Log Name:      Application
Source:        MSExchange RPC Client Access
Event ID:      26
Level:         Warning
Description:   The session with the user "DOMAIN\username" has been
               terminated because the connection timed out while waiting
               for a response from the server.
               Elapsed time: 120000 ms

# Get Event ID 26 entries from last 24 hours24 hours
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ProviderName = 'MSExchange RPC Client Access'
    Id = 26
    StartTime = (Get-Date).AddHours(-24)
} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-Table -Wrap

# Count disconnections by user
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ProviderName = 'MSExchange RPC Client Access'
    Id = 26
    StartTime = (Get-Date).AddHours(-24)
} | ForEach-Object {
    if ($_.Message -match 'user "([^"]+)"') { $matches[1] }
} | Group-Object | Sort-Object Count -Descending | Select-Object -First 10

# Check Exchange server resource usage
Get-Counter -Counter "\Processor(_Total)\% Processor Time", "\Memory\Available MBytes", "\PhysicalDisk(_Total)\Avg. Disk sec/Read" -SampleInterval 1 -MaxSamples 5 | ForEach-Object {
    $_.CounterSamples | Select-Object Path, CookedValue
}

# Check RPC Client Access service
Get-Service MSExchangeRPC | Select-Object Name, Status

# Check RPC performance
Get-Counter -Counter "\MSExchange RpcClientAccess\RPC Averaged Latency" -SampleInterval 1 -MaxSamples 5

# Test basic connectivity to Exchange
$exchangeServer = $env:COMPUTERNAME
Test-NetConnection -ComputerName $exchangeServer -Port 443

# Check for network issues from client perspective
# Run from affected client:
# Test-NetConnection -ComputerName mail.domain.com -Port 443 -InformationLevel Detailed-ComputerName mail.domain.com -Port 443 -InformationLevel Detailed

# Check if MAPI over HTTP is enabled
Get-MapiVirtualDirectory | Select-Object Server, IISAuthenticationMethods, InternalUrl, ExternalUrl

# Check organization config
Get-OrganizationConfig | Select-Object MapiHttpEnabled

# If not enabled, consider enabling for better stability
# Set-OrganizationConfig -MapiHttpEnabled $true-MapiHttpEnabled $true

# Check current RPC settings
Get-RpcClientAccess | Select-Object Server, MaximumConnections, *Timeout*

# Increase timeout for high-latency scenarios
# This provides immediate relief while investigating root cause
# Default is 00:02:00 (120 seconds), increase to 5 minutes02:00 (120 seconds), increase to 5 minutes

Set-RpcClientAccess -Server $env:COMPUTERNAME -BlockedClientPercentageThreshold 10

# For persistent issues, consider Throttling Policy adjustments
# Get-ThrottlingPolicy | Select-Object Name, RCA*-Object Name, RCA*

# Enable MAPI/HTTP for better resilience
Set-OrganizationConfig -MapiHttpEnabled $true

# Verify MAPI virtual directory
Get-MapiVirtualDirectory | Select-Object Server, InternalUrl, ExternalUrl

# If URLs not set, configure them
Set-MapiVirtualDirectory -Identity "$env:COMPUTERNAME\mapi (Default Web Site)" -InternalUrl "https://mail.domain.com/mapi" -ExternalUrl "https://mail.domain.com/mapi" -IISAuthenticationMethods Ntlm,OAuth,Negotiate

# Check for packet loss and latency
# Run extended ping test
Test-Connection -ComputerName mail.domain.com -Count 100 | Measure-Object -Property ResponseTime -Average -Maximum -Minimum

# Check DNS resolution
Resolve-DnsName mail.domain.com
Resolve-DnsName autodiscover.domain.com

# Check for proxy interference
netsh winhttp show proxy

# For users on VPN, ensure split tunneling allows Exchange traffic
# Or route Exchange traffic directly

# Check database status and health
Get-MailboxDatabase -Status | Select-Object Name, Mounted, DatabaseSize, AvailableNewMailboxSpace

# Check for database issues
Get-MailboxDatabaseCopyStatus | Select-Object Name, Status, CopyQueueLength, ReplayQueueLength

# Monitor RPC performance
Get-Counter -Counter "\MSExchange RpcClientAccess\RPC Requests", "\MSExchange RpcClientAccess\Active User Count", "\MSExchange RpcClientAccess\User Count" -SampleInterval 5 -MaxSamples 10 | ForEach-Object {
    $_.CounterSamples | Select-Object Path, CookedValue
}

# On affected client workstations:

# 1. Create new Outlook profile
# Control Panel > Mail > Show Profiles > Add

# 2. Disable add-ins (start Outlook in safe mode)-ins (start Outlook in safe mode)
# Run: outlook.exe /safe

# 3. Check Outlook connection status
# Ctrl+Right-click Outlook tray icon > Connection Status

# 4. Force MAPI/HTTP
# Registry: HKEY_CURRENT_USER\Software\Microsoft\Exchange
# DWORD: MapiHttpDisabled = 0

# 5. Reduce cached mode timeframe
# File > Account Settings > Account Settings > Change > 3 months instead of All

# Check for Event ID 26 after fixes
$hoursSince = 2  # Check last 2 hours
$events = Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ProviderName = 'MSExchange RPC Client Access'
    Id = 26
    StartTime = (Get-Date).AddHours(-$hoursSince)
} -ErrorAction SilentlyContinue

if ($events) {
    Write-Host "Found $($events.Count) disconnection events in last $hoursSince hours"$hoursSince hours" -ForegroundColor Yellow
} else {
    Write-Host "No disconnection events in last $hoursSince hours" -ForegroundColor Green
}

# Check RPC latency
Get-Counter -Counter "\MSExchange RpcClientAccess\RPC Averaged Latency" -SampleInterval 1 -MaxSamples 5 | ForEach-Object {
    $latency = $_.CounterSamples[0].CookedValue
    $color = if ($latency -lt 50) { "Green" } elseif ($latency -lt 100) { "Yellow" } else { "Red" }
    Write-Host "RPC Latency: $([math]::Round($latency,2)) ms"2)) ms" -ForegroundColor $color
}