Hardening changes for ReFS volumes on removable media

🚨 The Signal: Microsoft is hardening the Resilient File System (ReFS) on removable media to improve Windows security. This change adds visibility and control to block unsupported external ReFS configurations, requiring admin action to review audit data and address dependencies.

The Impact

Security teams and Windows administrators are affected, facing a moderate risk of operational disruption if unsupported ReFS volumes are not addressed.

  • Security teams: Must review audit data for ReFS usage.
  • Windows administrators: Need to identify and migrate unsupported ReFS data.
  • End-users: May experience access issues if their removable ReFS media is blocked.
  • Organisations: Risk operational disruption if not prepared for enforcement.

The Action

  1. Install Windows security updates released October 13, 2026, or later.
  2. Monitor ReFS audit events for removable media usage.
  3. Identify and migrate data from unsupported ReFS volumes.
  4. Test blocking in a controlled environment.
  5. Enable blocking when ready, or it defaults in January 2027.

Domain: Other · Impact: high · Workload: Other · Essential Eight: Patch Operating Systems · ISM: ISM-1407, ISM-1501, ISM-1621, ISM-1622, ISM-1623, ISM-1654, ISM-1655, ISM-1694, ISM-1695, ISM-1696, ISM-1701, ISM-1702, ISM-1877, ISM-1889, ISM-1902