Microsoft Adds ReFS External-Storage Auditing Ahead of Default Hardening

Microsoft released advisory ADV260001 and Windows updates introducing hardening controls for Resilient File System (ReFS) volumes on removable or externally attached storage. Updates released on or after October 13, 2026, provide auditing and optional enforcement, but the hardening will not be enabled by default until 2027. Microsoft identifies denial of service as the potential impact and rates the advisory Moderate, while individual product entries are marked “Not a Vulnerability” with severity “None.” Microsoft reported no public disclosure or exploitation at publication. The changes appear in Windows 11 version 26H1 update KB5127646, Windows 10 ESU and LTSC 2021 update KB5126657, and Windows Server 2022 update KB5126655; the Windows 10 update explicitly enables auditing by default.

Administrators should deploy the applicable updates, review ReFS audit findings, and assess external-storage dependencies before enabling optional enforcement. The releases also continue deployment of replacement Secure Boot certificates. Windows Server 2022 additionally gains enhanced NTLM auditing and automatic remediation of insecure AD FS Distributed Key Manager container permissions associated with CVE-2026-56155. Deployment planning should account for servicing-stack prerequisites on Windows 10 and a matching boot.stl file when updating Windows 10 or Windows 11 installation media to avoid boot failures. Some USB Audio Class 1.0 issues remain unresolved on those client platforms. Microsoft identifies KB5126655 as the final Windows Server 2022 mainstream-support update, with monthly security updates continuing under extended support through October 14, 2031.