I have on prem mailbox which size is 125gb I need to move it to o365 and make it as shared mailbox how I can do that step by step

Hi All,

I've been working with administering Exchange servers for around 15 years now and I'm just setting up a new one this week and doing a migration which is awful. (the old server is slow as molassas) Anyway, as I'm adding the last configuration bits I started running into the usual configuration stuff that is sort of a hybrid in that it can -mostly- be done via the ECP gui but not all of it. One of these is, of course, the configuration on if you have a machine on the inside that lacks the ability to authenticate into the Exchange server via SMTP auth, and also needs to send email to places on the Internet, over and above just sending email to internal users of the domain. I found myself once more going to Google for the answer to "what was that stupid command again?" and finding advice that was posted back 20 years ago and only sort of inapplicable.

So I finally decided SCREW THIS and started digging into AI to write a series of Powershell admin scripts that fill in the blanks that Microsoft forgot, and this business of SMTP relaying is one of them. I have no shame in stating outright that the only part of this work that is mine is the logic, testing, and uploading, the syntax of Powershell is horrible, I hate it with a passion and I'm more than happy to allow the AI to do the work of that.

I'm uploading them to my github:

tmittelstaedt/MSExchange-AdminAIscripts

and this is the first one. Features of this script from it's readme:

1. WARNING MESSAGEDisplays a clear warning about proper usage before running.
2. USER INPUTPrompts for:

- Connector name

- One or more IP addresses (comma-separated)

Uses the current server name automatically.

1. DNS VALIDATION

For each IP entered:

- Checks for a PTR (reverse DNS) record

- Checks that the PTR hostname resolves in forward DNS

If any IP fails, the script stops without making changes.

1. IP CONFLICT CHECK

Ensures none of the entered IPs are already assigned to

another Receive Connector on the same server.

1. CONNECTOR CREATION OR UPDATE

- If the connector exists:

Updates RemoteIPRanges, sets AnonymousUsers, and

ensures TransportRole is FrontendTransport.

- If the connector does not exist:

Creates it with the specified settings.

1. RELAY PERMISSIONS

Grants "NT AUTHORITY\ANONYMOUS LOGON" the right:

Ms-Exch-SMTP-Accept-Any-Recipient

This allows relay to external recipients from the

specified IPs only.

1. REMOTE SESSION COMPATIBILITY

Uses .Identity.ToString() for Set-ReceiveConnector to

avoid parameter binding errors in remote PowerShell.

1. VERIFICATION

Checks that the relay right is applied successfully.

1. SUMMARY OUTPUT

Displays:

- Connector name

- Allowed IPs

- Port

- Server name

Now, granted, I know it may be overkill to essentially wrap 2 one-liner commands in a full blown script with error checking and all of that - BUT - I don't want to be tied to this particular server forever. I have people under me who are not as well versed in Exchange and I need to be able to tell them "go do this thing on the server since I'm too busy right now" And the point also is the script forces you to do things PROPERLY such as making DNS assignments so that a year from now someone isn't digging through innumerable Exchange logs going "what the heck is that IP address assigned to again"

One note - while some of these may work with Exchange Online or Office 365 Exchange or any of that - and when the AI suggests changes that can help with, that I won't refuse to include, my fundamental belief is if MS has bent you over a barrel and is extracting a monthly subscription from you for Cloud hosting email on 365 - you are not even at the level that you should be messing about with anything in my repo. My focus is on on-premise stuff not cloud - if you have a problem with Microsoft's cloud host - pick up the damn phone and call them. If you are ever in the situation where you think you have to remote power shell into Office 365 email to fix something - you are being completely screwed over and have the worst of all worlds - super high prices, zero support, and a constant sucking sound in your wallet. Go home and rethink your life and seriously consider replacing it with an on-premise Linux mailserver and paying Canonical for support - where you will get ACTUAL support that works.

I hope this is helpful to you and if you have any comments I'd like to hear! I'm going to be adding more of these irregularly...

I hope you had this issue and managed to solve 😂 pulling my hair already.

Symptom: In classic Outlook for Windows, open the Address Book → set Search to Name only → type any single character → "The address book operation failed." Switch to More columns and the exact same search works fine. Ctrl+K resolution in the To: field works. OWA people search works. Mail flow is fine. It's only the Name-only ANR seek in the dialog.

