NewsEditorialSource: Microsoft
Microsoft adds ReFS auditing and optional policy controls to Windows 11 26H1
Microsoft released KB5127646 for all editions of Windows 11 26H1 on October 13, 2026, adding ReFS auditing and optional policy controls for externally attached storage. Microsoft says auditing is enabled by default and enforcement is disabled, giving administrators time to prepare for future hardening. According to the release notes, build 28000.3231 fixes Explorer startup failures and repeated crashes after sign-in in multi-user environments. It also fixes a problem that prevented tiered Storage Spaces Direct virtual disks from coming online after certain security updates. Pureinfotech reported the same changes for companion Windows 11 releases based on Microsoft’s changelog, without independently testing the 26H1 package.
Why it matters
Developers and platform teams using external ReFS storage should inventory dependencies and evaluate affected workflows during the audit period before enabling enforcement. Teams affected by the documented failures should also test virtual-desktop sign-in and clustered-storage recovery. Exact media eligibility and enforcement configuration remain unverified in the reviewed evidence. Microsoft also says some USB Audio Class 1.0 problems remain unresolved.
Attribution
Sources
- 1MicrosoftOctober 13, 2026—KB5127646 (OS Build 28000.3231) | Microsoft SupportSource published (UTC)
- 2PureinfotechKB5127648 (build 26200.9711) for Windows 11 drops as part of the October 2026 updateSource published (UTC)
Read the original source for full details and context.