AD FS DKM container hardening
Observed content change
18 new passages (about 1020 words), 12 edited passages (179 words changed), 27 removed passages (about 610 words). The changed wording mentions dates and deadlines, defaults, prerequisites, permissions, supported platforms, mitigations, settings and controls. Review the source to confirm the effect.
May need admin actionCheck whether new requirements apply to your setup; check whether a default changed for your tenant or devices; check the roles and permissions you grant.
[removed: Note]Original publish date: July 14, 2026 …
[added: Opting out of automatic remediation]
[added: Ownership failure event case (Event ID 1137)]
Event reference[added: s]
[added: Change log]
Short quotes of Microsoft's changed wording from Microsoft source, © Microsoft Corporation. Read the page for the full text.
Read the current Microsoft source · Link to this observation · Compare any two versions
Sections to inspect
- CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening
- In this article
- Summary
- Take action
- Expected secure state changes
- Opting out of automatic remediation
- Ownership failure event case (Event ID 1137)
- Save the previous SDDL (Recommended)
- How to restore the previous ACL
- Event references
- Change log
- How to manage this change
Up to 12 section headings from retained before/after evidence. The current source may have changed again.
Why this was flagged
The changed words, with a few words around them, matched these rule categories: dates and deadlines, defaults, prerequisites, permissions, supported platforms, mitigations, settings and controls. These matches identify subjects to assess; they do not establish a policy change or applicability.
Observation details · observed 19 Oct 00:53 UTC
- Observed by ChangeIntel
- 19 Oct 00:53 UTC
- Source update metadata
- 13 Oct 17:29 UTC
- Source review date
- 2026-07-14
- First observed on this installation
- 12 Oct 19:19 UTC
- Last successful check
- today 13:32 UTC
- Next check due
- today 19:32 UTC
Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.
Watch this page to review its changes in My radar.
Timeline
From the capture of 19 Oct 00:53 UTC- 2 dates
- 2 relative periods
- 7 undated sections
- 7 with conditions
- 30 recorded changes
- Opt-in14 Jul 2026 Now: You can turn it on early; the default is unchanged
- 3 months agoOpt-in
- SummaryMilestone
The Access Control List (ACL) on the Distributed Key Manager (DKM) container entered its first hardening phase with the July…
- 7 days ago
- SummaryMilestone
RemediateDkmAclCVE-2026-56155
Settings and overrides named on this page
Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.
RemediateDkmAclOverride13 Oct 2026SeSecurityPrivilege
Relative periods
Counted from an event the source describes, such as installing an update; they are not calendar dates.
RemediateDkmAcl- every 24 hours · within 24 hoursEvent textin Event referencesRequirementExceptionRecommendationTentative3 conditions
RemediateDkmAcl
Requirements, exceptions and scope
Save the previous SDDL (Recommended)…
RemediateDkmAclRemediateDkmAclSeSecurityPrivilege
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
-
-
every 24 hours
-
October 2026 -
October 2026 -
July 14, 2026
-
July 14, 2026 -
October 13, 2026
-
-
-
-
-
18 earlier changes
Observed history and review priority
Captured 19 Oct 00:53 UTC; extracted 19 Oct 00:54 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.
Review priority. Previously extracted guidance is missing from a later capture · Extracted assertions require review · Publisher marks guidance tentative · Applicability or exceptions require review · A published date window is near
0 date changes and 0 condition changes across 1 compared revisions. Suggested check interval: 6 hours.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 2
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 19 Oct 00:53 UTC · 29 candidates
- 12 Oct 19:19 UTC · 16 candidates
Related public evidence
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Denial of Service Vulnerability
Retained observations
- 19 Oct 00:53 UTC · shown above
- 12 Oct 19:19 UTC
Baseline for retained history; no earlier retained text to compare.
What changed
First observed 18 Oct 2026- 19 Oct 2026 How to manage this changeOctober 2026 · Audit / monitor → No longer listed in this observation. Previously: October 2026 · Audit / monitor
- 19 Oct 2026 Relative periodswithin 24 hours → every 24 hours; within 24 hours
- 19 Oct 2026 Summary (2)13 Oct 2026
- 19 Oct 2026 Summary14 Jul 2026 → 14 Jul 2026 · Opt-in
- 19 Oct 2026 SummaryMicrosoft's guidance publishes 2 dates, from 14 Jul 2026 to October 2026 (How to manage this change). → Microsoft's guidance publishes 2 dates, from 14 Jul 2026 to 13 Oct 2026 (Summary).
The most recent 100 field changes are listed. Complete recorded revisions are kept separately.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.