Microsoft hardening changes for ReFS volumes on removable media

Introduction​

Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS).

This article describes Windows hardening changes for ReFS volumes that are mounted from removable media. ReFS on removable media, such as a USB disk, is not a supported configuration. The changes add auditing and enforcement controls that help administrators identify these volumes and prevent them from being mounted.

Summary​

The changes improve the security posture of Windows by adding visibility into unsupported external ReFS configurations and by providing controls to block affected volumes. The changes apply to all supported Windows platforms. They are introduced in phases so that organizations can review audit data and address dependencies before blocking is enabled by default.

Why are we making these changes?​

• Improved visibility: Audit events identify ReFS volumes mounted from removable media.
• Reduced exposure: Administrators can block unsupported external ReFS configurations before enforcement becomes the default.
• Phased deployment: Audit-first behavior gives organizations time to identify affected workflows, devices, or applications and take corrective action.
• Centralized management: The behavior can be configured by registry settings or Group Policy, with policy settings taking precedence.

Timeline of changes​

• October 13, 2026 security update (Audit phase) Auditing is enabled by default for ReFS volumes detected on qualifying external media. Blocking is not enabled by default. Administrators can use the audit period to identify affected devices and workloads before enforcement.
  
  
  

  KB5127648 Windows 11 Cumulative Update build 26100.9711 (24H2), 26200.9711 (25H2), 26300.9711 (26H2) - Oct. 13

  Microsoft Support: Announcements and messages This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices. Important: Windows 11, version 24H2 Home and Pro has reached end of updates. The October 2026 monthly security update...

  www.elevenforum.com
• January 2027 security update (Enforcement phase) Auditing and blocking are enabled by default. ReFS volumes that meet either configured external-media condition are blocked from mounting unless an administrator explicitly changes the applicable setting.

Take action​

• UPDATE: Install the applicable Windows security update released on or after October 13, 2026 on supported devices.
• MONITOR: Review the ReFS audit events generated for removable media.
• ASSESS: Identify workflows that rely on ReFS volumes in unsupported external media configurations and migrate required data or workloads to a supported storage configuration.
• TEST: Enable blocking in a controlled environment and confirm that required devices and applications continue to operate as expected.
• ENFORCE: Enable blocking when your environment is ready. If no override is configured, blocking becomes the default with the January 2027 security update.

Auditing and enforcement behavior​

• When auditing is enabled, Windows logs an event where a ReFS volume is mounted on removable media.
• An event is logged once for each affected volume during each system boot.
• Windows tracks up to 32 affected external volumes per boot for auditing. This limit applies only to auditing and does not limit enforcement.

When auditing is enabled, ReFS logs the following warning event when it detects a volume on a removable or externally attached device.

Deployment considerations​

• Review audit events before enabling Block mode to identify systems that use ReFS on removable devices.
• Blocking can affect access to data on an external ReFS volume. Ensure that required data is available from supported storage before enforcing the policy.
• Use Group Policy for centrally managed configurations. A locally configured FileSystem value does not override a value supplied through Group Policy.
• Do not rely on the 32-volume auditing limit as an enforcement boundary. Blocking applies independently of the number of volumes recorded in the audit tracking list.

Group policy and registry configuration​

This update introduces the RefsRemovableDeviceMountPolicy group policy and registry setting.

Note When this setting is set in both the group policy and registry locations, the Group Policy setting takes precedence.

Group Policy​

RefsRemovableDeviceMountPolicy

Set the following policy value to manage ReFS volumes on removable devices.

Registry settings​

RefsRemovableDeviceMountPolicy

Set the following registry value to manage ReFS volumes on removable devices.

Restart requirement​

Restart the device after changing either setting for the new configuration to take effect.