissions unless an administrator explicitly opts out.

Important distinction: this is a same-day Microsoft support advisory, not a new Patch Tuesday release, not a consumer Windows emergency update, and not an Insider build. The underlying security update and CVE were released July 14. Microsoft’s July 29 notice is the 90-day operational deadline for AD FS administrators.

What Changed Today

Microsoft’s Windows message center posted a 90-day reminder for CVE-2026-56155, an elevation-of-privilege vulnerability involving the permissions on the AD FS DKM container in Active Directory. AD FS stores symmetric keys in that container to protect token-signing and token-encryption certificate private keys. If the access-control list is too permissive, an attacker who can read the DKM key material may be able to decrypt those private keys.

The official Microsoft guidance in KB5121391 says the July 14 security update begins with detection only. The AD FS service checks the DKM container ACL after the service starts and every 24 hours. The October security update moves supported servers into Enforcement mode, where Windows can automatically remove unexpected permissions and establish Microsoft’s secure ACL baseline.

Who Is Affected — And Who Is Not

Environment	What this advisory means
Windows Server 2016, 2019, 2022, version 23H2, or 2025 running AD FS	Affected. Install the July 2026 security update or later, review the AD FS/Admin log, test remediation, and prepare for automatic enforcement on October 13.
Windows Server 2012 or 2012 R2 ESU running AD FS	Affected, but October auto-remediation does not apply. Administrators must grant the AD FS service account the required permissions and remediate manually according to Microsoft’s platform-specific procedure.
Windows Server with Active Directory but no AD FS role/farm	Not directly affected by this AD FS DKM change. Continue normal Windows Server patching.
Microsoft Entra ID-only businesses	Generally not affected unless the organization also operates on-premises AD FS for federation.
Home Windows 10 or Windows 11 PCs	Not affected by this server-side advisory. No special registry change is needed on a home PC.
Macs	Not affected. Apple did not list a new macOS security release for July 29 as of this check.

How To Check Your AD FS Servers Now

1. Confirm whether you actually run AD FS. Check Server Manager, your identity architecture documentation, and your federation sign-in configuration. Do not make DKM or registry changes on ordinary domain controllers or client PCs.
2. Confirm patch status on every AD FS server in the farm. Microsoft requires the July 14, 2026 Windows security update or a later cumulative update. Our July 2026 Patch Tuesday guide explains the broader Windows release, but this deadline requires a separate AD FS review.
3. Open Event Viewer and inspect the AD FS/Admin log. Detection runs about one minute after AD FS starts and then every 24 hours.
4. Interpret the result. Event 1132 means the ACL does not match the secure state; 1133 means the ACL is healthy; 1134 means detection failed and requires troubleshooting.
5. Document any nonstandard permissions before remediation. Find out why they exist, who depends on them, and whether removing them could affect federation, certificate operations, monitoring, backup, or a legacy integration.
6. Back up and test. Verify a current system-state/Active Directory recovery plan, export relevant configuration, capture the current ACL, and schedule a maintenance window before opting in.

Microsoft’s Expected Secure ACL

After remediation, Microsoft says inheritance is disabled and inherited access-control entries are discarded. Only these principals should remain:

• Domain Admins: Full Control
• Enterprise Admins: Full Control
• SYSTEM: Full Control
• The AD FS service account: Read, Write, Create Child, Write Owner, and Delete Tree

This is why administrators should not treat the October change as a routine reboot. An unexpected permission may be insecure, but it may also reveal an undocumented dependency that should be fixed before enforcement removes it.

The Registry Setting: Use It Carefully

For Windows Server 2016 and later, Microsoft provides an opt-in remediation value named RemediateDkmAcl under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS. Setting the DWORD to 1 enables remediation during Audit mode; a successful run records Event 1135 and preserves the previous ACL in SDDL format. Starting with the October update, remediation runs by default even if the value was never created. A value of 0 opts out, but Microsoft warns that this leaves the insecure ACL in place.

Caution: do not copy a registry command from a summary and run it blindly. Back up the registry and the current ACL, read Microsoft’s full KB5121391 procedure, test federation sign-ins, and have a rollback plan. Windows Server 2012 and 2012 R2 require additional service-account permission work before the opt-in value can succeed.

Good And Bad News

Home And Small-Business Action Plan

For Home Users

No action is required for this AD FS advisory. Keep Windows Update enabled and do not add or change the AD FS registry path on a personal PC. The July 28 Windows 11 release was an optional non-security preview update, which is different from today’s server advisory.

For Businesses With Managed IT

• Ask whether your sign-in environment uses AD FS, pass-through authentication, password-hash synchronization, or Entra ID only.
• Require a report of AD FS/Admin Events 1132–1134 from every farm.
• Test opt-in remediation on a representative farm before October 13.
• Verify sign-in, token issuance, certificate rollover, monitoring, backup, and disaster-recovery procedures after the ACL change.
• Record any temporary opt-out as a formal risk exception with an owner and expiration date.

If you need help identifying legacy federation dependencies or planning a controlled maintenance window, review The IT Guys’ small-business IT services or schedule an appointment.

What About Apple And macOS Today?

Apple’s official security releases page did not list a new July 29 macOS security release, Rapid Security Response, or same-day Mac system advisory when this article was prepared. Apple’s latest Mac security releases remain the July 27 updates: macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and Safari 26.6. See our July 27 Apple Mac security update guide for those releases.

Frequently Asked Questions

Is Microsoft releasing a new Windows security patch on July 29?

No. Microsoft’s same-day item is a 90-day support reminder tied to the July 14 security update and CVE-2026-56155. It is operationally important for AD FS administrators, but it is not another Patch Tuesday release.

Does this affect ordinary Active Directory domain controllers?

The advisory specifically concerns the DKM container used by AD FS. A business can run Active Directory without running AD FS. Confirm your architecture before making changes.

What happens on October 13, 2026?

On supported Windows Server 2016-and-later AD FS systems, the October Windows update begins Enforcement mode and auto-remediation runs by default. Server 2012 and 2012 R2 are excluded from automatic remediation and need manual work.

Can we opt out?

Microsoft documents an opt-out by setting RemediateDkmAcl to 0, but detection continues and the insecure state remains. Treat an opt-out as a temporary, documented exception—not the final fix.

How do we know remediation worked?

Event 1135 reports successful remediation and includes the previous ACL in SDDL format. Event 1136 reports a remediation failure. Validate actual federation and sign-in behavior after the change; an event alone does not prove every business dependency still works.

Official Sources

• Microsoft Windows message center — July 29, 2026 90-day reminder
• Microsoft KB5121391: AD FS DKM container ACL hardening
• Microsoft Security Response Center: CVE-2026-56155
• Apple security releases

Source check completed July 29, 2026 at 7 PM Eastern. Microsoft may revise servicing guidance, so administrators should re-read the official KB before changing production permissions.