If you migrated all your mailboxes to Office 365, you’re most likely eager to remove your last Exchange Server from your hybrid environment.
The benefits of removing the last Exchange Server are plenty:
- Get rid of (or repurpose) hardware or VM resources.
- Get rid of a Windows operating system instance.
- Save time used to patch, monitor, backup, and troubleshoot your last Exchange Server.
- Potentially get rid of third-party licenses for AV, monitoring, and backup.
- Eliminate the risk of state-sponsored zero-day exploits that specifically target Exchange on-premises.
So, how can you do it?
Three options to Remove Your Last Exchange Server
Your main challenge is deciding how you will manage mailboxes and distribution groups after removing your on-premises Exchange Server.
Basically, you have three options to manage recipients after removing the last on-premises Exchange Server:
- Use a third-party tool to manage mail attributes and mailboxes.
- Use raw attribute editing (ADSIEdit style).
- Use the Exchange 2019 PowerShell management module.
Let’s consider the pros and cons.
Solution 1: Easy365Manager
Easy365Manager is a third-party snap-in for AD Users & Computers that consolidates AD and Office 365 administration.
With Easy365Manager, you get two new tabs in user properties in AD:
Besides allowing for the removal of the last Exchange Server, the significant benefit is the ability to work with a single, well-known, and intuitive interface to perform all daily AD and Office 365 management.
With Easy365Manager, your first-level supporters can easily perform any task – even calendar delegation, which otherwise requires semi-complex PowerShell scripting:
Organizations of all sizes have used Easy365Manager to remove their last Exchange Server. Visit Easy365Manager for reference clients and more information.
Pros:
- Eliminates the need to log in to multiple diverse consoles to manage hybrid users and mailboxes.
- Eliminates the need for complex PowerShell scripting.
- Empowers first-level supporters to do more with less training.
- Simple installation and configuration.
Cons:
- It involves a yearly per-tenant fee.
- Microsoft does not support configuration changes made by third-party tools, so you must rely on the support of the vendor in case of issues.
Solution 2: Raw Attribute Editing
The second option to manage emails and mailboxes after removing your last Exchange Server is directly editing AD properties.
You can do this using ADSIEdit or the attribute editor in AD Users & Computers.
The interfaces of ADSIEdit and the AD Users & Computers attribute editor are minimal and raw. Also, they don’t include any sanity checks of your modifications:
You can use this approach only if you’re well-versed in AD attribute management and know everything about attribute authority in hybrid Office 365.
Although this solution may be technically feasible, companies should seriously consider who will manage their environment when their “super admin” decides to leave for another job.
Pros:
- No direct cost to use ADSIEdit/AD Users & Computers
Cons:
- Very unfriendly interface.
- Easy to make mistakes.
- Hard to troubleshoot.
- Microsoft does not support email configuration changes made using ADSIEdit or ADUC, so you’re on your own in case of issues.
- Potentially a lot of indirect costs when problems occur or when introducing new hires.
Solution 3: Exchange 2019 Management Tools
In April 2022, Microsoft finally introduced a supported method to allow for the removal of the last on-premises Exchange Server.
With Exchange 2019 CU12, you can now use the Exchange management tools to manage your hybrid Office 365 environment without running an Exchange Server.
However, no GUI is included in this solution, so you must do everything from PowerShell.
PowerShell is an excellent tool for automating tasks. But for day-to-day operations and support, PowerShell is not ideal, especially not to first-level support teams.
To use the Exchange 2019 management tools, you must first upgrade your existing Exchange organization to Exchange 2019. This involves a schema update which is performed as part of the installation.
There is no direct upgrade path from Exchange 2007 and 2010, so you need to do a two-step upgrade if using those versions.
After starting the installation, you select only the management tools:
Depending on your system configuration you may need to install the Visual C++ Redistributable for Visual Studio 2012 Update 4.
Additionally, you need the IIS 6 Metabase Compatibility component. You can install this using the following command:
PS C:\Exchange> dism /online /Enable-Feature /FeatureName:IIS-IIS6ManagementCompatibility /all Deployment Image Servicing and Management tool Version: 10.0.20348.681 Image Version: 10.0.20348.1487 Enabling feature(s) [==========================100.0%==========================] The operation completed successfully.
With all of these prerequisites out of the way, you should be able to complete the installation:
You can verify the schema update succeeded by running a schema version check (the Exchange schema version should now be 17003).
With that taken care of – this will be the future of your Exchange recipient management:
PS C:\> Add-PSSnapin Microsoft.Exchange.Management.PowerShell.RecipientManagement PS C:\> Get-Command -PSSnapin Microsoft.Exchange.Management.PowerShell.RecipientManagement CommandType Name Version Source ----------- ---- ------- ------ Cmdlet Add-DistributionGroupMember 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Disable-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Disable-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Disable-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Disable-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Enable-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Enable-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Enable-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Enable-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-AcceptedDomain 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-Contact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-DistributionGroupMember 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-EmailAddressPolicy 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Get-User 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Import-RecipientDataProperty 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-AcceptedDomain 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-EmailAddressPolicy 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet New-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-AcceptedDomain 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-DistributionGroupMember 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-EmailAddressPolicy 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Remove-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-AcceptedDomain 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-Contact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-DistributionGroup 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-EmailAddressPolicy 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-MailContact 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-MailUser 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-RemoteMailbox 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Set-User 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Update-DistributionGroupMember 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement Cmdlet Update-EmailAddressPolicy 15.0.0.0 Microsoft.Exchange.Management.PowerShell.RecipientManagement
It is not a solution that will fit any shoe…
Pros:
- No direct cost to use Exchange 2019 management tools.
- Microsoft fully supports changes made with the Exchange 2019 management tools.
Cons:
- Requires extensive PowerShell knowledge from all supporters.
- Fragmented management as you still need to use Exchange Online PowerShell and Exchange Admin Center in addition to the Exchange 2019 management tools.
- Potentially a lot of indirect costs due to the complexity of using PowerShell for daily management and operations.
- It may take considerable time and effort to upgrade to Exchange 2019 if you’re on Exchange 2007 or 2010.
How to Remove the Last Exchange Server
No matter which of the above three options you pursue, the steps to remove the last Exchange Server are the same.
In general, you should never uninstall the last Exchange server or otherwise clean up your AD Exchange configuration from the domain configuration partition.
There is no benefit in removing the Exchange configuration from AD, but there are a lot of risks. So, leave it.
The first thing to do is thoroughly review that no more mailboxes, public folders, or mail flow are present on the server.
The last Exchange server should be completely eliminated from your mail flow – both inbound and outbound.
Once that is confirmed, you can simply turn off the server. And hold your breath.
Use the next couple of weeks to verify that no issues are reported and that you feel comfortable using the management tool you selected.
Remember to consider more than just your own situation: How are first-level supporters coping with the new setup? How will the company be doing if you decide to leave?
When you feel confident you’re in a good place, you can move on and remove your last Exchange Server from the Exchange Online configuration in Office 365.
Look at this article for details on how to check prerequisites and remove the last Exchange Server configuration from Exchange Online.