Microsoft tightens ReFS security on external drives, with 2027 enforcement deadline
Windows will enforce stricter controls on Resilient File System volumes on removable media, giving organisations time to prepare after October 2026 updates.
Key points
- Microsoft is implementing hardening changes for ReFS volumes on removable storage devices.
- Updates introducing these changes begin rolling out on 13 October 2026.
- The new security controls will not be enabled by default until 2027.
Microsoft is strengthening security controls for the Resilient File System on removable media, a move that will eventually enforce stricter handling of external drives in Windows. This change affects how the operating system manages data on portable storage that uses this specific file format.
According to an official advisory from the Microsoft Security Update Guide, the company is making these hardening changes to improve the safety of ReFS volumes. The updates that introduce these modifications will be released starting on 13 October 2026. However, the stricter controls will not be active by default until the year 2027.
What we know
The advisory, identified as ADV260001, outlines the timeline for this security adjustment. Microsoft states that the changes are designed to harden the file system on removable media. The company is providing a gap between the release of the updates and the default enforcement of the new rules. This period allows IT administrators to prepare their systems and workflows before the stricter policy takes effect automatically.
Neowin reports that Windows is changing how it handles a particular file system on external storage. The outlet notes that this shift gives IT teams time to get ready before the major policy change arrives. The headline suggests Microsoft is not a fan of ReFS on removable media, but the summary focuses on the timeline for preparation.
Organisations should note that the changes are not immediate. The updates will be available from October 2026, but the actual enforcement of the new security posture is delayed. This delay provides a clear window for planning and adjustment. The advisory directs users to further documentation for more detailed information on the technical aspects of the change.
Defender's checklist
- Review current usage of ReFS on any removable or external storage devices within your environment.
- Check internal documentation to understand how the October 2026 updates might affect existing workflows.
- Plan for the default enforcement of these controls scheduled for 2027.
- Monitor official Microsoft support pages for detailed guidance on the hardening changes.
The background in plain language
Teams usually need to understand how file systems work on external drives. A file system organises data on storage devices. ReFS is designed for resilience, but Microsoft is limiting its use on removable media. This means external drives using this format will face stricter checks. Organisations should check whether their backup or data transfer processes rely on ReFS. If they do, those processes may need adjustment. The goal is to ensure that data on portable drives is handled more securely by the operating system. Users should verify their storage configurations to avoid disruption when the new rules take effect.
What to do and how to stay safe: Microsoft
- Audit your removable storage devices to identify any that are formatted with the Resilient File System.
- Test your critical data workflows with the October 2026 updates in a controlled environment before the 2027 deadline.
- Consult with your IT security team to determine if alternative file systems are more suitable for external drives.
- Monitor vendor communications for any additional guidance on migrating away from ReFS on removable media.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will the ReFS hardening changes take effect?
The updates introducing the changes begin on 13 October 2026, but the controls will not be enabled by default until 2027.
What file system is affected by this change?
The Resilient File System (ReFS) on removable media is affected by these hardening changes.
Will this change happen automatically?
Yes, the stricter controls will be enabled by default in 2027, following the rollout of updates in October 2026.
