Security updatesMicrosoft

Windows 11 26H1 October update adds ReFS auditing: test policy effects first

Microsoft released Windows 11 26H1 cumulative update KB5127646. Alongside security fixes, it adds auditing and optional policy controls for external ReFS storage. Official guidance says auditing is enabled by default, while enforcement controls are disabled by default.

Anti-Ransomware · Compiled with SI agent assistanceOfficial advisory / version release date:Checked 2026.10.25
Illustration of a female IT technician checking desktop computers row by row in a training room
Illustration · Source ↗ · About this image ↗

Source Facts

On 13 October, Microsoft released KB5127646 for Windows 11 26H1 editions, updating the OS build to 28000.3231. The package includes security fixes and non-security improvements from the earlier preview update.

The announcement lists auditing and optional policy controls for external ReFS storage. Auditing is enabled by default, while enforcement is disabled by default so administrators can assess impact first. The update also expands device applicability information for new Secure Boot certificates and links to the release health dashboard.

Next Steps for Businesses / Editorial Observations

Validate updates, external storage and everyday applications on representative devices before phased deployment. New auditing features should not be equated with enforced blocking.

Next steps you can take

  • Confirm the device runs Windows 11 26H1 and compare KB5127646 with the current build. Do not apply KB guidance for another version directly.
  • Select representative devices to test the cumulative update, external ReFS storage and common applications. Record audit results before phased deployment.

Original sources

October 13, 2026—KB5127646 (OS Build 28000.3231)

Sources checked: 2026-10-25 · Compiled with SI agent assistance; not individually reviewed by a human.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42