RingCentral for Teams desktop plugin spawning thousands of processes on Server 2025 RDS after the October 2026 CU (KB5126646)

David R Blosser II 0 Reputation points
2026-10-19T20:32:31.0733333+00:00

Symptoms (first business day after the CU)

  • RingCentralForTeams.exe kept spawning processes on multiple hosts at once:
  • 100–160+ processes on hosts with a handful of users.
    • A host with only 2 users had 104 processes using about 11 cores.
    • The worst host reached 3,936 processes, 99.8% CPU and 98% commit charge (about 18 MB private bytes each).
    • CPU time was mostly kernel time. Logons and reconnects queued at "Please wait," and hosts became unresponsive, even to admin and WinRM.
    • There were no Application Error/WER crash events for it. It doesn't appear to crash and restart; it just keeps launching.
    • Killing it dropped one host from 88% to 15% CPU. Killing ~3,900 copies took several minutes.
  • It affected old and current plugin versions alike, so it doesn't look
  • like a bad plugin release.

Workaround The plugin runs from AppData, so the block has to work by file name. We used an IFEO Debugger key, pushed by GPO to the RDS hosts:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RingCentralForTeams.exe

Debugger (REG_SZ) = C:\Windows\System32\blocked-by-IT.exe

Then kill it and remove the per-user plugin folders:

taskkill /F /IM RingCentralForTeams.exe

Get-ChildItem 'C:\Users*\AppData\Local\Programs\ringcentral-desktop-plugin' -Directory | Remove-Item -Recurse -Force

Your EDR may flag the IFEO change. That's expected.

Unconfirmed theory KB5126646 adds a default cap of 512 on RPC Endpoint Mapper lookup contexts (EpmapSavedContextCap), documented for Exchange under load. RDS hosts are RPC-heavy. We're testing HKLM\SOFTWARE\Microsoft\Rpc\EpmapSavedContextCap = 65536 (DWORD, needs a reboot) on one host. Not verified.

Is anyone else seeing this on Server 2025 / 2022 RDS since the October CU? Cases are open with the vendors. I'll update with what we find.

Windows for business | Windows Server | User experience | Remote desktop services and terminal services
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daphne Huynh (WICLOUD CORPORATION) 2,540 Reputation points Microsoft External Staff Moderator
    2026-10-20T11:03:24.83+00:00

    Welcome to Microsoft Q&A!

    Thank you for taking the time to share such a detailed investigation.

    Based on the information currently available, there are a few important points to separate between what is documented and what is still being investigated.

    1. What is currently confirmed

    Microsoft has documented an issue associated with the October 2026 Windows Server updates, including KB5126646 for Windows Server 2025, involving the RPC Endpoint Mapper retained lookup-context limit.

    The available information indicates that increasing EpmapSavedContextCap has been used as a temporary mitigation for affected Exchange workloads. However, the currently documented scenario does not establish that this RPC behavior causes RingCentralForTeams.exe to launch repeatedly on RDS hosts.

    For that reason, testing a higher EpmapSavedContextCap value on an isolated host may provide useful diagnostic information, but I would avoid considering it a confirmed resolution for the RingCentral behavior until the relationship has been verified by Microsoft or RingCentral.

    2. RingCentral deployment considerations

    It would also be helpful to verify the RingCentral side of the deployment with RingCentral Support, particularly:

    • Whether the installed RingCentral for Teams plugin and related VDI components are supported on Windows Server 2025.
    • Whether all required RingCentral services are installed and running correctly in the multi-session RDS environment.
    • Whether more than one startup mechanism could be launching the plugin, such as Teams integration, a user startup entry, scheduled task, logon script, or updater.
    • Whether the repeated process creation is related to the plugin being unable to establish a required service or IPC connection after the Windows update.

    These checks may help distinguish between a Windows-side change that is triggering the behavior and a RingCentral component repeatedly attempting to recover from an unexpected condition.

    3. Recommended next steps

    Since you are not seeing corresponding Application Error or WER crash events, identifying what is creating each new RingCentralForTeams.exe process would be especially valuable.

    If possible, I recommend collecting the following from an isolated affected host:

    • Parent process ID and command line for several newly created RingCentralForTeams.exe processes.
    • A Process Monitor trace filtered for process creation involving RingCentralForTeams.exe.
    • RingCentral plugin, updater, and related service logs.
    • Relevant System, Application, RPC, and RDS event logs.
    • Results from comparing an affected host with the default RPC configuration against the isolated host where EpmapSavedContextCap is being tested.
    • Results after isolating any automatic startup mechanisms that may be launching the plugin.

    The IFEO configuration you implemented is understandable as an emergency containment measure given the severity of the resource exhaustion. However, because it prevents the executable from starting rather than addressing the underlying cause, I would consider it a temporary containment measure only. It should be carefully documented and reassessed once Microsoft or RingCentral provides a supported resolution.

    At this stage, the timing makes KB5126646 a reasonable area to investigate, particularly because an RPC-related behavioral change has been identified. However, there is not yet enough documented evidence to conclude that the update is directly responsible for the RingCentralForTeams.exe process-spawning loop.

    Since you already have cases open with the respective vendors, I would strongly recommend continuing those investigations and providing the parent-process information and process-creation traces. That evidence should help determine whether the repeated launches originate from Windows, Teams, a RingCentral component, or another startup mechanism.

    I appreciate that this may not provide the definitive root cause you were hoping for, especially after the amount of troubleshooting you have already completed. Unfortunately, Microsoft Q&A is a public community forum, I can only confirm behavior that has been publicly documented or officially communicated through supported Microsoft channels. I do not have access to the internal engineering investigation or the RingCentral product investigation, so I would not want to speculate beyond the evidence currently available.

    If you can reproduce the behavior in a clean environment and the issue persists after removing other policies or startup mechanisms from the equation, I would recommend sharing that reproduction information with Microsoft Support as part of the existing investigation. A clean reproduction, together with the process-parent and trace data, would be particularly useful in determining whether the Windows update is involved.

    Reference: October 13, 2026—KB5126646 (OS Build 26100.33650) | Microsoft Support

    While this is not a Microsoft website, it is the official site of support.ringcentral.com

    If you find it useful, please click Accept Answer.

    Thank you for choosing Microsoft Q&A.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.