Original publish date: July 14, 2026
KB ID: 5121391
In this article
- Summary
- Take action
- Expected secure state changes
- Opting out of automatic remediation
- Ownership failure event case (Event ID 1137)
- Save the previous SDDL (Recommended)
- How to restore the previous ACL
- Event references
- Change log
Summary
The Access Control List (ACL) on the Distributed Key Manager (DKM) container entered its first hardening phase with the July 14, 2026 Windows security update, which introduced automatic detection of insecure ACLs and an opt-in remediation mechanism.
Starting with the October 13, 2026 Windows security update, AD FS automatically remediates insecure DKM container ACLs by default. Administrators can opt out by setting RemediateDkmAcl to 0. This hardening effort addresses an elevation of privilege (EOP) that can arise from the vulnerability documented in CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability.
In summary, Active Directory Federation Services (AD FS) relies on the DKM container to store the symmetric keys used to protect token-signing and token-encryption certificates for private keys. If the container's ACL is overly permissive, an attacker with read access to the DKM key material can decrypt the token-signing private keys.
Take action
To protect your environment, complete the following steps:
- Install the appropriate Windows security update released on or after October 13, 2026 on all AD FS servers.
Important
Before installing the security update, determine whether you need to opt out of automatic remediation. Opting out is not recommended because it leaves the DKM container ACL in an insecure state.
If you must opt out for a specific compatibility requirement, set RemediateDkmAcl registry to 0 on every AD FS server in the farm before installing the update. The DKM container is a single Active Directory object shared by all AD FS servers in the farm, and the DKM ACL background task runs on each server. If RemediateDkmAcl is missing or set to a nonzero value on even one AD FS server, that server can automatically remediate the shared DKM container ACL after the update is installed.
After installation, the AD FS service audits the DKM container ACL each time the service starts and every 24 hours thereafter. If the ACL is insecure, AD FS attempts remediation automatically unless RemediateDkmAcl is set to 0.
Review the AD FS Admin event log for the following events:
Event ID: 1133 indicates that the DKM container ACL is secure. No further action is required.
Event ID: 1132 indicates that the DKM container ACL is insecure and automatic remediation will be performed. ACL details are written to one or more subsequent Event ID 510 entries with the same Instance ID. Review Event IDs 1135, 1136, or 1137 for the remediation result and take the following action based on the result.
Event ID: 1135 (remediation successful) No further remediation action is required. Save the previous ACL from the subsequent Event ID 510 entries as described in the Save the previous SDDL section.
Event ID: 1136 (remediation failed) Review the subsequent Event ID 510 entries for the current ACL and exception details, correct the underlying error, and then restart the AD FS service or wait for the next detection cycle.
Event ID: 1137 (ownership change failed) Grant the AD FS service account WriteOwner and WriteDacl permissions by following the Ownership failure event case guidance, and then restart the AD FS service or wait for the next detection cycle.
AD FS DKM container ACL events
| Event ID | Type | Meaning |
|---|---|---|
| 1132 | Warning | DKM container ACL does not match the expected secure state. Review remediation events 1135, 1136 and 1137. |
| 1133 | Information | DKM container ACL is in the expected secure state. No action required. |
| 1134 | Error | The detection task encountered an error (such as a LDAP connectivity failure). Review AD FS debug logs and correct the underlying error. |
| 1135 | Information | DKM container ACL remediation completed successfully. Save the previous SDDL. |
| 1136 | Error | DKM container ACL remediation failed. Review correlated Event ID 510 entries and AD FS Debug traces and correct the underlying error. |
| 1137 | Error | AD FS could not take ownership of the DKM container because the service account lacks the required permissions. Grant the required permissions |
| 510 | Information | Contains ACL or exception details that overflow from Event IDs 1132, 1135, or 1136. Match entries by Instance ID. |
Expected secure state changes
After remediation, only the following principals will have access to the DKM container:
| Principal | Access Rights |
|---|---|
| Domain Admins | Generic All (Full Control) |
| Enterprise Admins | Generic All (Full Control) |
| System | Generic All (Full Control) |
| AD FS Service Account | Read, Write, Create Child, Write Owner, Delete Tree |
Note Inheritance is disabled and all inherited ACEs are discarded. Any other explicit Allow ACEs not in the list above are removed.
Opting out of automatic remediation
Important
This section, method, or task contains information about how to change the registry. However, serious problems might occur if you change the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you change it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.
