If your company still runs its own email server, this month's Windows updates may cause trouble. Microsoft has confirmed that its October 2026 Windows Server security updates can stop people from signing in to web email and leave messages stuck unsent on Exchange servers that businesses run themselves. At the same time, Microsoft is ending extended security updates for Exchange 2016 and 2019 this month. Together, that makes this a good moment to ask whether keeping email on your own server is still worth it.
Is this you?
There are two common ways a business gets its email from Microsoft:
- Microsoft 365 (Exchange Online). Microsoft runs the email servers in its own data centers. You never install updates on them, and this problem does not apply to you.
- Exchange Server in your office. Your company owns a server, often sitting in a closet or server room, that runs Microsoft Exchange. Someone on your side has to install and manage its updates. This is the setup affected by the October problem.
If you aren't sure which one you have, that alone is worth a quick check.
What people will notice
The problem shows up on servers running Windows Server 2019 or later with the October update installed. Microsoft says any version of Exchange on those servers could be affected, though not every server will be. Busier servers are more likely to have trouble, and some may never see it. When it does happen, staff may find that:
- They can't sign in to Outlook on the web.
- Messages they send from Outlook sit in the Outbox and never go out.
- Mailboxes can have trouble during replication, so backup copies of mailboxes may fall behind.
The cause is a new memory limit the October update placed on a Windows component that Exchange relies on heavily. On a busy server, Exchange can hit that limit.
What Microsoft recommends
- Don't uninstall the updates. Microsoft is asking customers to keep them installed, since they also close security holes.
- A temporary workaround exists. Your IT support can make a small settings change on the server and restart it to raise the limit, then keep an eye on it.
- A permanent fix is in progress. Microsoft is working on a fix, but has not said when it will arrive.
Exchange 2016 and 2019 are also out of security updates
Separately, Microsoft will stop shipping extended security updates for Exchange 2016 and 2019 after this month. Those versions already reached end of support last year, and the paid extension that kept security fixes coming ends in October 2026. A server that no longer receives security updates is an open door for attackers, and email servers are a favorite target.
The question to ask: should we move?
For most small and mid-sized businesses, running your own Exchange server no longer makes sense. A few questions help settle it:
- Who keeps the server patched and running? Problems like this month's land on your team, often at a bad time.
- What would it cost to replace or upgrade the server? Hardware, Windows Server and Exchange licenses, and the labor to set it all up add up quickly.
- Do you need anything that only an in-house server can do? For most offices the answer is no.
- How much would a day without email cost you? Microsoft 365 runs on Microsoft's own infrastructure, with updates handled for you.
Microsoft 365 is the natural move for most Exchange users, since Outlook works the same way and your mailboxes, calendars and contacts come along. Google Workspace is another hosted option worth considering if it fits the way your team works.
How we can help
If you have a server in the closet running email, we can tell you whether you're affected by the October issue, apply Microsoft's workaround if needed, and map out a low-disruption move to Microsoft 365. Contact us or call (480) 382-3289 to get started.
Source: Microsoft: October Windows Server updates break Exchange sign-in, mail flow (BleepingComputer)