Has anyone removed their final Exchange server but kept Hybrid & AD Connect running

[-]

pieceofpower@reddit

We are running hybrid with AD Connect. I shut ours down about a year and a half ago and have had no issues. I remember reading with their guidance that you don't want to uninstall exchange because you need to keep the exchange properties in AD still and if you uninstall exchange it removes those properties. I've never had to turn it on.

Reply

[-]

zmbie_killer@reddit

How do you create new users with a linked 365 mailbox? Do you simply have the exchange tools on another system to run Enable-RemoteMailbox?

Reply

[-]

pieceofpower@reddit

You could do that, but I just have a script that adds the attributes and then they get picked up with the next sync cycle. I think this is the basic script but I have a longer one that does it as user creation as well. $user = Read-Host "Enter in the Username" $proxyAddress1 = "SMTP:$($user)@contoso.com" $proxyAddress2 = "smtp:$($user)@contoso.mail.onmicrosoft.com" $proxyAddress3 = "smtp:$($user)@contoso.org" $targetAddressNew = "smtp:$($user)@contoso.mail.onmicrosoft.com" $mailNickname = $user $mailName = "$($user)@contoso.org" Set-ADUser -identity $user -add @{proxyAddresses = "$proxyAddress1"} Set-ADUser -identity $user -add @{proxyAddresses = "$proxyAddress2"} Set-ADUser -identity $user -add @{proxyAddresses = "$proxyAddress3"} Set-ADUser -identity $user -add @{targetAddress = "$targetAddressNew"} Set-ADUser -identity $user -EmailAddress $mailName Set-ADUser -identity $user -add @{mailNickname = "$mailNickname"} Get-ADUser $user -properties * Read-Host "Added Attributes press enter to close"

Reply

[-]

ADynes@reddit (OP)

Looking back over this and the only proxy address we have had to add is the standard [user@contoso.com](mailto:user@contoso.com) and none of the "onmicrosoft" ones. It's been 3 months and we've added about 7 users in that time frame with no issues.

Reply

[-]

pieceofpower@reddit

Nice, yeah those other proxies are probably just specific to my org because we have multiple domains and different aliases for users and stuff. Glad it worked out.

Reply

[-]

ADynes@reddit (OP)

Yeah, in the article there's a big section with a reddish background that says do not uninstall Exchange as it will remove the properties required. It's actually the first Microsoft article I've seen a warning that large. It just seems counterintuitive to just leave it there and turned off. Like why wouldn't they just release some type of software update that uninstalls Exchange cleanly but still retains the properties. But consensus seems to be it works fine so...

Reply

[-]

pieceofpower@reddit

I just deleted the vm after about a year of no issues and haven't thought about it lol.

Reply

[-]

Krigen89@reddit

I don't know about uninstalling, that's probably a bad idea, but you can definitely turn off/delete the VM. AD properties stay available.

Reply

[-]

Itscappinjones@reddit

I want to shut my exchange server off so badly. I am in the same boat as many here. Its all migrated and I have AAD Connect, Entra, etc. I need to work up the courage to shut it off and see what happens.

Reply

[-]

ADynes@reddit (OP)

FYI - see the edits in my OP but we have had 0 issues at all doing this.

Reply

[-]

Unable-Entrance3110@reddit

I have this same trepidation over changing the password on the Kerberos TGT account... I know that it should be fine... but I can't bring myself to do it for fear of breaking the network.

Reply

[-]

ConfidentFuel885@reddit

Change it, wait a week, and change it again. Really nothing to worry about at all.

Reply

[-]

Unable-Entrance3110@reddit

Thanks. I know that it should be fine. But then I read a horror story about someone who did it and things went terribly wrong. I look at the open source, multi-thousand-line PowerShell scripts for doing this and I am like "holy crap, that's a lot of contingency planning for a password change". It just freaks me out. I know, it's sort of irrational. I just need to educate myself better, but then I move on to something else and forget about doing it because everything is working right now and why would I purposely throw a wrench in the works?

Reply

[-]

ConfidentFuel885@reddit

I don’t even use the scripts lol. I just raw dog the password change and wait a few days to do it again. I do get the hesitancy though.

Reply

[-]

Krigen89@reddit

Do it. Wait a week, backup the VM one last time, delete the VM. Sleep happily.

Reply

[-]

HankMardukasNY@reddit

Yes, did it shortly after they released the guidance. Nothing broke. Still have AD Connect running. All of our computers are Entra Joined and managed with Intune

Reply

[-]

Cultural-Horse-762@reddit

Feels good. Device writeback makes it all so smooth.

