Original publish date: October 13, 2026
KB ID: 5130741
In this article
- Introduction
- Summary
- Why are we making these changes?
- Timeline of changes
- Take action
- Auditing and enforcement behavior
- Deployment considerations
- Group policy and registry configuration
- Restart requirement
- Change log
Introduction
Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS).
This article describes Windows hardening changes for ReFS volumes that are mounted from removable media. ReFS on removable media, such as a USB disk, is not a supported configuration. The changes add auditing and enforcement controls that help administrators identify these volumes and prevent them from being mounted.
Summary
The changes improve the security posture of Windows by adding visibility into unsupported external ReFS configurations and by providing controls to block affected volumes. The changes apply to all supported Windows platforms. They are introduced in phases so that organizations can review audit data and address dependencies before blocking is enabled by default.
Why are we making these changes?
Improved visibility: Audit events identify ReFS volumes mounted from removable media.
Reduced exposure: Administrators can block unsupported external ReFS configurations before enforcement becomes the default.
Phased deployment: Audit-first behavior gives organizations time to identify affected workflows, devices, or applications and take corrective action.
Centralized management: The behavior can be configured by registry settings or Group Policy, with policy settings taking precedence.
Timeline of changes
October 13, 2026 security update (Audit phase) Auditing is enabled by default for ReFS volumes detected on qualifying external media. Blocking is not enabled by default. Administrators can use the audit period to identify affected devices and workloads before enforcement.
January 2027 security update (Enforcement phase) Auditing and blocking are enabled by default. ReFS volumes that meet either configured external-media condition are blocked from mounting unless an administrator explicitly changes the applicable setting.
Take action
UPDATE: Install the applicable Windows security update released on or after October 13, 2026 on supported devices.
MONITOR: Review the ReFS audit events generated for removable media.
ASSESS: Identify workflows that rely on ReFS volumes in unsupported external media configurations and migrate required data or workloads to a supported storage configuration.
TEST: Enable blocking in a controlled environment and confirm that required devices and applications continue to operate as expected.
ENFORCE: Enable blocking when your environment is ready. If no override is configured, blocking becomes the default with the January 2027 security update.
Auditing and enforcement behavior
When auditing is enabled, Windows logs an event where a ReFS volume is mounted on removable media.
An event is logged once for each affected volume during each system boot.
Windows tracks up to 32 affected external volumes per boot for auditing. This limit applies only to auditing and does not limit enforcement.
When auditing is enabled, ReFS logs the following warning event when it detects a volume on a removable or externally attached device.
| Property | Value |
|---|---|
| Log | System |
| Event ID | 524 |
| Source | ReFS |
| Level | Warning |
| Message | Volume "volume_name" is on a removable or externally attached disk. This is not a supported configuration for ReFS. If a policy to block these volumes is enabled, the volume will not be mounted. Move the volume to a supported disk type. |
| Notes | This event is logged when ReFS detects a volume on a removable or externally attached storage device that is not considered a supported deployment configuration. Administrators can use this event to identify volumes that may be affected by future enforcement policies that block mounting ReFS volumes on removable or externally attached media. |
Deployment considerations
Review audit events before enabling Block mode to identify systems that use ReFS on removable devices.
Blocking can affect access to data on an external ReFS volume. Ensure that required data is available from supported storage before enforcing the policy.
Use Group Policy for centrally managed configurations. A locally configured FileSystem value does not override a value supplied through Group Policy.
Do not rely on the 32-volume auditing limit as an enforcement boundary. Blocking applies independently of the number of volumes recorded in the audit tracking list.
Group policy and registry configuration
This update introduces the RefsRemovableDeviceMountPolicy group policy and registry setting.
Note When this setting is set in both the group policy and registry locations, the Group Policy setting takes precedence.
Group Policy
RefsRemovableDeviceMountPolicy
Set the following policy value to manage ReFS volumes on removable devices.
| Item | Details |
|---|---|
| Registry location | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies |
| DWORD name | RefsRemovableDeviceMountPolicy |
| DWORD value | 0 – Off 1 - Audit (default) 2 – Block |
Registry settings
RefsRemovableDeviceMountPolicy
Set the following registry value to manage ReFS volumes on removable devices.
| Item | Details |
|---|---|
| Registry location | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem |
| DWORD name | RefsRemovableDeviceMountPolicy |
| DWORD value | 0 – Off 1 - Audit (default) 2 – Block |
Restart requirement
Restart the device after changing either setting for the new configuration to take effect.
Change log
| Change date | Change description |
|---|---|
| October 13, 2026 | Initial publication |