In this blog post October Patch Tuesday Exchange Server Stabilisation Checklist we will explain how to confirm that your Exchange environment is stable, protect mail flow and reduce the chance of another patch-related outage.
Your servers may look healthy immediately after patching, only for Outlook on the web to fail, outgoing messages to queue up or mailbox databases to become unavailable later. For IT managers, the challenge is knowing whether the incident is genuinely resolved or simply waiting to return during the next busy period.
What happened after October Patch Tuesday
Microsoft Exchange Server provides business email, calendars, shared mailboxes and related services. When it runs on your own infrastructure, it depends on both the Exchange application and the underlying Windows Server operating system.
That distinction matters in October 2026. Microsoft confirmed that some Exchange Server 2016, 2019 and Subscription Edition systems became unstable after Windows Server updates released on 13 October 2026. The problem was not caused by the October Exchange security update itself.
Affected servers could lose access to mailbox databases, stop processing email normally or experience problems with database availability groups. A database availability group, commonly called a DAG, is a group of Exchange servers that keeps copies of mailbox databases available if one server fails.
The October issue affected how Windows handled some of the internal communications Exchange uses between services. Under sufficient load, the available capacity for tracking those communications could be exhausted. A reboot might restore service temporarily without removing the underlying risk.
If you are still dealing with an active outage, start with our Exchange Server instability triage guide. The checklist below begins once basic service has been restored.
1. Confirm exactly what changed
Do not rely on a ticket that simply says “October updates installed”. Record the Windows Server version, installed Windows update, Exchange version, Exchange security update and reboot time for every server.
The Windows updates associated with the confirmed issue were KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019 and KB5126868 for Windows Server 2016.
Microsoft advised organisations not to uninstall these security updates. Removing a security patch can reopen vulnerabilities and create a second incident while the first is still being managed.
Use our October 2026 Exchange patch checklist to confirm the installed versions and identify any missing updates.
2. Apply the Microsoft mitigation through change control
As at 19 October 2026, Microsoft’s published mitigation is to increase a Windows setting that controls the number of saved RPC communication contexts. RPC is the mechanism Windows applications use to communicate with services elsewhere on the server or network.
Run the following from an elevated Command Prompt on an affected Exchange server:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /fThe server must then be rebooted. Treat this as a formal production change: capture the previous state, obtain approval, schedule the reboot and confirm that backups and recovery procedures are usable.
For multi-server environments, change one server at a time. Confirm it has returned to service before proceeding to the next server so that email remains available throughout the work.
3. Check Exchange health rather than just server uptime
A server responding to a ping or showing a Windows login screen does not prove that Exchange is working. Your checks need to follow the same path used by employees and business applications.
At a minimum, verify:
- Users can open Outlook and Outlook on the web.
- Internal and external messages are sent and received.
- Shared mailboxes, calendars and mobile devices work normally.
- Mail queues are not steadily increasing.
- Mailbox databases are mounted and healthy.
- DAG members can communicate and database copies are current.
- Backup, archiving, scanning and line-of-business integrations still work.
Useful Exchange Management Shell checks include:
Test-ServiceHealth
Get-Queue | Sort-Object MessageCount -Descending
Get-MailboxDatabaseCopyStatus *These commands provide a starting point, not a final verdict. Compare the results with your normal baseline and investigate unusual queue growth, failed database copies or repeatedly stopping services.
4. Monitor through a full business cycle
The October problem can become more visible as workload increases. Declaring success ten minutes after a reboot is therefore risky.
Monitor the environment for at least 48 hours, including a busy morning period. Track mail queue depth, database availability, Outlook on the web failures, service restarts, CPU and memory use, and relevant Windows event log errors.
Set clear escalation thresholds. For example, investigate if a queue grows for more than 15 minutes, a database copy falls behind or employees begin reporting delayed messages. This turns monitoring into an operational control rather than a collection of dashboards nobody is watching.
5. Test the business processes people forget
Email appearing in Outlook is only part of the picture. Many businesses use Exchange to deliver website enquiries, invoices, monitoring alerts, password resets, scanned documents and messages from older applications.
Create a short list of business-critical mail flows and test each one. A finance system that cannot send invoices may create a larger financial impact than a short interruption to employee email.
6. Keep an evidence pack
Record the installed updates, mitigation applied, reboot times, validation results and monitoring evidence. Also document who approved the change and whether any exceptions remain.
This supports the Essential Eight, the Australian Government’s cybersecurity framework that many organisations use to improve security maturity. Regular patching is important, but auditors and executives also need evidence that updates were controlled, tested and verified.
This incident reinforces why mid-market patch validation cannot be optional. A successful installation message is not the same as a successful business outcome.
A practical scenario
Consider a 180-person company with two Exchange servers. Both reboot successfully overnight, and the patching job is marked complete. By mid-afternoon, email queues begin growing and webmail becomes unreliable.
A second reboot temporarily clears the symptoms, but the business loses several hours to delayed orders, support requests and supplier communication. A structured stabilisation process would have identified the affected Windows updates, applied the mitigation one server at a time and monitored queue growth before the next business peak.
The value is not simply technical stability. It is fewer employee interruptions, less management uncertainty and a lower risk of missed revenue.
7. Make a decision about the future of on-premises Exchange
October 2026 is also the final month of extended security updates for Exchange Server 2016 and 2019. After this point, Microsoft’s security updates continue for Exchange Server Subscription Edition, not the older releases.
If your organisation still runs Exchange 2016 or 2019, stabilisation should be followed by a documented upgrade or migration decision. The realistic choices are moving to Exchange Subscription Edition or migrating mailboxes to Exchange Online within Microsoft 365.
Exchange Online does not remove every email risk, but it transfers much of the underlying server maintenance and patching burden to Microsoft. Security settings, account protection and data governance still need active management, as covered in our Microsoft 365 security checklist.
Stability should be measurable
Your Exchange environment is not stable merely because complaints have stopped. Stability means updates are verified, mail queues remain normal, databases stay healthy, critical applications can send email and the environment has passed a full period of business load.
CloudProInc is a Melbourne-based Microsoft Partner and Wiz Security Integrator with more than 20 years of enterprise IT experience. We help organisations across Australia assess Exchange, Windows Server and Microsoft 365 environments without turning the process into a large, open-ended consulting project.
If you are not sure whether your Exchange servers are stable, supported or costing more to maintain than they should, we are happy to take a practical look and help you understand the next step — no strings attached.