Microsoft Will Block ReFS Volumes on USB Drives Starting January 2027

Microsoft is introducing new security restrictions for ReFS (Resilient File System) volumes on removable storage devices, including external USB drives. Starting in January 2027, Windows will block these volumes from mounting by default, although administrators can override the restriction.

The changes arrive with the October 2026 Patch Tuesday updates and affect all supported Windows platforms.

According to Microsoft’s documentation, ReFS on removable media is not officially supported. The new restrictions aim to improve security while giving administrators more control over unsupported external storage configurations.

Microsoft will begin blocking ReFS removable drives in January 2027

Microsoft is introducing the restrictions in two phases, giving organizations time to identify affected devices before enforcement begins.

The rollout follows this schedule:

• October 13, 2026: Windows enters the audit phase, detecting and logging unsupported ReFS volumes on removable drives without blocking them.
• January 2027: Windows enters the enforcement phase and automatically blocks affected volumes from mounting unless administrators override the default policy.

During the audit phase, Windows records Event ID 524 whenever it detects an affected ReFS volume.

The good news is that administrators can disable the restrictions or change their behavior through Group Policy or the Windows Registry.

New Group Policy setting gives administrators more control

Microsoft has introduced a new setting called RefsRemovableDeviceMountPolicy, which determines how Windows handles ReFS volumes on removable storage.

The setting supports three values:

• 0 (Off): Disables both auditing and blocking.
• 1 (Audit): Logs unsupported ReFS volumes without preventing access.
• 2 (Block): Prevents unsupported ReFS volumes from mounting.

Administrators can configure the setting through Group Policy at the following registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies

Alternatively, they can configure it directly through the registry at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

Group Policy settings take priority over local registry configurations, and administrators must restart Windows after changing the policy.

What administrators should do before January 2027

Organizations that use ReFS volumes on external drives should review their storage configurations before Microsoft enables enforcement.

Administrators should install the October 2026 security updates, monitor Event ID 524 for affected devices, and identify workloads that rely on removable ReFS volumes.

Microsoft also recommends moving important data to supported storage configurations and testing the blocking policy before January 2027 to avoid unexpected access issues.

Organizations that still need access to these volumes can override the restrictions, although Microsoft continues to classify ReFS on removable media as unsupported.

In other news, Windows 11 26H2 KB5127648 fixes File Explorer crashes, AC-3 audio playback issues, and VPN errors. Meanwhile, Microsoft’s October 2026 Patch Tuesday addresses 1,411 security vulnerabilities, including three zero-days.

Via Neowin