Microsoft is making hardening changes to the Resilient File System (ReFS). The changes improve the security posture of Windows by adding visibility into unsupported external ReFS configurations and by providing controls to block affected volumes. The changes apply to all supported Windows platforms in phases to allow your organization to review audit data and address dependencies.
Message ID: MC1506290
Published: Oct 13, 2026
Service: Windows
Tag: Admin impact
Rollout schedule
- October 2026 Windows security update (Audit phase)
- January 2027 Windows security update (Enforcement phase)
Impact on your organization
The changes improve the security posture of Windows but require admin action.
Action required/recommendations
- UPDATE: Install the applicable Windows security update released on or after October 13, 2026 on supported devices.
- MONITOR: Review the ReFS audit events generated for removable media.
- ASSESS: Identify workflows that rely on ReFS volumes in unsupported external media configurations and migrate required data or workloads to a supported storage configuration.
- TEST: Enable blocking in a controlled environment and confirm that required devices and applications continue to operate as expected.
- ENFORCE: Enable blocking when your environment is ready. If you configure no override, blocking becomes the default with the January 2027 security update.
Learn more at Hardening changes for ReFS volumes on removable media.
Compliance considerations
Hardening changes affect Windows security. Review as appropriate for your organization.