Microsoft began auditing ReFS volumes on removable media with the October 13 security update and plans to block mounting by default in January 2027. This targets previously unsupported external configurations such as USB, not all ReFS or NTFS drives. ReFS event 524 currently identifies affected use, and policy changes require a restart. Group Policy takes precedence over local registry settings. Blocking does not delete files, but it prevents access, so preserve necessary data on supported storage before testing the policy.