An employee clicks Send, but the message remains in Outlook’s Outbox. Another person cannot sign in to Outlook on the web. Meanwhile, the email queue on the company’s server keeps growing.
Those symptoms can look like an internet outage, a damaged mailbox, or a Microsoft 365 problem. For organizations running Exchange Server on their own infrastructure, Microsoft has now documented another possibility: instability after October 2026 Windows Server updates.
Microsoft’s Windows Server 2025 update page says some on-premises Exchange servers may experience Outlook on the web sign-in failures, messages that do not leave the Outbox, growing mail queues, and mailbox-replication problems. Microsoft says it is investigating and provides a temporary mitigation for administrators. [1]
This issue is important—but it does not justify uninstalling security updates across every server or making an untested registry change. The right response starts with verifying whether the organization actually operates on-premises Exchange, whether the relevant Windows updates are installed, and whether the observed symptoms match Microsoft’s description.
Who is affected?
This article is relevant to organizations that operate Exchange Server 2016, Exchange Server 2019, or Exchange Server Subscription Edition on Windows Server. Microsoft’s Exchange Team says those Exchange versions might be affected after October Windows updates. [2]
Many small businesses use Exchange Online as part of Microsoft 365 and do not host Exchange mailboxes on a local server. Those organizations should not assume this specific server issue applies to them merely because staff use Outlook.
Some hybrid Microsoft 365 environments still retain an on-premises Exchange server for mail routing or recipient management. That makes the first question architectural, not diagnostic: Where do the mailboxes and mail-flow functions actually run?
Southwest Florida businesses that may have retained local Exchange include regulated organizations, firms with legacy applications, and companies operating hybrid environments. This is not a claim that any particular local organization has experienced the issue.
What Microsoft says is happening
Microsoft attributes the documented behavior to a new Windows Server default limit on memory used by Endpoint Mapper while handling Endpoint Lookup calls. The default permits 512 simultaneous calls. Microsoft says that number might be insufficient for workloads such as Exchange Server under heavy load. [1]
Microsoft lists several possible symptoms:
- Outlook on the web may fail with a mailbox-offline connection error.
- Outlook messages may remain in the Outbox instead of being delivered.
- Exchange email queues may grow as mail flow slows or stops.
- Mailbox replication can have trouble reaching mailboxes.
- Some database availability group environments may experience communication or quorum-related problems.
- A reboot may restore service only temporarily. [1][2]
The Exchange Team explicitly says the reported instability is associated with October Windows Server updates—not with the October Exchange Server security update itself. Microsoft also says the Exchange security update does not need to be installed for the Windows-related problem to occur. [1][2]
That distinction matters. An administrator troubleshooting the wrong update can create more risk without fixing the underlying condition.
Do not confuse “email sent” with “email delivered”
For a business owner, the most dangerous failure may be silent delay. An employee may believe a quote, legal notice, patient instruction, vendor order, or insurance document has been sent when it is still waiting on the server.
During a suspected incident, establish a verified communications channel outside the affected path. That might be a preapproved phone tree, text alert, status page, or alternate cloud mailbox configured before the incident. Do not improvise by moving confidential information into personal email accounts.
Identify time-sensitive messages and confirm delivery using approved methods. Avoid repeatedly clicking Send, because duplicates may be delivered when service recovers.
A safe response sequence
The following sequence is an MIA operational recommendation. It is not a substitute for Microsoft’s technical instructions or an environment-specific change plan.
1. Confirm the architecture
Document the Exchange version, Windows Server version, mailbox location, hybrid role, database availability group membership, and mail-routing path. Identify which October Windows updates are present.
If all mailboxes and transport functions are in Exchange Online, investigate the correct Microsoft 365 service health and client path instead of applying an on-premises Exchange mitigation.
2. Confirm the symptoms
Review Outlook on the web access, transport queues, relevant Windows application logs, Exchange service health, mailbox replication status, and database availability group health where applicable.
Microsoft specifically references Event ID 1006 with a MapiExceptionMdbOffline condition in some affected configurations. One symptom alone is not proof; correlate the time, server, update history, and business impact. [1]
3. Protect business communications
Tell staff what is known, what they should avoid, and how urgent messages should be handled. Maintain one source of truth for incident updates. Record which critical communications require confirmation after mail flow returns.
4. Use Microsoft’s mitigation through change control
Microsoft documents a temporary registry-based mitigation that raises the maximum number of simultaneous Endpoint Lookup calls. Microsoft also notes that increasing the limit increases the memory Endpoint Mapper may use. [1]
Only an authorized administrator should apply the current Microsoft-published setting after validating the target server, backing up the relevant configuration, defining a rollback plan, and obtaining approval. Recheck Microsoft’s article immediately before acting because the investigation remains open and guidance can change.
Microsoft Support also has an additional mitigation for affected devices. [1]
5. Verify recovery
Do not stop at “services are running.” Test Outlook on the web, internal and external mail flow, transport-queue movement, mailbox access, replication, and high availability. Confirm that previously queued messages drain without unacceptable failures or duplication.