Reply

[-]

OCAU07@reddit

Was there anything you did you clean up AD to remove exchange attributes from the schema?

Reply

[-]

Expensive-Bed3728@reddit

Definitely dont want to remove the attributes, need them to manage mailboxes still, such as hidefromgal, mailnickname, proxy addresses etc

Reply

[-]

ReformedBogan@reddit

There’s 2 Microsoft pages that detail everything you need to do. Ones for the recipient and ones for prep to shut down the last Exchange server. The second page details the script you can run to clean up AD which removes the Exchange objects and permissions that aren’t required, while leaving the attributes in place. I don’t have it in front of me, but IIRC it’s in Exchange 2019 management tools that you’ll need to install on a management box.

Reply

[-]

OCAU07@reddit

I came into a role a couple of years back that had already made migrated to Exchange online fully before I started and we are now hybrid. There is still a lot of ms Exch attributes in AD still as part of the ad schema. Wasn't sure if this was correct but it seems based in your reply it might be

Reply

[-]

graywolfman@reddit

Same

Reply

[-]

ReformedBogan@reddit

Yep. Done it at several sites. Only very infrequently do we need to use Powershell to manage recipient details.

Reply

[-]

shifty_new_user@reddit

Same here. No issues.

Reply

[-]

Flatline1775@reddit

Same here.

Reply

[-]

mmeister97@reddit

i can agree to that.

Reply

[-]

WhAtEvErYoUmEaN101@reddit

Done is on four dozen customer environments so far. It is indeed the way to go

Reply

[-]

Emiroda@reddit

Yep and I was boo'd by this subreddit some years ago for suggesting it as an option. As if it's of the utmost importance for random small companies to be able to call Microsoft Premium Support to get bug fixes for something that's probably not Exchange related anyway. The last Exchange server had to be there because it's Microsoft's only supported tool to edit AD attributes related to Exchange, but that's in AD and not Exchange! So yeah, unless you have a Microsoft Premium Support agreement and you actively depend on it, being unsupported is not a worry. Make your own assesment and have management sign off on it if you're in any doubt.

Reply

[-]

Jeff-IT@reddit

We just shut down our exchange server a month ago and it’s the best thing we ever did. We stil have our AD on site

Reply

[-]

Dikvin@reddit

Why, can you elaborate

Reply

[-]

Jeff-IT@reddit

Its just a lot easier to manage. Talking strictly cloud benefits here MS handles security instead of us. Dont have to do as much in terms of dmac, spc, dkim. Built in anti-spam Better email deliverable-ility / better trust. Since its microsoft and not our IP sending the emails

Reply

[-]

Dikvin@reddit

Makes sense, thank you for your feedback.

Reply

[-]

Unable-Entrance3110@reddit

Yes, I shut down my last Exchange server in 2015 after migrating to 365. I never did an uninstall of Exchange, the AD Schema is still there, but the VM has been powered off for 10 years now. I think I finally removed the computer account from the domain a few years ago.

Reply

[-]

ITGuyThrow07@reddit

Yes, we use the Exchange Management Tools you linked. They're fine, except they're a freaking SNAP-IN so you can only use them in PowerShell 5. PowerShell 7 doesn't support snap-ins. Make sure you follow their instructions for "removing" Exchange. DO NOT UNINSTALL EXCHANGE FROM THE LAST SERVER.

Reply

[-]

phunky_1@reddit

We still have the on prem server. A lot of exchange attributes for on prem identities can only be managed via on prem exchange. The attributes are read only in Entra ID.

Reply

[-]

Expensive-Bed3728@reddit

This is wrong, it s fully supported you do not need the servers they can all be decommed, do not uninstall exchange just stop the vm's. Manage exchange attributes using asdi edit or advanced features in AD. Obviously I'm simplifying things as there are prereqs to just turning off the exchange servers

Reply

[-]

ADynes@reddit (OP)

According to this article, which is directly for microsoft, you're not really decommissioning. You're simply making sure everything's migrated over and then turning it off. Then you use the exchange 2019 management tools to continue managing the attributes locally.

Reply

[-]

phunky_1@reddit

Yes, you need to use the on premises exchange server to manage attributes locally. This doesn't work if the VM is turned off or fully removed from the environment.

