Exchange OnPrem / Hybrid
On-premises Exchange Server, security updates, hybrid connectivity to Exchange Online, and the migration to Exchange SE.
Exchange outages after the October 2026 Windows Server updates: MapiExceptionMdbOffline (ec=1142)
After the October 13, 2026 Windows Server updates, Exchange servers report MapiExceptionMdbOffline (ec=1142) after around 24 hours: OWA fails, queues grow, and DAG copies stop replicating. The cause is a new limit in the RPC Endpoint Mapper; since October 17, 2026, Microsoft has recommended the EpmapSavedContextCap registry value, but a fix is still unavailable. Symptoms, affected KBs, verification commands, and procedure.
October 2026 Exchange security updates: six vulnerabilities, final update for Exchange 2016 and 2019
The October SU closes six vulnerabilities, including a critical remote code execution issue through a crafted email, and fixes the .ics issue and the WordBreaker deadlock. It is the final update for Exchange 2016 and 2019, including under the ESU program.
Exchange Security Update September 2026 v2: Early Fix for CVE-2026-96940
On October 2, 2026, Microsoft released version 2 of the September SUs for Exchange SE, 2019, and 2016. It also addresses CVE-2026-96940, an elevation-of-privilege vulnerability with a CVSS score of 8.8 and an “Exploitation More Likely” assessment. Microsoft recommends installing v2 as soon as possible, including on servers running the first September SU.
September 2026 Exchange Security Updates: Nine Vulnerabilities, Wrapper Issue Fixed, v2 Released
The September SU closes nine vulnerabilities in Exchange SE and 2019 (eight in Exchange 2016), including a spoofing vulnerability with CVSS 9.3, and fixes the wrapper issue in hybrid environments. A v2 with an additional CVE followed on October 2; there are also three known issues with workarounds and a SettingOverride that should now be removed.
Closing a journaling gap: Exporting from Microsoft Purview and importing into Enterprise Vault
If journal reports from Exchange Online fail for several days, they cannot be generated retroactively. However, the content still exists in the mailboxes. Learn how to export it as PST through the new Purview eDiscovery, why Enterprise Vault's PST Migrator is usually not an option, and how to reimport it through the journal mailbox without displacing the active journal stream, using two generic scripts for importing, moving, and logging.
Exchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works
Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.
How Long Does an SMTP Session Stay Open? ConnectionTimeout 00:10:00 in Exchange and the Systems for Which That Is Too Short
Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.
CVE-2026-62911: Why 85 Percent of On-Premises Exchange Servers Are Vulnerable and What Is Technically Behind It
The BSI reports that around 85 percent of on-premises Exchange servers in Germany are vulnerable to CVE-2026-62911. This article explains the vulnerability technically: MRSProxy, missing Channel Binding, NTLM relay, and Orange Tsai’s Pwn2Own chain, along with context for the figures and the specific recommended actions.
AuthMechanism 10 and AuthAs Internal: How Exchange Classifies Message Submission in the Header
The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.
Internal or External? Interpreting Exchange Hybrid Mail Headers: AuthAs, MessageDirectionality, and X-originatororg
In Exchange hybrid environments, header classification determines whether an email is treated as internal. Which headers carry the classification, how tenant attribution works through certificates and connectors, and how to identify a misrouted message.
Determining a Mail Server’s Load Profile: Bursts, Peak Rates, and Recipient Structure from Message Tracking
How many emails per minute does your mail server really process, and how high are the peaks? How to use PowerShell and Exchange Message Tracking to determine the real load profile: rates per minute and hour, burst duration, recipient structure, message sizes, and common analysis mistakes.
Analyzing Exchange Mail Flow: Message Tracking, SMTP Logs, and Receive Connectors
How to systematically determine where a message ended up in Exchange On-Premises, Hybrid, and Exchange Online: queries with sample output, how to read the SMTP log correctly, and the issues that regularly lead to incorrect conclusions.
What We Can Learn from Science for IT Troubleshooting
Falsifiability, control groups, confounding variables, and sampling bias: the method natural sciences have used for centuries solves exactly the problems where IT troubleshooting regularly fails, illustrated with examples from mail flow.
Who Is Actually Delivering to Your Tenant? Aggregating Sending IP Addresses
A single report shows which systems actually deliver mail to your tenant: forgotten connectors, applications sending directly, and service providers nobody documented, including the typical analysis errors involving pagination logic and interpretation.
Common Causes of Mail Loops and How to Fix Them
How to systematically identify and fix SMTP mail loops in Exchange Online, hybrid environments, and upstream mail gateways using NDRs, headers, Message Trace, recipient objects, and connectors.
EXO Migration Without a Remote Move
How to provision on-premises Exchange mailboxes in a controlled manner as new, empty Exchange Online mailboxes: PST backup, CSV approval, RemoteMailbox, synchronization, validation, and rollback.
