Hardening changes for ReFS volumes on removable media

What and why

Microsoft is making hardening changes to the Resilient File System (ReFS). The changes improve the security posture of Windows by adding visibility into unsupported external ReFS configurations and by providing controls to block affected volumes. The changes apply to all supported Windows platforms in phases to allow your organization to review audit data and address dependencies.

Rollout schedule

• October 2026 Windows security update (Audit phase)
• January 2027 Windows security update (Enforcement phase)

Impact on your organization

The changes improve the security posture of Windows but require admin action.

Action required/recommendations

• UPDATE: Install the applicable Windows security update released on or after October 13, 2026 on supported devices.
• MONITOR: Review the ReFS audit events generated for removable media.
• ASSESS: Identify workflows that rely on ReFS volumes in unsupported external media configurations and migrate required data or workloads to a supported storage configuration.
• TEST: Enable blocking in a controlled environment and confirm that required devices and applications continue to operate as expected.
• ENFORCE: Enable blocking when your environment is ready. If you configure no override, blocking becomes the default with the January 2027 security update.

Learn more at Hardening changes for ReFS volumes on removable media.

Compliance considerations

Hardening changes affect Windows security. Review as appropriate for your organization.