Microsoft plans to make auditing and blocking the default for ReFS volumes mounted from removable or externally attached media with the January 2027 security update. Applicable updates released on or after October 13, 2026, already enable auditing by default, giving administrators an earlier phase to spot affected volumes.
What changes for ReFS on removable media
ReFS, or Resilient File System, is the file system covered by the policy. Microsoft describes using ReFS on removable media as an unsupported configuration and says the change is intended to improve Windows security by adding visibility into these setups and giving administrators a way to block them.
The policy applies to ReFS volumes mounted from removable or externally attached media. It is not limited to Windows 11, and the announcement does not describe a general retirement of ReFS.
When auditing and blocking take effect
Applicable security updates released on or after October 13, 2026 enable auditing by default. Microsoft schedules both auditing and blocking to be enabled by default with the January 2027 security update.
Auditing records affected volumes; blocking prevents them from mounting. Administrators can change the policy setting rather than use its default. Microsoft names January 2027 as the scheduled update window.
Which Windows versions Microsoft lists
Microsoft's applicability list includes specified Windows 10 and Windows 11 editions and releases, as well as Windows Server versions:
- Windows 10: Enterprise LTSB 2016; Enterprise LTSC 2019; IoT Enterprise LTSC 2021; and version 22H2, all editions.
- Windows 11: Home and Pro 22H2; Enterprise Multi-Session 22H2; Enterprise and Education 22H2; IoT Enterprise 22H2; SE 23H2; Home and Pro 23H2; Enterprise and Education 23H2; Enterprise Multi-Session 23H2; and versions 24H2, 25H2, and 26H1, all editions.
- Windows Server: 2012 ESU, 2012 R2 ESU, 2016, 2019, 2022, and 2025.
For administrators checking a mixed fleet, the Windows 10 and Windows Server entries matter as much as the Windows 11 list: Microsoft's stated scope includes all three product families, with the editions and versions above.
What the policy setting and audit log show
Microsoft documents three values for RefsRemovableDeviceMountPolicy:
| Value | Meaning |
0 | Off |
1 | Audit |
2 | Block |
The Microsoft support notice gives two registry locations: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies for the Group Policy setting, and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem for the registry setting. If both are configured, Group Policy takes precedence. A restart is required after changing either setting.
During auditing, Windows records a ReFS Warning, Event ID 524, in the System log once per affected volume during each system boot. Auditing tracks up to 32 affected external volumes per boot; that limit applies to audit tracking, not enforcement.
What happens to data on an affected drive
Microsoft warns that blocking can affect access to data and advises administrators to make required data available on supported storage before enforcement. PCWorld reports that the policy will not automatically delete files, although Windows will initially be unable to access them. PCWorld also reports that FAT32-, exFAT-, and NTFS-formatted media are unaffected by this specific ReFS restriction.