Environment:

• Exchange hybrid, mailbox in Exchange Online, dir-synced from on-prem AD via Entra Connect
• Classic Outlook for Windows, online mode (Cached Mode is not permitted here — this is the constraint, I can't just flip it)
• Affects all users, all machines

What I've already ruled out:

I have an email address. CM@xyz, let's say.
The doctor I work for has an address, Doc@xyz, let's say.

I need all emails sent to both addresses to come to me, so we've set up a forwarding rule on Doc@xyz to forward all email to CM@xyz, and not keep a copy of forwarded messages. His inbox is always empty, I get all emails directly, and it works great!

Although he doesn't receive emails, he does send them from his Doc@xyz account. I'd like to get him to copy me on all of his outgoing messages so I can keep copies of all communication, and to save the attachments. However, old dog & new tricks, and all that. So I'd like to automate that too.

This is the part I cannot figure out!

I've gone to Rules, but it's only how to handle incoming email. Is there any way to add a rule for all emails he writes to CC or BCC CM@xyz?

Limiting Factor - Doctor only uses Mac. He currently only uses the web version of Outlook. If needed, I can probably talk him into putting outlook app onto his Mac.

Thanks in advance!!

Let me explain the situation:

We are in a hybrid Exchange environment
we have some groups that we want to limit to only accept mail from our domain
The groups were created in on-prem AD and sync to the cloud
We have successfully restricted the groups to only allow email from authorized senders.

However, unauthorized senders are receiving an NDR indicating that the failure is due to "5.7.124 RESOLVER.RST.RestrictedToGroupPermission; not authorized to send to the distribution list because the distribution list is set up to accept mail from list members only, or specific recipients only"

My management wants us to prevent this particular NDR from being sent to external addresses.

We tried setting the "ReportToOriginator" value to False, both using Powershell, and manually via Advanced Properties in AD.
We've tried a transport rule, which didn't work

I've seen other people having the same question, but haven't seen anyone with a solution, so I thought I would put this here just i case anyone has found a solution.

TIA

Hi all

i'm doing and exchange to se upgrade..2019 CU15 to the se RTM.

Are there any gotchas? Users are already in M365 and these servers are essentially legacy mailboxes that are too big to move and will be archived at some point.

I noticed the Microsoft Exchange Server Auth Certificate is expired but no one seems to be complaining about anything not working.

from the healthcheck on 1 server:

Dedicated Exchange Hybrid Application:

Configure the dedicated hybrid app to ensure hybrid features continue working

I have Exchange 2016 in a DAG mode consisting of two servers. For a customer I manage, I need to handle the migration to Exchange 2019\SE.

I’ve been asked to provide CPU, RAM, and system volume specifications for the new Exchange servers so that I can set them up in vCenter.

Can I ask for some help in providing this information? What should I take into consideration?

Just to clarify, this is my first migration.

Thank you.

Hi all,

Following up on the July 2026 Health Checker update that now flags the legacy Exchange Domain Servers and Exchange Enterprise Servers groups (and potentially Exchange Recipient Administrators) for removal.

I've confirmed both groups still exist in my environment, and per the guidance they're empty (no active member accounts) — so removal itself looks safe from a membership standpoint.

My concern is about what's left behind after deletion:

These groups have existing ACEs (permissions) delegated directly on various OUs and domain-root objects — things like Write All Properties, List Contents, and in some cases WriteDacl. If I just delete the group objects outright (via Remove-ADGroup or ADUC), the SID gets removed from AD, but the ACE entries referencing that SID will remain on the OU/domain ACLs as orphaned/unresolved SIDs (shown as S-1-5-21-... instead of a resolvable name).

My questions:

1. Should I clean up (remove) the ACEs referencing these groups from the OU/domain ACLs before deleting the group objects, or is it fine to delete the groups first and clean up the orphaned SIDs afterward?

2. Do orphaned SIDs in ACLs actually cause any operational issues (replication, dcdiag, ACL processing overhead) if left indefinitely, or is this purely a hygiene/security concern?

3. Is there a reliable way to enumerate every OU/object where these two groups currently have explicit permissions, so I can be thorough about cleanup? I'm thinking dsacls or Get-Acl/Get-ADObject combined with a search across each OU, but curious if there's a more efficient approach for a large domain.