Reply

[-]

zm1868179@reddit

No you don't every single one of those attributes can be updated directly in active directory. We've been doing it a long time before they officially even told people how to do it. Microsoft released the tools. All you have to do is have the latest tools installed and you can manage it all through powershell without a single exchange server turned on or even existing anymore. Obviously don't actually uninstall the last server. You can shut it down, delete it whatever you want to do it. It doesn't have to exist anymore, just don't uninstall it.

Reply

[-]

phunky_1@reddit

It seems dumb to not keep it online and patched if you can't decommission it. I have always just used remote powershell to use exchange management shell against the server.

Reply

[-]

zm1868179@reddit

Honestly, truly, you don't even need the exchange powershell modules. You can do it all with just the standard active directory modules or even an active directory users and computers directly through the attribute editor As long as you know which attribute you're wanting to edit, which if you've moved all your mailboxes to exchange online literally about the only attributes you even really have to edit on-prem is those extension attributes and maybe the proxy address if you're adding aliases. Outside that you don't have to touch anything else. You don't have to do anything to even provision a mailbox. As long as the attributes you just license the user in m365 With a license that has exchange on it and exchange will create the mailbox and even write the correct attributes back to the on-prem ad account. Then in the future if you need to add aliases you just edit the proxy address and that's it. It's like the only one you have to touch unless you're going to hide them from the gal and then there's that other attribute you'd have to edit.

Reply

[-]

phunky_1@reddit

I don't trust junior admins or service desk to mess around in adsiedit. I would rather give them ECP or powershell to work with.

Reply

[-]

Forsaken-Discount154@reddit

Why would they need adsiedit to edit attributes such as aliases?

Reply

[-]

zm1868179@reddit

Honestly, truly, you don't even need the exchange powershell modules. You can do it all with just the standard active directory modules or even an active directory users and computers directly through the attribute editor As long as you know which attribute you're wanting to edit, which if you've moved all your mailboxes to exchange online literally about the only attributes you even really have to edit on-prem is those extension attributes and maybe the proxy address if you're adding aliases. Outside that you don't have to touch anything else. You don't have to do anything to even provision a mailbox. As long as the attributes you just license the user in m365 With a license that has exchange on it and exchange will create the mailbox and even write the correct attributes back to the on-prem ad account. Then in the future if you need to add aliases you just edit the proxy address and that's it. It's like the only one you have to touch unless you're going to hide them from the gal and then there's that other attribute you'd have to edit.

Reply

[-]

bob_cramit@reddit

Yep, that’s exactly it. Was kinda skeptical myself, but have basically the exact same setup as you and once the exchange server wasn’t hosting mailboxes or relaying smtp, I simply shut it down. It seems like a strange concept, but yeah just shut it down.

Reply

[-]

team_jj@reddit

You don't need Exchange to do that. You can edit the attributes in AD. You just need to extend the AD Schema to edit Exchange attributes. [https://learn.microsoft.com/en-us/exchange/plan-and-deploy/prepare-ad-and-domains?view=exchserver-2019#step-1-extend-the-active-directory-schema](https://learn.microsoft.com/en-us/exchange/plan-and-deploy/prepare-ad-and-domains?view=exchserver-2019#step-1-extend-the-active-directory-schema)

Reply

[-]

wrootlt@reddit

I wonder which ones. If they are AD attributes that came with Exchange schema, they should be available in ADUC in Attributes editor.

Reply

[-]

dmoisan@reddit

We did that at my workplace forever ago (several years ago). The only wrinkle is that we had a number of email senders for alerts and reports and we had to consume an M365 license so we could send mail without Exchange.

Reply

[-]

touchytypist@reddit

Why not just setup an SMTP relay server?

Reply

[-]

dmoisan@reddit

I couldn't remember the MTA to save my life when I posted this, but I used Postfix in the end. As you imply, it was easier than anything else I could have considered. I haven't given it a thought since then as all my alerts and reports are coming through.

Reply

[-]

touchytypist@reddit

OK that makes sense. Much better than burning M365 licenses for such a basic function.

Reply

[-]

ADynes@reddit (OP)

I have relaying directly through exchange online which shouldn't require a license: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365 See OP for setup link.

Reply

[-]

overworked-sysadmin@reddit

We're hybrid with AD connect too. I shut ours down about a year back, have had zero issues. I can still manage exchange bits through powershell / AD Attribute editor. DO not "uninstall" exchange, just turn it off

Reply

[-]

andrea_ci@reddit

Yes. only downside? I have to edit a few attributes in AD/powershell and not in the local Exchange UI.

