Prior to Microsoft’s update to the Exchange management tools in Exchange Server 2019, it’s likely that you were locked into an Exchange hybrid deployment for recipient management. Fortunately, it’s now possible to eliminate that last on-premise Exchange server. This means you can now get rid of that last piece of infrastructure that potentially exposes you to security risks and potentially reduce the number of machines that require regular patching.
Fortunately, going entirely cloud after migrating to Microsoft 365 and particularly Exchange Online can be a fairly straight-forward process, with some guidance. Herein, we highlight the steps to follow towards this goal and the warnings to keep in mind for successful decommissioning.
Before diving into steps to follow to remove the last Exchange server, it is prudent to mention what’s required to completely offload said on-premise server.
Requirements to Remove Hybrid Exchange
Right out of the gate, note that your organization is mandated to meet the requirements of the Exchange Server 2019 management tools. Further, you are required to meet the following:
- Your entire mailboxes and public folders are in Exchange Online
- No mandated auditing or logging of actions pertaining to recipient management
- Your organization must be using Active Directory for recipient management and Azure AD Connect for AD objects synchronization
- No role-based access controls should be in use
Once you have these requirements in place, the admin can now embark on executing the Exchange setup in Exchange Server 2019 CU12 or latter. Here, they will be seeking to access the updated Exchange management tools already present on the domain-joined machine.
Note that said updated Exchange management tools require the Windows PowerShell to leverage the following management cmdlets:
- Set-MailUser, Get-MailUser, New-MailUser, Remove-MailUser, Enable-MailUser and Disable-MailUser
- Set-RemoteMailbox, Get-RemoteMailbox, Enable-RemoteMailbox, Disable-RemoteMailbox, Remove-RemoteMailvox
- Get-DistributionGroupMember, Remove-DistributionGroupMember, Update-DistributionGroupMember, Add-DistributionGroupMember
- Set-MailContact, Disable-MailContact, Enable-MailContact, Get-MailContact, New-MailContact
- Set-User and Get-User
- Set-EmailAddressPolicy, Remove-EmailAddressPolicy, Update-EmailAddressPolicy, New- EmailAddressPolicy
Keep in mind that these PowerShell commands can only be accessed by administrators or a security group named Recipient Management EMT. The later is created by the Exchange management tools.
Before jumping into the removal, you have to plan for the decommissioning. Part of said planning will be a discovery where the IT team will be confirming if there are any mailboxes or archives that still need to migrate or be used. Further, the team will be checking whether there are any other services that still use Exchange server as a mail relay.
In the event that either of these scenarios apply, then these need to be routed to the SMTP traffic or Exchange Online directly. There’s also the option of routing these to another server which then needs to be deployed.
Steps to Removing Hybrid Exchange
Here is a step-by-step guide to removing hybrid Exchange servers.
- Ensure that all of your mailboxes have already been migrated t the Microsoft cloud. You can achieve this by running the following PowerShell command:
Set-AdServerSettings -ViewEntireForest $true Get-Mailbox
- Verify that the Exchange Online tenant coexistence domain is set at the target delivry domain. For this you’ll run the following command:
Get-RemoteDomain Hybrid* | Format-List DomainName,TargetDeliveryDomain
- Install the Exchange management tools found within the Exchange Server 2019 April CU Update.
- Install the Remote Server Administration Tools
- Copy the script tagged ScriptingAgentConfig.ml from CmdletExtensionAgents folder found in the Exchange Server to the install folder of the new Exchange management tools.
- Run the command below:
Add-PSSnapin *RecipientManagement
- Run a test using the PowerShell commands listed above. As the last step, this should help you check on the status of the decommissioning. If there are no issues, then you can successfully shut off the last remaining Exchange server.
Having successfully removed the last hybrid Exchange, the next step is to remove any references to the hybrid configuration.
Removing References to the Exchange Hybrid Configuration
To remove any references to the Exchange hybrid configuration, you are going to leverage Exchange Management Shell.
To achieve said removal, you’ll need to run the following commands to remove any federation trust and certificate.
_Remove-FederationTrust "Microsoft Federation Gateway"_
_$fedThumbprint = (Get-ExchangeCertificate | ?_
_{$_.Subject -eq "CN=Federation"}).Thumbprint_
_Remove-ExchangeCertificate -Thumbprint_
_$fedThumbprint_This code should successfully clean up references to the Exchange hybrid configuration. The next step is to revoke any service principal credentials leveraged by OAuth.
To achieve this, you’ll need to run the code below to obtain the OAuth credValue:
_$thumbprint = (Get-AuthConfig).CurrentCertificateThumbprint_
_$oAuthCert = (dir Cert:\LocalMachine\My) | where {$_.Thumbprint -match $thumbprint}_
_$certType = [System.Security.Cryptography.X509Certificates.X509ContentType]::Cert_
_$certBytes = $oAuthCert.Export($certType)_
_$credValue = [System.Convert]::ToBase64String($certBytes)_Once you obtain the OAuth credValue, run the following code script to get KeyID. Keep in mind that the following code uses the Azure Active Directory Module for Windows PowerShell to find a mirror value for the OAuth credValue.
_Install-Module -Name MSOnline_
_Connect-MsolService_
_$ServiceName = "00000002-0000-0ff1-ce00-000000000000"_
_$p = Get-MsolServicePrincipal -ServicePrincipalName_ _$ServiceName_
_$keyId = (Get-MsolServicePrincipalCredential –_
_AppPrincipalId_
_$p.AppPrincipalId -ReturnKeyValues $true | ?_
_{$_.Value -eq $credValue}).KeyId_The next step is to remove the service principal credential. For this, you’ll run the following code.
_Remove-MsolServicePrincipalCredential -KeyIds @($keyId) -AppPrincipalId $p.AppPrincipalId_Suppose your organization uses a modern hybrid configuration. In this case, you’ll need to remove the hybrid agent by running several commands from the hardware where the agent’s found. It is best that you leverage the Exchange Management Shell to move to the C:Program FilesMicrosoft Hybrid Service folder. Once in the folder, you’ll run the following code to import hybrid agent PowerShell module:
_Import-Module .\HybridManagement.psm1_In there, you’ll need to find the Appld required to remove the hybrid agent. For that, you’ll run the following:
_Get-MigrationEndpoint "Hybrid Migration Endpoint - EWS (Default Web Site)" | Select-Object RemoteServer_The output from the above command is the GUID which should look something like the following:
_Get-MigrationEndpoint "Hybrid Migration Endpoint - EWS (Default Web Site)" | Select-Object RemoteServer_You should then proceed to use the value of the Appld that you got from the previous step to run the following command which will effectively remove the application.
_Remove-HybridApplication -appId <GUID> -_
_Credential (Get-Credential)_
