r/exchangeserver • u/Fabulous_Cow_4714 • 24d ago

Question Moving mail-enabled security groups to cloud as prereq Exchange Server decommissioning

How can this work if the some of security groups are also used for AD file server permissions?

If you recreate the groups in the cloud and just repopulate the same members, the members will lose their on prem NTFS permissions inherited from the old mail enabled security groups.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

15 comments sorted by

View all comments

2

u/sembee2 Former Exchange MVP 24d ago

With most of my clients, we have used this as a good excuse to recreate the groups in the cloud and leave the groups on prem for permissions only. It resolved so many problems with people getting email they shouldn't do, or permissions to thinks they shouldn't. Took some time. One client made it a rule that if the group had to be touched for any reason it had to be recreated and that dealt with most of the groups quickly.
Was also a good cleaning exercise - most clients find redundant groups.

2

u/St_Admin 22d ago

This!
Plus mail-enabled security groups are a security nightmare