MICROSOFT is tightening how ReFS (Resilient File System) volumes on removable or external storage are supported in Windows 11 and Windows Server. Starting with the October 13, 2026 monthly security update, Windows will audit removable ReFS volumes by default. From January 2027, the system will move to automatic blocking of mounting these volumes, though administrators can override the restriction via group policy to permit external ReFS media in specific cases.
In short, ReFS on removable storage is moving from a supported-but-audited configuration to a blocked one by default, with an opt‑out option for organisations that rely on such devices.
Microsoft describes an initial auditing phase in which eligible external ReFS devices can still mount for now, while Warning Event ID 524 from the ReFS source is logged to help identify affected hardware, applications, and workflows. The system will cap the volume count per startup at 32 and generate at most one log entry per boot for each affected volume.
The January 2027 enforcement will combine auditing and blocking by default, meaning unaffected users would lose access to data on external ReFS volumes unless policy changes are applied.
To ease the transition, Microsoft offers enterprise management policies to help organisations assess eligibility and plan data migration to fully supported storage configurations. Administrators are advised to review Event ID 524 after applying the October update, test policy changes in a controlled environment first, and migrate critical data to supported storage before the default mount-block takes full effect.