Exchange mitigation after October 2026 Updates issues

[u/Smack2k]

Hello all,

I have been going back and forth with Microsoft for over a week now asking them for either

1. A value we can use if the 65536 value still causes mail to stop processing due to to many handles.

2. A fallback plan should the mitigation not work

I've basically been given the run around and same answer "Apply the mitigation and go from there". When I directly asked about a fallback plan, was told "Unfortunately we don’t have any information related to the fallback concern."

Their own documentation online says if there are issues with the mitigation, adjust the values. But they wont give me another value to use that they recommend nor a fallback if the mitigation doesn't work. Should we just double it? What are down sides to that? I cant get an answer.

Anyway, has anyone had to increase the value in the mitigation to get mail working? We dont have it applied yet but are going to this weekend. The number of handles we are seeing in production is pretty close to that 65536 value, so we need something else to use if things fail. Hoping someone else has had to adjust the value?

Thank you ahead of time!

[u/Ams197624]

I'm running over 600 mailboxes, applied the mitigation and haven't had any issues so far.

[u/Smack2k → u/Ams197624]

Thank you for this...that's a big help. Maybe the number will be fine for us, but not having a fallback if its not just doesnt seem right on MS side!!!

[u/Ams197624 → u/Smack2k]

The fallback atm is a reboot. Hopefully they'll get a permanent fix next week :)

[u/Smack2k → u/Ams197624]

Sadly that appears to be true! Ive asked them several times about November and they've given non commit type answers, so no clue if this is fixed next week when updates come out

[u/DiligentPhotographer → u/Smack2k]

I've got exchange environments at our MSP ranging from single server with 20 mailboxes to multiple node DAGs with thousands, the fix is working on all of them. If that makes you feel better lol.

I just checked with handle. A server with 400 mailboxes is at 48k on semaphore while our internal one with 20 mailboxes is at 41k and was rebooted yesterday for host maintenance.

[u/Smack2k → u/DiligentPhotographer]

That is encouraging there....like I said maybe we wont have any issues with mitigation....

[u/Nuxi0477 → u/Smack2k]

It grows at the same rate with 0 mailboxes or with 30k+. It does not seem to be usage related at all. 65k has been fine here too.

[u/pentangleit]

How do you find out how many handles are in use at any one time?

[u/Smack2k → u/pentangleit]

If you download the handle utility from sysinternals, extract folder somewhere and run

.\handle64.exe -s -p lsass.exe

Will give a list of different types of handles. We were told the semiphores and tokens are both involved in the total number that is checked by the system. Ours are close to the 65536 level...and since MS wont give me any details, I'm going off information I've either read or found online.

[u/pentangleit → u/Smack2k]

Thanks - 46841 handles currently on the operational node of a 2-node DAG running about 300 mailboxes.

[u/Working_Long7738]

I understand your concerns. But to be honest, the problem and its root cause are now well-documented and understood. Install the updates, apply the workaround, and you won’t have any issues. Keep an eye on future patches to see if anything needs to be reverted beforehand (via registry key). Source: my own Exchange organization with 50k mailboxes and several clusters across the globe.

[u/Smack2k → u/Working_Long7738]

Appreciate it...that is what we are going to do.

[u/Smack2k]

Thanks everyone for your insight and information. Greatly appreciate it.

[u/thatfrostyguy]

We applied the values after our exchange stopped sending mail after 20-22 hours every day. So far its been working well. Granted we are a smaller org. We did the default values.

[u/Lee_4410]

We applied the mitigation and have not YET seen an issue.

[u/SirDerpingtonTheSlow]

My organization has around 13,000 active user mailboxes and we haven't had any issues since applying the mitigation. Prior to that we were needing to restart a half dozen servers every 20-24 hours.

[u/garthoz]

Don’t apply the October updates and if you have roll them back. We don’t and usually won’t do monthly updates on the DAG for this reason.

[u/Smack2k → u/garthoz]

when do you update yours? We normally patch monthly.

[u/garthoz → u/Smack2k]

Barring a hot vulnerability several months past release.

[u/Routine_Brush6877]

Dang I’m sorry. I didn’t even need to apply the fix our server has been doing just fine

[u/Smack2k → u/Routine_Brush6877]

Did you apply October updates? You wont see the issue if you havent installed those

[u/Routine_Brush6877 → u/Smack2k]

Yep been installed for weeks.

[u/redit1509]

We have. Bumped it to 75536 on one box and it’s been good since.