Microsoft to harden ReFS on removable media in Windows 11

Microsoft is introducing hardening changes for Resilient File System (ReFS) volumes located on removable media. These updates, tracked under advisory ADV260001, will be included in Windows updates released on and after October 13, 2026, according to the Microsoft Security Update Guide.

What happened

Microsoft is modifying how Windows handles the Resilient File System on external storage devices. The company announced these hardening changes via advisory ADV260001, which details updates starting with the October 13, 2026 release. According to Microsoft, these changes are part of a broader effort to secure ReFS usage on removable media. The updates will be distributed through standard Windows update channels.

The hardening measures will not be active by default when the updates first arrive. Microsoft has stated that the changes will not be enabled until 2027. This delay provides a window for organizations to adjust their workflows. Neowin reported that Microsoft is not a fan of using ReFS on removable media and is hardening Windows 11 against this configuration.

Why it matters

IT managers need to prepare for a shift in how Windows treats external ReFS volumes. The delay until 2027 allows time for planning and adaptation. Organizations relying on ReFS for portable storage must assess their current setups. The changes involve hardening ReFS on removable media. This move reflects Microsoft's reported stance on ReFS usage on external media.

What to watch

• Monitor Microsoft Security Update Guide for ADV260001 details.
• Review internal use of ReFS on external drives.
• Check for compatibility issues with existing workflows.
• Prepare for default enforcement in 2027.

Who needs to act first

Teams should prioritize auditing systems that use ReFS on removable media. Identify critical workflows dependent on this configuration before the 2027 enforcement date. Test alternative file systems or storage methods in isolated environments to ensure stability. Document current usage patterns to facilitate a smooth transition. Communicate changes to end-users early to minimize disruption. Plan for potential data migration if ReFS on removable media becomes unsupported.

What to do and how to stay safe: Microsoft

• Inventory all removable media using ReFS within your organization.
• Evaluate alternative file systems for external storage needs.
• Test updated Windows versions in non-production environments.
• Develop a migration plan for data currently on ReFS removable drives.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When do the ReFS hardening changes take effect?

The updates are released starting October 13, 2026, but enforcement is delayed until 2027.

Are the changes enabled by default immediately?

No, Microsoft states the changes are not enabled by default until 2027.

Which advisory covers these changes?

The changes are covered under Microsoft advisory ADV260001.