Remediation is enabled by default when RemediateDkmAcl is missing or set to a nonzero value. If you must opt out for a specific compatibility requirement, set the value to 0 on every AD FS server in the farm before installing the update. Opting out is not recommended because it leaves the DKM container ACL in an insecure state.
| Information | Details |
|---|---|
| Registry key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS |
| Value: | RemediateDkmAcl |
| Type: | DWORD |
| Data: | 0 |
Ownership failure event case (Event ID 1137)
Event ID: 1137 indicates that AD FS could not take ownership of the DKM container because the service account lacks the required permissions. This condition is expected most often on farms originally created on Windows Server 2012 or Windows Server 2012 R2. In this case, grant the required permissions to the AD FS service account by following the steps below on any one AD FS server in the farm. Otherwise, remediation attempts will continue to fail.
Identify the DKM container DN:
$dkmContainerDn = (Get-AdfsProperties).CertificateSharingContainer $dkmContainerDnIdentify the AD FS service account:
$serviceAccount = (Get-CimInstance Win32_Service -Filter "Name='adfssrv'").StartName $serviceAccountGrant explicit Allow ACEs for WriteOwner and WriteDacl:
$sid = (New-Object System.Security.Principal.NTAccount($serviceAccount)).Translate([System.Security.Principal.SecurityIdentifier]) $entry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$dkmContainerDn") $rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule( $sid, ([System.DirectoryServices.ActiveDirectoryRights]::WriteOwner -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl), [System.Security.AccessControl.AccessControlType]::Allow, [System.DirectoryServices.ActiveDirectorySecurityInheritance]::All ) $entry.ObjectSecurity.AddAccessRule($rule) $entry.CommitChanges() $entry.Close()After the required permissions are granted, either:
- Wait up to 24 hours for the next detection cycle
- Restart the AD FS service to trigger remediation sooner
On successful remediation, Event ID: 1135 (Information) is logged with the previous ACL in SDDL format.
Save the previous SDDL (Recommended)
As a precautionary measure, we recommend saving the previous ACL (SDDL) from the Event ID: 510 entries correlated with Event ID: 1135 after successful remediation. Event ID: 1135 contains the instance ID used to identify the related Event ID: 510 entries. While the previous ACL is not expected to be needed in most cases (since the original permissions were insecure), having it available provides a safety net for any unforeseen compatibility issues.
Note
Event logs can roll over due to size limits. If you need the previous SDDL in the future and the event has been overwritten, it will be permanently lost.
You can manually copy and combine the SDDL from the Event ID: 510 entries that have the Instance ID referenced by Event ID: 1135. Alternatively, use the following PowerShell script to collect the correlated Event ID: 510 entries and save the SDDL to a file:
New-Item -ItemType Directory -Path 'C:\ADFSBackup' -Force | Out-Null
$event = Get-WinEvent -FilterHashtable @{
LogName = 'AD FS/Admin'
Id = 1135
} -MaxEvents 1
if ($null -eq $event) {
throw 'Event ID 1135 was not found.'
}
if ($event.Message -notmatch 'Instance ID:\s*([0-9a-fA-F-]{36})') {
throw 'Instance ID was not found in Event ID 1135.'
}
$instanceId = $Matches[1]
$details = Get-WinEvent -FilterHashtable @{
LogName = 'AD FS/Admin'
Id = 510
StartTime = $event.TimeCreated
EndTime = $event.TimeCreated.AddMinutes(5)
} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -like "*$instanceId*" } |
Sort-Object RecordId |
ForEach-Object {
if ($_.Message -match '(?s)Details:\s*(.*)$') {
$Matches[1]
}
}
if (-not $details) {
throw "No Event ID 510 entries were found for Instance ID $instanceId."
}
[System.IO.File]::WriteAllText('C:\ADFSBackup\dkm-acl-previous-sddl.txt', ($details -join '').TrimEnd())
How to restore the previous ACL
If you experience issues after remediation and need to revert to the previous ACL:
# Restore the full security descriptor (DACL + Owner + SACL) from the saved SDDL
$dn = "<Container DN from event 1135 or C:\ADFSBackup\dkm-acl-previous-sddl.txt>"
$sddl = "<Previous ACL (SDDL) value from event 1135 or C:\ADFSBackup\dkm-acl-previous-sddl.txt>”
$entry = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$dn")
$entry.ObjectSecurity.SetSecurityDescriptorSddlForm($sddl, [System.Security.AccessControl.AccessControlSections]::All)
$entry.CommitChanges()
$entry.Close()
Note
This command requires the account running it to have SeSecurityPrivilege (typically Domain Admins have this). Run this from an elevated PowerShell session on a domain-joined machine.
