Windows: ReFS hardening for removable volumes, audit now, enforcement in January 2027
Summary
Microsoft is hardening the Resilient File System (ReFS) for external and removable volumes on all supported Windows platforms. The audit phase comes with the October 2026 security update, enforcement with the January 2027 security update. The Microsoft excerpt gives no exact day for either phase.
What changes?
In the audit phase, unsupported external ReFS configurations become visible. With enforcement, controls are available to block affected volumes, so external ReFS drives that are not supported may no longer be usable. Details on the exact behaviour are in the Microsoft article.
Affected
- All supported Windows platforms
- External and removable volumes formatted with ReFS
- Phase 1: October 2026 security update (audit)
- Phase 2: January 2027 security update (enforcement)
Preparation and temporary exceptions
- Identify external or removable drives formatted with ReFS.
- Review the Microsoft article on hardening changes for ReFS volumes on removable media for the available controls.
- Move data from unsupported ReFS external volumes to a supported file system such as NTFS before enforcement, where the Microsoft article does not specify otherwise.
Check and complete
Not a defect. Enforcement follows with the January 2027 Windows security update. Verify the audit results after installing the October 2026 update.
Recommendation
Inventory external ReFS media now, evaluate the audit information during the audit phase and plan migration or the documented controls before the January 2027 update. Test the update on a pilot group first.
Timeline
- October 2026 Windows security update: audit phase, adds visibility into unsupported external ReFS configurations.
Sources
- Hardening changes for ReFS volumes on removable media Vendor · support.microsoft.com
- Resilient File System (ReFS) overview Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 22:04.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.