Decommission Exchange Server 2010 after M365 Migration

Scenario

Organization has moved all their mailboxes to the Exchange Online from On-Premise Exchange 2010 server. MX Record is cutover to Microsoft 365 (inbound and outbound mail flow is moved to Microsoft 365). Entra connect is being used to sync Active directory users to Entra ID.

Requirement

Decommission Exchange 2010 server from the environment while keeping the Active directory synchronization through Entra connect running.

Procedure

You may have used Hybrid Configuration Wizard (HCW) or third party tools like bittitan to migrate mailboxes to the cloud. Most of the steps from this post will still be applicable.

This blog post will be based on one Exchange 2010 server with all exchange roles on it without DAG and without HCW configuration. You can use this article as a guidance and create a plan for decommissioning exchange server as per your organization requirements.

Important Note:

Please note Microsoft recommends not to fully decommission the last Exchange Server specially when Azure AD Connect is in use to sync the users to the cloud. If you still go ahead with Exchange server decommissioning, then most of the mail attributes needs to be managed via on-premise using Active Directory Schema Editor Snap-in or Third Party Tools or Powershell which is something not supported by Microsoft. (“MS recommendation: Remove all Exchange servers with the exception of the servers you will retain for user management and creation. Two servers should be sufficient for user management, although you could possibly get by with one server. In addition, there is no need to have a Database Availability Group or any other high availability options.”)

1. Take Backup of mail Attributes from AD

Taking backup of important email attributes is not mandatory but its always a best practice to take the backup before the start of this activity. This backup can also be used later for verifying the email attributes to make sure that mail attributes are populated correctly as per requirement.

Backup mail, mailNickName and proxyaddresses

Get-ADUser -Filter * -Properties proxyaddresses, mailNickName, Mail | Where { ($_.Enabled -eq $True) -and ($_.proxyaddresses -ne $null) } | Select-Object Name, Mail, mailNickName, @{ L = "ProxyAddresses"; E = {($_.ProxyAddresses | Where-Object {$_ -like "*smtp:*" }) -join ';'} } | Export-Csv -Path "c:\temp\UsersMailAttributes.csv" –NoTypeInformation

Backup X400 Addresses

Get-ADUser -Filter * -Properties proxyaddresses | Where { ($_.Enabled -eq $True) -and ($_.proxyaddresses -ne $null) } | Select-Object Name, @{ L = "ProxyAddresses"; E = {($_.ProxyAddresses | Where-Object {$_ -like "X400*" }) -join ';'} } | Export-Csv -Path "c:\temp\X400.csv" –NoTypeInformation

Backup X500 Addresses

Get-ADUser -Filter * -Properties proxyaddresses | Where { ($_.Enabled -eq $True) -and ($_.proxyaddresses -ne $null) } | Select-Object Name, @{ L = "ProxyAddresses"; E = {($_.ProxyAddresses | Where-Object {$_ -like "X500*" }) -join ';'} } | Export-Csv -Path "c:\temp\X500.csv" –NoTypeInformation

Other Commands for Reference (optional)

• csvde -f c:\DLs.txt -r “(&(objectCategory=group)(proxyAddresses=*))”
• csvde -f c:\Users.txt -r “(&(objectCategory=user)(proxyAddresses=*))”

2. Disable Entra Connect Synchronization

Login to the server where Entra Connect is installed and disable the entra sync using below command.

Disable Entra Sync

Set-ADSyncScheduler -SyncCycleEnabled $false

3. Remove Service Connection Point (SCP)

Next, Remove the Service Connection Point (SCP) value on your Exchange Servers. SCP value is used for automatically configure outlook client. When you remove the Service connection point, the client will use the DNS method for autodiscover.

For Exchange 2010 Server:

Get-ClientAccessServer | fl AutoDiscoverServiceInternalUri

Get-ClientAccessServer | Set-ClientAccessServer -AutoDiscoverServiceInternalUri $Null

Exchange 2016 Server or later:

Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null

If you are unable to remove the Service Connection Point using Powershell. You can open ADSIEdit and delete the Service connection Point manually.

Open ADSIEdit > Configuration Partition > Services > Microsoft Exchange > CN = <Exchange Organization> > Administrative Groups > Servers > <Exchange Server Name> > Protocols > Autodiscover > Under this folder you will see serviceConnectionPoint. Delete this manually. However, I will prefer the Powershell command option as its easier and less complex than using ADSIEdit.

4. Delete offline Address Books (OAB’s)

Remove offline Address Books (OAB’s) using Powershell or manually using the Exchange management console (EMC). Please find both the methods below and use the one preferable to you.