Continue monitoring long enough to detect a recurring condition. Microsoft says a restart may provide only temporary relief in some cases. [2]
What businesses should not do
- Do not uninstall security updates throughout the environment as a first response.
- Do not apply a registry value copied from an informal post without checking Microsoft’s current guidance.
- Do not assume a reboot is a permanent repair.
- Do not move protected, financial, legal, or customer information to personal email.
- Do not clear message queues simply to make the warning disappear; understand what would be lost.
- Do not claim that every Outlook delivery delay is caused by this issue.
The goal is to restore dependable mail flow while retaining security coverage and an evidence trail.
Business-continuity lessons for Southwest Florida
Email is often treated as a convenience, but many small and midsize organizations use it as an operating system for approvals, customer commitments, scheduling, and vendor coordination.
A continuity plan should therefore define:
- Who monitors mail flow and who receives alerts.
- How the business distinguishes a client problem from a server problem.
- Which communications are time-critical.
- What approved channel is used when normal email is impaired.
- Who can authorize a server change.
- How queued messages and delivery confirmations will be reconciled.
- When customers, vendors, insurers, or regulators must be notified.
Storm planning makes the same point. Having backup power and internet service does not prove that the mail system itself can process and deliver messages.
Where AI can help—and where it should not decide
An approved AI tool can help an administrator summarize sanitized event records, correlate incident timestamps, group repeating errors, draft a business-status notice, and turn verified technical findings into a post-incident report.
AI should not be given server credentials, private keys, mailbox contents, patient information, or customer data through an unapproved service. It should not choose and execute a registry change, remove security updates, clear production queues, or declare recovery without independent validation.
The human administrator remains responsible for diagnosis, scope, rollback, and production changes. The business owner remains responsible for continuity priorities and consequential communications. AI-generated conclusions should be treated as hypotheses until they match current Microsoft documentation and evidence from the actual environment.
What to ask your IT provider today
- Do we operate any on-premises Exchange servers, including hybrid or relay roles?
- Which Exchange and Windows Server versions do they run?
- Were October 2026 Windows Server updates installed, and when?
- Are OWA failures, mail queues, mailbox replication, and high availability being monitored?
- Have we observed symptoms matching Microsoft’s known issue?
- What is our approved temporary communications channel?
- If a mitigation is required, what are the backup, approval, and rollback steps?
- How will we verify that delayed messages were delivered correctly?
- When will temporary changes be reviewed and removed?
- Is our long-term Exchange architecture still appropriate and supported?
How Managed Intelligence Advisors can help
Managed Intelligence Advisors can help business leaders translate this technical issue into a clear operational decision: whether the environment is exposed, what business process is at risk, which evidence is needed, and how to recover safely.
An engagement can be scoped to include an Exchange and mail-flow inventory, update-state review, monitoring assessment, continuity runbook, change-control review, and executive-ready findings. Where another MSP or Microsoft partner manages the environment, MIA can help define responsibilities and decision points without assuming control it does not have.
The objective is not simply to make Outlook appear normal. It is to establish that mail is being processed, delivered, monitored, and recoverable.
Request an Exchange Mail-Flow and Continuity Readiness Review from Managed Intelligence Advisors, serving Fort Myers, Cape Coral, Estero, Bonita Springs, Naples, and surrounding Southwest Florida communities.
Frequently asked questions
Does this issue affect every business using Outlook?
No. Microsoft describes an issue involving some on-premises Exchange servers after October Windows Server updates. Outlook users whose organizations are fully cloud-hosted need a different diagnosis.
Is the October Exchange security update the cause?
Microsoft says the reported instability is associated with October Windows Server updates and does not require the October Exchange security update to occur.
Should we uninstall the Windows security update?
Do not make that the default response. Have an authorized administrator confirm the issue and follow Microsoft’s current mitigation guidance with backup, approval, and rollback procedures.
Is rebooting the Exchange server a permanent fix?
Not necessarily. Microsoft says a reboot may resolve symptoms temporarily in some affected environments.
How can AI assist during the incident?
An approved AI tool can summarize sanitized logs and draft communications, but humans must validate the diagnosis and approve production changes.
What proves the email system has recovered?
Verify web access, internal and external mail flow, queue movement, mailbox access, replication, and high availability—not merely that services restarted.
Frequently asked questions
Does this issue affect every business using Outlook?
No. Microsoft describes an issue involving some on-premises Exchange servers after October Windows Server updates. Outlook users whose organizations are fully cloud-hosted need a different diagnosis.
Is the October Exchange security update the cause?
Microsoft says the reported instability is associated with October Windows Server updates and does not require the October Exchange security update to occur.
Should we uninstall the Windows security update?
Do not make that the default response. Have an authorized administrator confirm the issue and follow Microsoft’s current mitigation guidance with backup, approval, and rollback procedures.
Is rebooting the Exchange server a permanent fix?
Not necessarily. Microsoft says a reboot may resolve symptoms temporarily in some affected environments.
How can AI assist during the incident?
An approved AI tool can summarize sanitized logs and draft communications, but humans must validate the diagnosis and approve production changes.
What proves the email system has recovered?
Verify web access, internal and external mail flow, queue movement, mailbox access, replication, and high availability—not merely that services restarted. ---