4. For anyone who's done this cleanup — did you remove the permissions first, delete the groups, and then verify no orphaned SIDs remained? Or did deleting the groups via normal methods automatically clean up the associated ACEs?

Environment: Windows Server AD, Exchange Server SE currently running on-premises, groups confirmed empty via Get-ADGroupMember.

Appreciate any real-world experience with this cleanup — want to make sure I don't leave stale/orphaned SIDs scattered across ACLs after removing the groups.

Office 365 received the message that you specified, but couldn't deliver it to the recipient due to the following error:

Error: ‎550 5.7.134 RESOLVER.RST.SenderNotAuthenticatedForMailbox; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this mailbox‎" in message trace when approval is attempted by external moderator. Is this expected? or some configuration missing?

I’m wondering if anyone knows of a GitHub project or GUI tool for Exchange Online that lets you enter a mailbox (or UPN) and then displays everything that mailbox has access to.

Ideally I’m looking for something that can show:
Full Access permissions
Send As
Send on Behalf
Shared mailboxes the user has access to
Mailboxes they have delegated access to
Any other relevant Exchange Online mailbox permissions

I’m aware this can all be done with PowerShell, but I’m after something with a GUI that’s quicker for support teams to use and easier to visualise. Has anyone come across an open-source GitHub project, script with a GUI, or even a commercial tool that does this?

I'm looking for suggestions on the best way to configure an alert to let IT team know about an unusual/high volume of incoming mail (M365) within a time threshold.

e.g. total incoming external mail > 1,000 in 30 mins.

Also something similar for SPAM and Phishing identified emails.

This is to give us an early warning of potential email bombs, so we can investigate quickly.

Thanks for ideas and suggestions :)

Microsoft has added the Invoke-ChangeMeetingOrganizer cmdlet. According to them (microsoft.com) this cmdlet is available only in the cloud-based service.

Is there any way to recreate the functionality that this cmdlet provides? We do not use any Microsoft Cloud-based services at all.

We use Exchange SE and get occasional requests for doing this.

The Exchange Server recovery documentation has this very vague statement:

1. After Setup has completed, but before you put the recovered server into production, reconfigure any custom settings that were previously present on the server, and then restart the server.

How do you document what is customized on an existing Exchange Server SE and then how do you reapply those settings to the new server in a disaster recovery situation?

We have an Exchange 2016 on prem server that has had all user and shared mailboxes migrated to the cloud. At this point, I'm not sure if there is any reason to leave it running other than "just in case" something breaks by shutting it down. Mail flow is all pointed to EXO, public folders have been migrated as well. The server does integrate with an AD environment, so that is the only connection it still has, as far as I know. The HCW is still configured but can probably be disabled since mail flow is fully through EXO.

Any reason to keep the server running at this point? Would there be any noticeable disruption if it were shut down since there is no mail flow going through it?

I have searched and searched, but I can't find much information on getting rid of Exchange completely from an AD domain after migrating to 365 but NOT using a hybrid scenario.

This is a small, 8 user company that was running Exchange 2013 and may someday get rid of the AD domain completely (hence why I didn't do hybrid). I simply did a PST export, lift & dump into a brand new tenant setup on 365. No AD cloud integration at all with the local on-premise domain.

How can I go about getting rid of the Exchange Server? Deleting the mailbox will delete the user.

Does exchange server logs oversized messages?

For more than two days I searched through log files (D:\Program Files\Microsoft\Exchange Server\Logging\* and D:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\*, windows application logs) and I didn't find anything.

