Microsoft Blocks ReFS USB Drives on Windows Starting January 2027

Microsoft will block ReFS- formatted USB drives and external storage on Windows 11, 10, and Server by January 2027. Learn how to audit and override this policy.

Microsoft Blocks ReFS USB Drives on Windows Starting January 2027

Microsoft will begin blocking external storage that uses ReFS file systems from January 2027. ReFS volumes weren't ever officially supported for removable storage devices. So this new policy will help keep people from mounting incompatible volumes by accident.

Microsoft Windows logo on a digital display
Microsoft logo on a digital display

Windows 11 and 10 users must check external storage formats before the enforcement date

The new policy affects all Windows 11 and supported versions of Windows 10 as well as Windows Server systems. So if you use ReFS for internal storage, you should be ok, but if you use ReFS with external storage, you may need to modify your setup.

This new policy will kick off in the "Audit" stage starting October 13, 2026. In this stage you won't be blocked, but you'll be able to audit. You'll see affected ReFS volumes logged in Event Viewer with the Event ID 524.

So you'll be able to track the problem in your environment before you get to the actual enforcement stage. The ReFS volumes will still be mountable during this "Audit" stage, so you'll have time to adjust to the new restrictions.

You'll be able to adjust the enforcement level through the RefsRemovableDeviceMountPolicy registry or Group Policy setting. The possible values are 0 (no restriction) 1 (audit) and 2 (block affected volumes). A value of 2 will match what's planned to be the default from January 2027, so you'll have the option to keep legacy ReFS on external storage if needed in your environment.

Note that this won't affect common consumer media formats like FAT32, exFAT, and NTFS. The new restrictions only affect removable storage that's been formatted as ReFS. This helps make sure your other external storage devices will continue to work as expected.

So this new policy is part of Microsoft's continued push towards hardening the security while also keeping the system stable. Kind of like some of the themes we saw in the latest Windows update.

Discussion

0 comments

Log in to join the thread with a thoughtful take, question, or correction.

Add to the discussion