Quick answer: Event ID 524 from source ReFS in the System log means Windows found a ReFS-formatted volume on a USB or other external disk. Microsoft says that’s “not a supported configuration”. Since the October 13, 2026 updates, Windows only logs a warning. From the January 2027 security update, it will block those volumes from mounting by default, so the drive won’t open. Copy your files off the drive now, then reformat it as NTFS or exFAT.
In this guide
What Microsoft is changing
Microsoft’s support article KB5130741, “Hardening changes for ReFS volumes on removable media”, published October 13, 2026, describes two phases:
| Phase | When | What happens |
|---|---|---|
| Audit | Updates released on or after October 13, 2026 | Windows logs Event ID 524 for each affected volume. Drives still mount and work. |
| Enforcement | January 2027 security update | Auditing and blocking are both on by default. Affected volumes won’t mount unless an admin changes the setting. |
It applies to Windows 11 versions 22H2 through 26H1, Windows 10 22H2 and its LTSB/LTSC editions, and Windows Server 2012 (with Extended Security Updates) through Windows Server 2025. Microsoft calls it a security hardening change but hasn’t described a specific threat.
ReFS on removable media was never officially supported. Microsoft’s ReFS overview lists “Supported on removable media” as unavailable for ReFS and available for NTFS. The change only affects drives formatted as ReFS. USB drives formatted as NTFS, exFAT or FAT32, which is nearly all of them, aren’t affected.
What Event ID 524 means
| Field | Value |
|---|---|
| Log | System |
| Source | ReFS |
| Level | Warning |
| Event ID | 524 |
The message names the volume and says it’s on a removable or externally attached disk, that this isn’t a supported configuration for ReFS, and that it won’t be mounted if a blocking policy is on. It ends by telling you to move the volume to a supported disk type.
Windows logs it once per affected volume at each startup, so a drive you rarely plug in may only show up after you connect it and restart. To find it:
- Right-click Start and select Event Viewer.
- Go to Windows Logs > System.
- Select Filter Current Log on the right, type 524 in the event ID box, and select OK. Check that the source column says ReFS.
Or run this in PowerShell as administrator:
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='ReFS'; Id=524}If it returns “No events were found”, no ReFS removable volumes were seen since the October update was installed.
Check whether your drive uses ReFS
Plug the drive in and note its letter, then run either command (replace E with your drive letter):
fsutil fsinfo volumeinfo E:Look at the File System Name line. In PowerShell:
Get-Volume -DriveLetter EThe FileSystem column shows ReFS, NTFS, exFAT or FAT32. You can also right-click the drive in File Explorer and select Properties; the file system is shown on the General tab.
Move your data and reformat the drive
Microsoft’s advice is to migrate data to supported storage before blocking takes effect. Do it before January 2027, while the drive still mounts.
- Copy everything from the ReFS drive to your PC’s internal disk or another drive. Check the copy opens before going further.
- Reformat the external drive. This erases it. For a drive used only with Windows, NTFS is the natural choice. For a drive shared with Macs or other devices, use exFAT.
- Copy your files back.
To reformat in PowerShell as administrator (per Microsoft’s Format-Volume reference):
Format-Volume -DriveLetter E -FileSystem NTFS -NewFileSystemLabel BackupSwap NTFS for exFAT if you need it on other devices. Double-check the drive letter: formatting the wrong drive wipes it. For step-by-step help with File Explorer or Disk Management instead, see how to reformat a hard drive in Windows, and for the size limits of older file systems, how to format a USB drive as FAT32. Memory cards formatted as ReFS need the same treatment; see how to format an SD card in Windows.
ReFS features such as integrity streams and block cloning don’t carry over to NTFS or exFAT. If you relied on them, keep that data on an internal ReFS volume instead.
Admins: the mount policy setting
KB5130741 documents a DWORD value named RefsRemovableDeviceMountPolicy:
| Value | Behaviour |
|---|---|
| 0 | Off: no auditing, no blocking |
| 1 | Audit: log Event ID 524 only (the default from October 2026) |
| 2 | Block: affected volumes don’t mount (the default from January 2027) |
It can be set locally under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem, or through a Group Policy-backed value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies. Microsoft says the Group Policy setting takes precedence and the device must restart after either change. A local command would look like this:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v RefsRemovableDeviceMountPolicy /t REG_DWORD /d 1 /fSetting 1 after January keeps drives mounting while you migrate. Microsoft’s recommended order is: install the update, review the 524 events, identify workflows that depend on ReFS removable media, move the data, test Block on a few machines, then enforce it. It hasn’t said how long the Off and Audit values will remain available, so treat them as a short-term bridge. Back up the registry before editing it.
What Microsoft hasn’t said
- It doesn’t say whether data on a blocked drive is deleted. It says the volume won’t be mounted and warns that blocking “can affect access to data”. Don’t rely on recovering it later; copy it off now.
- It doesn’t define exactly which external disks count. Some USB enclosures report as fixed disks, and it’s unconfirmed how those are treated. Check for Event ID 524 rather than guessing.
- It doesn’t mention Dev Drive or internal ReFS volumes. Tech sites report they’re unaffected, which fits the wording, but Microsoft hasn’t stated it.
- Some sites report a notification near the removable-device icon in the taskbar. Microsoft’s article doesn’t describe one.
Related guides
- How to reformat a hard drive in Windows
- How to format a USB drive as FAT32
- How to format an SD card in Windows 11 and 10 (4 ways)
Leave a Reply