Microsoft’s phased policy for ReFS volumes on removable and externally attached storage is in its audit phase: qualifying Windows security updates released on or after October 13, 2026, enable auditing by default. Microsoft plans to enable both auditing and blocking by default with the January 2027 security update. The policy covers listed Windows 10, Windows 11, and Windows Server releases, and administrators can change its setting. Microsoft’s support notice gives the full scope and controls.
Which Windows systems and drives are covered?
The policy applies to ReFS volumes on removable media, such as USB disks, and on externally attached devices. Microsoft lists these Windows 10 releases and editions: Enterprise LTSB 2016, Enterprise LTSC 2019, IoT Enterprise LTSC 2021, and version 22H2, all editions.
For Windows 11, the listed editions are Home, Pro, Enterprise Multi-Session, Enterprise, Education, and IoT Enterprise for version 22H2; SE, Home, Pro, Enterprise, Education, and Enterprise Multi-Session for version 23H2; and all editions of versions 24H2, 25H2, and 26H1. The notice also lists Windows Server 2012 ESU, 2012 R2 ESU, 2016, 2019, 2022, and 2025.
What changes in January 2027?
The current phase enables auditing by default with qualifying security updates released on and after October 13, 2026. Blocking is not the default in this phase. Microsoft plans for the January 2027 security update to enable both auditing and blocking by default, unless an administrator changes the setting.
In audit mode, Windows records a ReFS warning, event ID 524, in the System log when it detects an affected volume. It records an event once per affected volume during each system boot. Audit tracking covers up to 32 affected external volumes per boot; that limit applies to tracking, not enforcement.
How administrators can manage the policy
The RefsRemovableDeviceMountPolicy setting has three values:
| Value | Meaning |
0 | Off |
1 | Audit |
2 | Block |
Microsoft recommends reviewing audit events, identifying workflows that depend on affected volumes, moving required data or workloads to supported storage, and testing blocking in a controlled environment. If both Group Policy and the registry configure the setting, Group Policy takes precedence. A restart is required after changing either configuration.
The Group Policy setting table lists HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies; the registry setting table lists HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem. In Block mode, Windows blocks the affected ReFS volume from mounting, which can affect access to its data.
