Microsoft has confirmed that the October Windows Server security updates cause Outlook on the web sign-in failures and mail delivery problems on some on-premises Exchange servers. The company posted the confirmation over the weekend on its Windows release health dashboard and in an Exchange team blog, and a fix is still pending.
Windows Update Limits Endpoint Mapper Calls Exchange Depends On
According to Microsoft, the October update added a default limit on the memory the Endpoint Mapper uses for Endpoint Lookup calls. The default allows 512 simultaneous Endpoint Lookup calls, a ceiling that Microsoft says may be too low for Exchange under heavy load.
Any Exchange version running on an affected Windows version can be hit, and the severity depends on server load. Some servers may never see the problem. The affected configuration is on-premises Exchange Server running on Windows Server 2019 and later with the October Windows security update installed.
Symptoms Administrators Are Seeing: OWA Failures, Stuck Outbox and MapiExceptionMdbOffline
Users on affected servers cannot sign in to Outlook on the web. Mail sent from Outlook stays in the Outbox, and Exchange has trouble accessing mailboxes during mailbox replication. Some administrators report the error “MapiExceptionMdbOffline: Unable to make connection to the server (hr=0x80004005, ec=1142)” along with Event ID 1006 in the application log.
According to security press coverage, the issues began appearing after the October 13 Patch Tuesday release, with on-premises servers failing under load.
Microsoft Says Exchange Security Updates Are Not the Cause
Microsoft stresses that the problem is not related to the October Exchange Server security updates and tells customers not to uninstall them. The distinction matters because administrators troubleshooting a broken Exchange server often look first at the most recent Exchange patch. Microsoft’s guidance places the cause in the Windows update instead.
The company attributes the failure to the Endpoint Mapper limit alone. It has not described any other component as involved.
The Registry Workaround: EpmapSavedContextCap Raised to 65536
Microsoft published a workaround while it works on a fix. From an elevated command prompt, administrators run reg add "HKLMSOFTWAREMicrosoftRpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f and then reboot the server. The value raises the Endpoint Mapper limit from the default of 512 simultaneous calls.
Microsoft says administrators should monitor the server afterward and raise the limit again if the problem recurs. That instruction suggests the right ceiling depends on how much load a given Exchange deployment generates.
Timeline: From Patch Tuesday to Release Health Confirmation
Microsoft released the October updates on Patch Tuesday, October 13. The company confirmed the Exchange issue on the release health dashboard and in the Exchange team blog on the weekend of October 17 and 18. Coverage followed on October 19, and the fix remained pending at that point.
Impact on Organizations Already Moving Off Older Exchange Versions
Organizations running on-premises Exchange on Windows Server 2019 or later may lose OWA access and outbound mail delivery. Microsoft is also ending extended security updates for Exchange 2016 and 2019 this month, so many of the affected servers are already in a transition period.
Teams that are planning migrations away from older Exchange versions now also have to manage a Windows patch regression on the servers they still operate, and Microsoft has not given a date for the fix.
Why the Limit Surfaces Only on Busy Exchange Servers
Because the cap applies to simultaneous Endpoint Lookup calls, quiet servers can stay under the limit while heavily used ones cross it. Microsoft’s statement that some servers may never see the problem follows from that: the failure depends on concurrent demand, not on a particular build or configuration alone. A server that handles mailbox replication during busy periods is the scenario Microsoft and the reported symptoms point to.
Microsoft has not said when it will ship a permanent fix or whether it will change the default value of the limit.
