Microsoft says keep the Windows update that can block Exchange email
Since October 13, on-premises Exchange servers have stopped sending messages or refused Outlook on the web. Here is the cause, the setting that works around the outage, and what not to do.
Automated publication. This article was written by artificial intelligence, then checked by a second AI model that verifies the facts against primary sources. It was published without prior human review.
Translated from French by AI. The original French article is the reference version.
Messages are stuck in Outlook's outbox. Outlook on the web refuses to open a session. On the server side, mail queues keep growing. Since the Windows security updates released on October 13 were installed, this is what is happening to some on-premises Exchange servers in companies.
Microsoft acknowledged the problem on October 16 on its Windows update tracking page. It affects Exchange Server 2016, 2019 and Subscription Edition installed on Windows Server 2016, 2019, 2022 and 2025. According to Next, the updates involved are KB5126646 (Windows Server 2025), KB5126655 (2022), KB5126651 (2019) and KB5126868 (2016). The company points out a surprising detail: you do not need to have installed this month's Exchange patches to be hit by the outage. Windows is the cause, not the mail software.
A limit added to a Windows service
According to Microsoft, the October update added a default limit on the memory used by the "Endpoint Mapper." This Windows service acts as a directory for programs that communicate with each other through remote procedure calls (RPC): it tells them which address to use to reach a service. The limit is set at 512 simultaneous requests. For a heavily loaded Exchange server, this cap "may not be sufficient," the company writes.
The symptoms described by Microsoft:
- unable to sign in to Outlook on the web;
- messages sent from Outlook that never leave the outbox;
- mail queues that keep growing;
- mailbox access failing during replication;
- in some cases, the
MapiExceptionMdbOfflineerror (ec=1142), with event 1006 in the application log.
Next adds that servers grouped in a high-availability cluster (DAG) may no longer be able to work together. According to BleepingComputer, Microsoft warns that not all servers are affected in the same way: some show no symptoms at all.
What to do if your servers are affected
Uninstalling the update seems the simplest option. That is precisely what Microsoft advises against: these updates fix many vulnerabilities, including one already exploited, as we explained in our article on October's Patch Tuesday. The company suggests raising the limit in the meantime:
- on the Exchange server, open a command prompt as administrator;
- run:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f; - restart the server;
- monitor its behavior, and raise the value again if the problem returns.
According to Next, simply restarting without this setting only relieves the server for a while. Microsoft also says another mitigation is available through its enterprise support. Remember to note the setting in your documentation: you may need to remove it once the real fix is released.
A permanent fix is still pending
As of October 19, Microsoft lists the problem as "mitigated," saying it is continuing its investigation without announcing a date. It comes at a bad time for some: according to BleepingComputer, extended security updates for Exchange 2016 and 2019 end this month, after a six-month extension announced in April. It remains to be seen whether the fix will arrive as an out-of-band update or with the next Patch Tuesday, scheduled for November 10.
Method: article written by artificial intelligence from public sources, facts verified by a second, independent AI model, published automatically without prior human review, under the editorial responsibility of Frédéric LENQUETTE. Spotted an error? Let us know. Our editorial policy.
Share this article