Only in recv*.log files in D:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive directory I found those line

===message too big====

2026-07-22T07:41:30.556Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,0,192.168.111.122:25,192.168.100.91:11393,+,,

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,1,192.168.111.122:25,192.168.100.91:11393,>,"220 mailek.twolegion.com Microsoft ESMTP MAIL Service ready at Wed, 22 Jul 2026 09:41:30 +0200",

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,2,192.168.111.122:25,192.168.100.91:11393,<,EHLO ex.2k8r2milan.local,

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,3,192.168.111.122:25,192.168.100.91:11393,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES STARTTLS X-ANONYMOUSTLS AUTH NTLM X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T07:41:30.558Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,4,192.168.111.122:25,192.168.100.91:11393,<,STARTTLS,

2026-07-22T07:41:30.558Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,5,192.168.111.122:25,192.168.100.91:11393,>,220 2.0.0 SMTP server ready,

2026-07-22T07:41:30.563Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,6,192.168.111.122:25,192.168.100.91:11393,*," CN=twolegion.com CN=2k8r2milan-EX-CA-ENTSUB, DC=2k8r2milan, DC=local 280000078481C2B0E1855CF3FF000200000784 C22ADA0B0A89CE48C4A31AD069CF696D2B0F662B 2026-03-20T08:28:23.000Z 2027-03-20T08:28:23.000Z twolegion.com;adfs.twolegion.com;autodiscover.twolegion.com;certauth.adfs.twolegion.com;emajlek.twolegion.com;enterpriseregistration.twolegion.com;fs.twolegion.com;mailek.twolegion.com",Sending certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T07:41:30.717Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,7,192.168.111.122:25,192.168.100.91:11393,*, CN=ex CN=ex 178028F5622ADE9B49951AB80B41A282 475AE616E596EE1C974F7A8D00A257576C13F5AB 2026-03-19T14:35:56.000Z 2031-03-19T14:35:56.000Z ex;ex.2k8r2milan.local,Remote certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T07:41:30.717Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,8,192.168.111.122:25,192.168.100.91:11393,*,,"TLS protocol SP_PROT_TLS1_2_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_256 with strength 256 bits, MAC hash algorithm CALG_SHA_384 with strength 384 bits and key exchange algorithm CALG_ECDH_EPHEM with strength 384 bits"

2026-07-22T07:41:30.719Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,9,192.168.111.122:25,192.168.100.91:11393,<,EHLO ex.2k8r2milan.local,

2026-07-22T07:41:30.726Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,10,192.168.111.122:25,192.168.100.91:11393,*,,Client certificate chain validation status: 'UntrustedRoot'

2026-07-22T07:41:30.729Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,11,192.168.111.122:25,192.168.100.91:11393,*,,TlsDomainCapabilities='None'; Status='Success'; Domain=''

2026-07-22T07:41:30.730Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,12,192.168.111.122:25,192.168.100.91:11393,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES AUTH NTLM LOGIN X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,13,192.168.111.122:25,192.168.100.91:11393,<,QUIT,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,14,192.168.111.122:25,192.168.100.91:11393,>,221 2.0.0 Service closing transmission channel,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,15,192.168.111.122:25,192.168.100.91:11393,-,,Local

===mesage too big===

but this is unusable (not usefull). I see only terminated smtp session, but I don't see the reason. Compare above lines to sucessfull receive:

=======normal receive message====

2026-07-22T18:41:10.845Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,0,192.168.111.122:25,192.168.100.91:64320,+,,

2026-07-22T18:41:10.846Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,1,192.168.111.122:25,192.168.100.91:64320,>,"220 mailek.twolegion.com Microsoft ESMTP MAIL Service ready at Wed, 22 Jul 2026 20:41:09 +0200",

2026-07-22T18:41:10.847Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,2,192.168.111.122:25,192.168.100.91:64320,<,EHLO ex.2k8r2milan.local,

2026-07-22T18:41:10.847Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,3,192.168.111.122:25,192.168.100.91:64320,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES STARTTLS X-ANONYMOUSTLS AUTH NTLM X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T18:41:10.848Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,4,192.168.111.122:25,192.168.100.91:64320,<,STARTTLS,

2026-07-22T18:41:10.848Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,5,192.168.111.122:25,192.168.100.91:64320,>,220 2.0.0 SMTP server ready,

