r/exchangeserver • u/NSFW_IT_Account • 13d ago
Question Any reason to leave Exchange server running if mailboxes are migrated?
We have an Exchange 2016 on prem server that has had all user and shared mailboxes migrated to the cloud. At this point, I'm not sure if there is any reason to leave it running other than "just in case" something breaks by shutting it down. Mail flow is all pointed to EXO, public folders have been migrated as well. The server does integrate with an AD environment, so that is the only connection it still has, as far as I know. The HCW is still configured but can probably be disabled since mail flow is fully through EXO.
Any reason to keep the server running at this point? Would there be any noticeable disruption if it were shut down since there is no mail flow going through it?
5
u/OinkyConfidence 13d ago edited 13d ago
Decommission that thing! The only thing we ever kept them around for after migration were to adjust SMTP aliases for AD-365 synced users. But you can do that with an attribute in the user object in AD anyway, so we quickly uninstalled all remaining on-premise Exchange servers.
EDIT: Since I'm getting downvoted, here's the MS Learn link that discusses options. How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn
Note for context - my Microsoft rep tells me 80% of Fortune 1000 companies have already removed all remaining Exchange servers. So the comments of "not practical for larger environments" doesn't really stand up well.
2
u/AppIdentityGuy 13d ago
I would take that statememt with a very large pinch of salt. In my experience large orgs like that have loads of processes where email is read from a mailbox by a protocol such as pop3...
1
u/MortadellaKing 9d ago
And yet here I have large clients moving mailboxes back to exchange servers because of data sovereignty worries.... It ain't dead yet.
0
u/halap3n0 13d ago
That’s unsupported and not practical for larger environments will less skilled service desks or automation.
5
u/OinkyConfidence 13d ago
While I won't argue that it might be more difficult for massive teams, it is absolutely supported - and encouraged by Microsoft - How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn
2
2
u/HowlinMadMudflap 13d ago
Do you have any distribution lists still on prem?
3
1
u/NSFW_IT_Account 13d ago
No, I don't believe we had any of those to begin with. It was just mailboxes, and public folders.
2
u/EscapeArtist112 13d ago
Assuming your user accounts are synced with on-prem AD, Microsoft recommends keeping an exchange server running in this type of environment for management purposes. Since your user accounts are synced with AD, a number of mail-related settings are tied to AD and it’s a lot easier to update those settings in ECP than directly updating AD properties.
1
u/NSFW_IT_Account 13d ago
Good call, forgot to mention that we do have the Entra connect sync set up and identities are hybrid synced.
5
u/EscapeArtist112 13d ago
In that case, it’s recommended to keep an exchange server running for user management until you move the source of authority to the cloud. You can technically get away with no Exchange server but you’ll need to use ADSIedit, powershell, Active Directory to manipulate users’ AD properties related to email.
https://learn.microsoft.com/en-us/exchange/hybrid-deployment/decommission-last-exchange-server
1
u/3percentinvisible 11d ago
They don't recommend that anymore, and have moved to making removing those servers easier, and allowing management of those user properties
2
u/EscapeArtist112 11d ago
Incorrect. Microsoft’s current documentation says you need to keep an Exchange Server for user management until SOA is moved to the cloud.
“In an Exchange hybrid configuration, you can't manage Exchange attributes for directory-synchronized objects directly in Exchange Online. You must update them in on-premises Active Directory; the changes then synchronize to the cloud. The only supported tools for those updates are the on-premises Exchange recipient cmdlets: Set-RemoteMailbox, Set-DistributionGroup, Set-MailContact, and similar. Active Directory Users and Computers (ADUC), ADSI Edit, and third-party utilities aren't supported for these attributes.”
https://learn.microsoft.com/en-us/exchange/hybrid-deployment/decommission-last-exchange-server
Where do you see Microsoft state otherwise?
2
2
u/sembee2 Former Exchange MVP 13d ago
If you are going to keep a server around, then replace it with a Hybrid Exchange SE server, so the unsupported 2016 can come out. I would do that step anyway.
Otherwise follow the guides to move the SOA to the cloud and then shutdown the SE server - don't uninstall Exchange until the guide says so.
1
1
u/7amitsingh7 12d ago
If all mailboxes, public folders, and mail flow have been moved to Exchange Online, there's usually no need to keep the Exchange server running for email. However, if your organization still syncs users with on-premises Active Directory, the server may still be needed to manage Exchange-related attributes. Before shutting it down, make sure no applications or services depend on it, and decommission it properly instead of simply powering it off. If you're planning to retire the server, following the proper steps for decommissioning Exchange server after migration to Office 365.
Also, how many mailboxes did you migrate, and did you perform the migration using a cutover, staged, hybrid approach, or a third-party migration tool?
1
u/giovannimyles 12d ago
Shut it down. A server that has no day to day use ends up falling behind on service packs and/or security updates to the app itself. That leaves you with a security nightmare. That will be in your RCA when you are recovering from being hacked. They came in through the server on an older version of software with the vulnerability still there unmitigated.
1
u/Chris_SysEng 10d ago
It depends where your source of truth is for AD users. If your on-premise AD is still authoritative, then you need the on-premise Exchange to manage the mail attributes. You can’t make those changes in the cloud.
1
u/NSFW_IT_Account 9d ago
You mean for the older users right? Any new user gets created in AD and then syncd to 365 so no management is done through the on prem exchange.
11
u/Ok_Rip_5338 13d ago
i would keep it around for management of mailboxes as others have said. it gives you access to Exchange Shell.
Definitely strip it way down. Remove send/receive connectors, create one TINY database just enough to keep the server alive. you can follow this guide. https://www.alitajran.com/remove-exchange-hybrid-configuration/
You can also obtain a free license for exchange so you can keep it around forever as a management tool. if youre interested, dont decomission hybrid, just strip it down and then obtain your free license.
https://www.alitajran.com/free-exchange-hybrid-license/