Just opening a thread here because I've seen some known-issues and workarounds online related to the Microsoft Windows Server patches for this month.
So far these appear to be issues resulting from the patches themselves, not related specifically using BigFix to deploy them -
Windows Server Known-Issues Bulletins - Well Worth the Read, the links are always worth keeping handy, but it can take a while before new issues are updated here:
Exchange Server Instability
Symptoms that can be seen are various, but here are some:
- Exchange Server OWA may fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with event ID 1006 logged in the Application Log.
- Exchange email queues might grow during the day, with email crawling to a halt.
- Various issues related to DAG members not being able to reach quorum have been reported too.
- Exchange server reboot might resolve the issues temporarily.
- Exchange Server 2016, 2019 or Subscription Edition (SE) might be impacted.
From that article, it looks like Microsoft may have changed some behaviors in the RPC Endpoint Mapper - which is deep in Windows internals' and could cause any number of issues.
This article has some in-depth descriptions on the new RPC Endpoint Mapper Limits:
https://www.rack2cloud.com/endpoint-mapper-limit/
The article mentions some other major changes (that were previously disclosed) while complaining that Microsoft did not include the RPC change int he release notes:
The same four notes disclose other default changes.
The DKM ACL change is listed in all four: AD FS remediation now runs by default, with
RemediateDkmAclset to 0 as the opt-out, a change covered in DKM ACL hardening.ReFS auditing on externally attached storage is on by default in all four.
The Server 2025 note also states that NTLMv1 SSO now defaults to Enforce when
BlockNtlmv1SSOis not set.Each of those carries a registry value or a policy an administrator can find in the note and act on.