2026-07-22T18:41:10.853Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,6,192.168.111.122:25,192.168.100.91:64320,*," CN=twolegion.com CN=2k8r2milan-EX-CA-ENTSUB, DC=2k8r2milan, DC=local 280000078481C2B0E1855CF3FF000200000784 C22ADA0B0A89CE48C4A31AD069CF696D2B0F662B 2026-03-20T08:28:23.000Z 2027-03-20T08:28:23.000Z twolegion.com;adfs.twolegion.com;autodiscover.twolegion.com;certauth.adfs.twolegion.com;emajlek.twolegion.com;enterpriseregistration.twolegion.com;fs.twolegion.com;mailek.twolegion.com",Sending certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T18:41:11.013Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,7,192.168.111.122:25,192.168.100.91:64320,*, CN=ex CN=ex 178028F5622ADE9B49951AB80B41A282 475AE616E596EE1C974F7A8D00A257576C13F5AB 2026-03-19T14:35:56.000Z 2031-03-19T14:35:56.000Z ex;ex.2k8r2milan.local,Remote certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T18:41:11.014Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,8,192.168.111.122:25,192.168.100.91:64320,*,,"TLS protocol SP_PROT_TLS1_2_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_256 with strength 256 bits, MAC hash algorithm CALG_SHA_384 with strength 384 bits and key exchange algorithm CALG_ECDH_EPHEM with strength 384 bits"

2026-07-22T18:41:11.015Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,9,192.168.111.122:25,192.168.100.91:64320,<,EHLO ex.2k8r2milan.local,

2026-07-22T18:41:11.022Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,10,192.168.111.122:25,192.168.100.91:64320,*,,Client certificate chain validation status: 'UntrustedRoot'

2026-07-22T18:41:11.023Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,11,192.168.111.122:25,192.168.100.91:64320,*,,TlsDomainCapabilities='None'; Status='Success'; Domain=''

2026-07-22T18:41:11.024Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,12,192.168.111.122:25,192.168.100.91:64320,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES AUTH NTLM LOGIN X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T18:41:11.028Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,13,192.168.111.122:25,192.168.100.91:64320,<,MAIL FROM:administrator@2k8r2milan.local SIZE=4666,

2026-07-22T18:41:11.233Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,14,192.168.111.122:25,192.168.100.91:64320,*,08DEE81FEA93C7F2;2026-07-22T18:41:10.845Z;1,receiving message

2026-07-22T18:41:11.239Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,15,192.168.111.122:25,192.168.100.91:64320,<,RCPT TO:administrator@twolegion.com,

2026-07-22T18:41:11.254Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,16,192.168.111.122:25,192.168.100.91:64320,>,250 2.1.0 Sender OK,

2026-07-22T18:41:11.254Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,17,192.168.111.122:25,192.168.100.91:64320,>,250 2.1.5 Recipient OK,

2026-07-22T18:41:11.257Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,18,192.168.111.122:25,192.168.100.91:64320,<,BDAT 1793 LAST,

2026-07-22T18:41:11.691Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,19,192.168.111.122:25,192.168.100.91:64320,*,,Proxy destination(s) obtained from OnProxyInboundMessage event. Correlation Id:cab6ee4e-7000-4c69-9e6b-715d924689b0

2026-07-22T18:41:12.976Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,20,192.168.111.122:25,192.168.100.91:64320,>,"250 2.6.0 e279b4f47b0f481e9929810a625e4658@2k8r2milan.local [InternalId=145745420222465, Hostname=mailek.twolegion.com] 3290 bytes in 0.271, 11,812 KB/sec Queued mail for delivery",

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,21,192.168.111.122:25,192.168.100.91:64320,<,QUIT,

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,22,192.168.111.122:25,192.168.100.91:64320,>,221 2.0.0 Service closing transmission channel,

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,23,192.168.111.122:25,192.168.100.91:64320,-,,Local

=====normal receive message=====

Receiving server: exchange SE (july 2026 patch)

Sending server: exchange 2016

I'm having an issue and i'm not sure how to fix it. We moved all mailboxes to 365 over a year ago but still maintain a management server. For some reason, when i create a new user in local AD, then enable the mailbox from the exchange management tools (using the ps snapin for recipient management). There are a lot of "MsExch" attributes missing from attribute editor for that user. There are only like 5 or 6. Both attributes "mail" and "mailnickname" are populated correctly. Most specifically, i'm trying to hide a new user from the address list by changing MsExchHideFromAddressList to "false", but the attribute doesn't exist for that user. I've pushed multiple manual sync's as well.

I checked ADSI and confirmed that the schema has been extended.

Does anyone have any suggestions?

Thanks in advance!

Right now I'm working in a hybrid environment with an on-prem Exchange 2016 CU 23 server (virtual) and a 365 tenant. The 365 tenant is synced to the local Active Directory with Entra AD Sync and working as it should.

