Microsoft says updates released on or after October 13, 2026, enable auditing by default for qualifying ReFS volumes on removable or externally attached media. Default blocking is scheduled for the January 2027 security update. The policy covers specified versions of Windows 10, Windows 11, and Windows Server, and can prevent affected volumes from mounting and their data from being accessed.
Which Windows versions are listed?
ReFS, or Resilient File System, is designed for data availability, large data sets, integrity, and resilience to corruption. Microsoft says using ReFS on removable media, such as a USB drive, is unsupported. Its policy applies to qualifying ReFS volumes on removable or externally attached storage, not to USB storage in general or NTFS volumes.
Microsoft’s applicability list names these operating systems and editions:
| Windows family | Versions and editions listed by Microsoft |
| Windows 10 | Enterprise LTSB 2016; Enterprise LTSC 2019; IoT Enterprise LTSC 2021; version 22H2, all editions |
| Windows 11 | Home and Pro 22H2; Enterprise Multi-Session 22H2; Enterprise and Education 22H2; IoT Enterprise 22H2; SE 23H2; Home and Pro 23H2; Enterprise and Education 23H2; Enterprise Multi-Session 23H2; versions 24H2, 25H2, and 26H1, all editions |
| Windows Server | 2012 ESU; 2012 R2 ESU; 2016; 2019; 2022; 2025 |
Check the specific version and edition in use against the list; the policy is not a blanket rule for every Windows release.
What changes in each phase?
| Phase and timing | Default behavior | Effect on qualifying ReFS volumes |
| Updates released on or after October 13, 2026 | Audit is enabled; blocking is not enabled by default | Windows records qualifying volumes for administrators to identify dependencies |
| January 2027 security update | Auditing and blocking are enabled by default | Qualifying volumes are blocked from mounting unless an administrator changes the applicable setting |
During auditing, Microsoft specifies a ReFS warning, Event ID 524, in the System log. Windows logs it once per affected volume per system boot. The audit tracker records up to 32 affected external volumes per boot; that tracking limit does not limit enforcement.
The restriction concerns mounting and access. Microsoft advises administrators to make sure required data is available from supported storage before enforcement.
How administrators can configure the policy
The setting is RefsRemovableDeviceMountPolicy. Its DWORD values are:
0: Off1: Audit, the default value2: Block
Microsoft lists HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies as the Group Policy registry location and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem as the registry location. If both Group Policy and the registry set a value, Group Policy takes precedence. A restart is required after changing either setting.
Why Microsoft is making the change
Microsoft says the phased policy is intended to improve Windows security by making unsupported external ReFS configurations more visible, reducing exposure, and giving organizations an audit period to identify affected workloads. Microsoft’s policy notice sets out the rollout schedule and administrator controls.