Reply

[-]

jlipschitz@reddit

We removed our exchange servers and use mailgun for our SMTP relays. It supports DKIM.

Reply

[-]

Infinite-Stress2508@reddit

I removed ours shortly after migrating to 365 exchange, back in 2018. Saved having to migrate exchange server to new hardware/ server os. 450 users, still running hybrid with sync, managing almost all policies through intune except relating to onprem database and rds farm.

Reply

[-]

ADynes@reddit (OP)

Thanks. A lot of people replying but our entry joined. Good to hear it's working fine on hybrid joint. Although I have no idea how you got most of your policies moved into intune, I had one GPO (out of 11) with 130 entries and when I brought it into the import wizard it said intune with support 16% of it. That's the day I kind of gave up and moved some policies to InTune (bitlocker, windows updates, onedrive, edge, etc) and left the rest in AD (file and folder manipulation, registry changes, etc.).

Reply

[-]

Infinite-Stress2508@reddit

Yeah I didn't use the wizard, it was all manual, took me several months to get it sorted. I used it as a body of work to go through each GPO and determine if it was required or not, which pruned quite a few. Good luck!

Reply

[-]

ADynes@reddit (OP)

Same as you we've gone through and cleaned up a lot of old junk. But I think the main problem is we do a lot of file and folder manipulation, like some custom executables that are written in house and when there's an update we're just deleting the old one and replacing the new one (slightly different file name) and then updating a shortcut to the new name. All that will take manual Powershell scripts and stuff and it's just not worth it when GPO does it so easily. Same with printers and network drives. Someday hopefully it will be better.

Reply

[-]

Forsaken-Discount154@reddit

This, i did the same. i took it as opportunity to clean a lot of stuff up and start withe clean slate.

Reply

[-]

He_do_be@reddit

I’m in the process of doing this as we speak.

Reply

[-]

shanxtification@reddit

I've used this article on a couple of clients and never had an issue, but it requires upgrading to Exchange 2019 and performing a schema update as well: [http://www.mistercloudtech.com/2022/04/21/microsoft-released-ability-to-remove-last-exchange-server-from-hybrid-environments/](http://www.mistercloudtech.com/2022/04/21/microsoft-released-ability-to-remove-last-exchange-server-from-hybrid-environments/)

Reply

[-]

basec0m@reddit

Do you actually have to build a new 2019 exchange server or the article seems to say, just installing the management tools upgrades the org to 2019 and extends the schema?

Reply

[-]

corbei@reddit

Turned ours off about 3-4 years ago, we had a ramsomware attack I just never turned it back on. Only issues we have our it's a little trickier to manage some of the attributes in ad. Next step is to remove our actual dcs

Reply

[-]

wrootlt@reddit

Well, we did that 7 years ago on my last job :) And it worked fine. I actually read that it is not recommended years later. But our consultant at that time said sure, you don't need local Exchange anymore, just decommission it and use ADUC to create new user and create email address and then assign license in EO and mailbox is ready. So, we nuked Exchange server and did that. And also did SMTP relay via connector in EO same way (stood up Windows Server with IIS + SMTP that would take emails from MFPs and a few older systems and relay through EO). I knew later it is not recommended/supported setup. But keeping a full blown Exchange server just to have old web GUI to create mailboxes? Seemed inefficient. Maybe we were lucky, but not once did MS support asked about our hybrid setup when i had cases opened (for EO issues as well).

Reply

[-]

min5745@reddit

Just did this last week. Zero issues.

Reply

[-]

Zealousideal-Pop1548@reddit

Our 2013 physical box fatally gave up when we were doing final checks on what was still running through it. Apart from having to change the smtp relay in one system, things just carried on working fine. We now use https://www.easy365manager.com to manage mailbox creation, etc for 365, via on-prem AD

Reply

[-]

onboarderror@reddit

Shutdown the last exchange server (2019) and left the schema stuff in place. Its not hurting anything to just sit there forever.

Reply

[-]

Rehendril@reddit

As others have said you can do this and I have done it at my org. Worked great! Microsoft has an article on exactly how to do this.

Reply

[-]

ddaw735@reddit

I got rid of my exchange servers, the exchange schema does enough and with a bit of power shell you’re able to manage everything

Reply

[-]

Dhaism@reddit

I would plan on upgrading to 2019 and make sure to install the latest 2019 exchange management tools before decom. I've done this a handful of times over the years following microsoft's documentation. https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

Reply

Reply to Post

71 Comments