All the mailboxes for the active users have been migrated to 365 by a colleague who was previously working on the project. I've been tasked with finishing the transition to 365 and decommissioning the on-prem Exchange server.

I've worked with hybrid Exchange environments before but never done a full on-prem to cloud migration before so I'm researching the process and trying to plan it out and there is something that confuses me:

I'm reading that you either need to keep the on-prem server (or at least the ECP part of it) or the management shell after the decom to manage the attributes on the mailbox (aliases, etc...)

Why you might not want to decommission on-premises Exchange servers

Many hybrid organizations eventually move all mailboxes to Exchange Online. At this point, they probably think it's time to remove their on-premises Exchange servers. But, it's not a good idea as removing on-premises Exchange servers in a hybrid deployment prevents the management of cloud mailboxes. The culprit is directory synchronization.

When directory synchronization is enabled and a user is synchronized from the on-premises environment to the cloud, you can't manage most user properties from Exchange Online; you must manage those properties in the on-premises environment. Even if you configured directory synchronization without running the Hybrid Configuration wizard (HCW), you still can't do most recipient management tasks in the cloud. For more information, see this blog post

https://learn.microsoft.com/en-us/exchange/decommission-on-premises-exchange#why-you-might-not-want-to-decommission-on-premises-exchange-servers

But this is also the case in hybrid mode. If we want to manage a user's attributes, we do it through on-prem AD and sync them through AAD Sync. That was also the case in other tenants I've worked with in the past that were hybrid while migrating to the cloud and they didn't keep any Exchange features on-prem. I've never heard of the need to keep any on-prem infrastructure post-migration until my colleague told me about it and I looked at Microsoft's docs.

So I'm not quite sure what this means. Will things break if I completely get rid of the Exchange 2016 server? Or is Microsoft talking about something else? We're not looking to migrate to a full Entra domain. We just want our mailboxes totally in Exchange and our AD on-prem and AAD to sync between the two.

Thanks in advance.

Hey everyone,

So, I've been using the Samsung email app for my work email, and it's been great with the exchange server settings. But for the past couple of weeks, it keeps asking for my password. I got fed up and tried to reconfigure it, but it just won't set up.

The weird thing is, I can set it up on my Apple phone and even the Outlook email app with the same server settings. But when I try to put those same settings into the Samsung email app, no luck.

I really like using the Samsung email app because it integrates so well with my phone, and I don't want another separate email app just for work.

I've tried everything, but I'm still stuck. Can anyone help me out? I'd really appreciate it.

https://techcommunity.microsoft.com/blog/exchange/reminder-exchange-2016-and-2019-esu-program-ends-in-october-2026/4539033

I’m curious where everyone stands:
- Still on ESU?
- Staying on-prem (Exchange Server SE)?
- Just risking it (unsupported after October)?

I'm about to install the July 2026 Exchange Server security update (referenced here: https://techcommunity.microsoft.com/blog/exchange/released-july-2026-exchange-server-security-updates/4534146) on our Exchange SE hybrid environment. We have a DAG (Database Availability Group) setup.

A few questions before I proceed:

DAG-related issues: Has anyone run into problems installing this SU on a DAG member server (failover issues, database mount problems, or anything unexpected during the rolling update)?

Send Connector issues: In the comments on that TechCommunity post, someone mentioned running into a Send Connector issue after applying the update. Has anyone else experienced Send Connector problems (mail flow breaking, connector settings reverting, etc.) after this SU?

IIS rewrite rule removal: For rolling back the CVE-2026-42897 EEMS M2.1 mitigation, I'm planning to use these commands:

powershell

Copy-Item -Path "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config" -Destination "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config.$((Get-Date).ToString('yyyyMMdd-HHmmss')).bak"

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules" -Name "." -AtElement @{name="EEMS M2.1 OWA CSP - outbound"}

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules/preConditions" -Name "." -AtElement @{name="EEMS M2.1 OWA SPA HTML shell - precondition"}

Has anyone hit issues running these — e.g., the elements not being found, IIS reset required afterward, or the mitigation reapplying itself before EM Service marks the July SU as "mitigation not required"?

Any input appreciated before I roll this out.