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ADFS" -Name "RemediateDkmAcl" -Value 0 -Type DWord
After restoring, set RemediateDkmAcl = 0 on every AD FS server in the farm to prevent the service from re-remediating on the next cycle.
Event references
Event ID: 1132 — DKM container ACL requires review
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Warning |
| Event source | AD FS |
| Event ID | 1132 |
| Event text | AD FS detected that the Distributed Key Manager (DKM) container ACL does not match the expected secure state. The DKM container stores symmetric keys used to protect token-signing key material. Container DN: <DN> The expected secure state is inheritance disabled, and only Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account have access. AD FS will attempt to remediate the ACL automatically. Remediation runs immediately and every 24 hours thereafter until the ACL matches the expected secure state. See event 1135 (remediation successful) or event 1136/1137 (remediation failed) for the outcome. If you want to opt out of autoremediation, set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl (DWORD) to 0. For guidance, see https://go.microsoft.com/fwlink/?linkid=2369796. Additional Data Inheritance Disabled: <Yes/No> Current ACL (SDDL): See event 510 entries with Instance ID: <Instance ID> |
Event ID: 1133 — DKM container ACL is healthy
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Information |
| Event source | AD FS |
| Event ID | 1133 |
| Event text | The DKM ACL background task reviewed the container ACL for security hardening. The container has the correct settings, and no further action is required. Container DN: <DN> |
Event ID: 1134 — Detection error
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Error |
| Event source | AD FS |
| Event ID | 1134 |
| Event text | The AD FS DKM container ACL check background task encountered an error. Container DN: <DN> Additional Data Exception details: <exception> User Action Review the AD FS debug logs for more details. Ensure the AD FS service account has access to the DKM group container in Active Directory. |
Event ID: 1135 — Remediation successful
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Information |
| Event source | AD FS |
| Event ID | 1135 |
| Event text | AD FS successfully hardened the Distributed Key Manager (DKM) container ACL. Container DN: <DN> The container ACL now grants access only to Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account. Inheritance has been blocked, and all other permissions have been removed. Note: Autoremediation will not run again while the ACL matches the baseline. If you want to permanently opt out of autoremediation even if the ACL drifts in the future, set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl (DWORD) to 0. The previous ACL is included in the SDDL format below. If you need to restore the original permissions, see https://go.microsoft.com/fwlink/?linkid=2369796 Additional Data Previous ACL (SDDL): See event 510 entries with Instance ID: <Instance ID> |
Event ID: 1136 — Remediation failed
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Error |
| Event source | AD FS |
| Event ID | 1136 |
| Event text | AD FS attempted to remediate the Distributed Key Manager (DKM) container ACL but failed. Container DN: <DN> User ActionAutoremediation will retry on the next detection cycle (within 24 hours). If you prefer to fix the ACL manually, review and correct ACEs on the DKM group container. Only Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account should have access. To disable autoremediation, set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl (DWORD) to 0. For guidance, see https://go.microsoft.com/fwlink/?linkid=2369796 Additional Data Current ACL (SDDL) and exception details: See event 510 entries with Instance ID: <Instance ID> |
Event ID: 1137 — Ownership change failure
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Error |
| Event source | AD FS |
| Event ID | 1137 |
| Event text | AD FS attempted to remediate the Distributed Key Manager (DKM) container ACL but could not take ownership because the AD FS service account does not have the required permissions. This is expected for farms originally created on Windows Server 2012 or Windows Server 2012 R2. Container DN: <DN> User Action Grant the required permissions to the AD FS service account for the remediation to be successful. Autoremediation will retry on the next detection cycle (within 24 hours) or on service restart. If you prefer to fix the ACL manually, review and correct ACEs on the DKM group container. Only Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account should have access. To disable autoremediation, set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl (DWORD) to 0. For guidance, see https://go.microsoft.com/fwlink/?linkid=2369796 |
Event ID: 510 — Additional ACL information
| Information | Details |
|---|---|
| Event log | AD FS/Admin |
| Event type | Information |
| Event source | AD FS |
| Event ID | 510 |
| Event text | More information for the event entry with Instance ID <Instance ID>. There may be more events with the same Instance ID with more information. Instance ID: <Instance ID> Details: <ACL or exception detail segment> For large ACLs, multiple Event ID 510 entries can be logged. The related Event ID 1132, 1135, or 1136 is logged first, followed by the Event ID 510 entries with the same Instance ID. |
Change log
| Change date | Change description |
|---|---|
| October 13, 2026 |
|