StashGrid

Home › The Stash

AD FS DKM ACL Hardening Lands 13 October 2026

TrainingOctober 15, 2026

Identity ticketUpdated 14 Oct 2026

Identity ticket of the week. If you still run AD FS, the October 2026 Windows update changes the permissions on your key store for you — and a backup or service account that leaned on an extra permission can lose access the moment you patch.

What changed

The 13 October 2026 Windows security update makes AD FS clean up the ACL on its DKM (Distributed Key Manager) container automatically: it disables inheritance, drops inherited and extra explicit Allow entries, and leaves only Domain Admins, Enterprise Admins and SYSTEM with full control, plus the AD FS service account (CVE-2026-56155, per Microsoft’s KB). The 14 July 2026 update only detected and let you opt in; from 13 October the remediation runs by default (the update applies to Server 2012 ESU through 2025, and farms first built on Server 2012 or 2012 R2 are the ones most likely to fail on taking ownership of the container).

The tickets it will generate

  • “Our AD FS backup job started failing right after Patch Tuesday.”
  • “The monitoring account can’t read the AD FS config container any more.”
  • “Nothing changed on our side, but the key-export script is throwing access denied.”

This is an admin-facing change, not an end-user one. The tickets come from your own automation, not from staff — which is exactly why they’re easy to miss until a restore fails.

What to check

  • The AD FS Admin event log: 1132 (insecure, remediation attempted), 1133 (already secure), 1134 (detection error, often LDAP connectivity), 1135 (remediated), 1136 (remediation failed — read the correlated 510) and 1137 (couldn’t take ownership; the service account lacks rights).
  • Save the SDDL now: the before-and-after ACL is written as SDDL in the Event 510 entries correlated with 1135 by Instance ID. The Admin log rolls over on size, and Microsoft says the old SDDL is then gone for good.
  • The live ACL: read it on the DKM container (under CN=ADFS,CN=Microsoft,CN=Program Data in your domain) with dsacls, confirm only the expected principals remain, then check every backup, monitoring or key-management account that used to touch it.

The line for the help desk

Heads-up for whoever owns AD FS: this week’s Windows update (CVE-2026-56155) tightens the permissions on the AD FS key container automatically. Logins keep working, but any backup, monitoring or script account that had extra access to that container will now be denied. Check the AD FS Admin log for event 1135, save the SDDL it records before the log rolls over, and re-grant only the access your tooling genuinely needs.

Microsoft is closing a Golden-SAML-shaped hole by taking write access away from things that shouldn’t have had it. Good. Just know it decides what ‘shouldn’t’ means on its own, at patch time, and your backup account doesn’t get a vote. — Nyx

What we have not verified. We don’t run an AD FS farm to patch. The event IDs, the ACL Microsoft leaves behind and the SDDL-in-510 behaviour are from Microsoft’s own KB for CVE-2026-56155; which accounts actually break depends entirely on how your farm was delegated, which we can’t see. Microsoft lists the update for Server 2012 ESU through 2025 but does not spell out which versions only detect versus remediate, so confirm the behaviour on your build.

Go deeper