Using Powershell

Get-OfflineAddressBook
Get-OfflineAddressBook | Remove-OfflineAddressBook
Get-OfflineAddressBook

Using GUI Method

Open Exchange Management Console > Organization Configuration > Mailbox > offline Address Book > Select all Offline Address Books > right click > Remove.

5. Migration of Public Folders

• Launch Powershell as administrator.
• Execute Get-OrganizationConfig |fl PublicFoldersEnabled and ensure that it is not set to remote.

If it is set to remote and you want to continue to access the public folders, you would need to migrate them to Exchange online. If you have already migrated Public folders to Exchange Online, Please proceed to the next section to delete public folders.

Delete Public Folders

Before deleting Public folders, Open Exchange Management Console > Toolbox > Open Public Folder Management Console and check the existence of Public Folders.

Use below command to delete all public folders.

Get-PublicFolder -Server ExchangeServerHostName “\” -Recurse -ResultSize:Unlimited | Remove-PublicFolder -Server ExchangeServerHostName -Recurse -ErrorAction:SilentlyContinue

Once all Public folders are deleted. Open the Public folder management console again to verify the deletion (as shown in below screenshot).

Delete Public Folder Database

Now, you can Delete the Public Folder Database from the Exchange Management console (However, if you receive an error message as shown below, please follow the given steps to fix the error).

Error:
The public folder database Public Folder Database contains folder replicas. Before deleting the public folder database, remove the folders or move the replicas to another public folder database. For detailed instructions about how to remove a public folder database, see http://go.microsoft.com/fwlink/?linkid=81409&clcid=0x409.

You can check the replicas using below command:

Get-PublicFolder -Recurse | ft name,parentpath,replicas

You will find folder replicas are still there for the Public folder database. To get around this issue, follow below steps:

• Dismount the Public folder database.

• Move Public folder database folder contents to a New directory (which includes database and log files, if your log file’s location is different than the database location, go to the log file folder and move its contents as well).

• Mount the Public folder database again and delete it.

I’ll guide you on how I resolved this error and offer some alternative methods to fix it. If you want to skip ahead to an alternative method (that I haven’t personally tested), please check the Alternate Fix for Replica Error section.

a) Dismount the Public Folder Database(s)

Dismount-Database -Identity PublicFolderDatabaseName

b) Note Public Folder database and log file paths Information

You can also check this information by right clicking the Public folder database and click properties > General Tab.

Get-PublicFolderDatabase | fl name, *Path*

c) Move the Contents of EdbFilepath and LogFolderPath folder to another new Folder.

I created a new folder movePFcontents in I:\ drive. You can create the folder in any drive provided you have enough free space to move the Public folder database and Log folder contents. You can also manually move the data using GUI tools, I have used move command to move the contents.

d) Mount the Public Folder Database

 Mount-Database -identity publicfolderdatabasename

e) Delete Public Folder database

You can now try to delete the Public folder database at this stage. However, If you receive below error message then please follow further guidance to fix the issue.

The public folder database ‘PublicFolderDatabaseName’ cannot be deleted.

Error:
Public folder database “PublicFolderDatabaseName” is the default public folder database for the following mailbox database(s):

Mailboxdatabasename

. Before deleting the public folder database, assign a new default public folder database to the mailbox database(s).

Error Message when trying to delete the public folder database

Solution

First we need to check the default public folder associated for each mailbox database. Run the command Get-MailboxDatabase | ft name, publicfolderdatabase. You can see that mailbox database(s) are having association with public folder database. We need to remove this association to fix this issue so that that mailbox database will not be able to use the public folder DB.

Get-MailboxDatabase | ft name, publicfolderdatabase

Deleting this association by using Set-Mailboxdatabase command didn’t work in my case, so I have used the ADSI Edit to delete the associations manually.

Open ADSI Editor > Configuration Partition > CN=Services > CN=Microsoft Exchange > CN=(<your organization name>) > CN=Administrative Groups > CN=Exchange Administrative Group (<group name>) > CN=Databases.

Right click on each mailbox database for which you noted the association with public folder databases and Click Properties > Attributes Editor. Search for msExchHomePublicMDB attribute and clear the value.

Repeat for all other Mailbox databases and then check the association of mailbox database with public folder again to make sure that you have removed all association(s). Use the same command which was used earlier.

Get-MailboxDatabase | ft name, publicfolderdatabase

Now, try to delete the Public folder databases. As you can see from below screenshot, Public folder database is now removed.

Get-PublicFolderDatabase | Remove-PublicFolderDatabase

Alternate Fix for Replica Error [Not Tested]

If you’ve got a pop-up displaying below error message, you can use the provided commands to resolve it. I haven’t personally tested these methods, so I can’t guarantee their effectiveness.

Error: The public folder database “Public Folder Database” contains folder replicas. Before deleting the public folder database, remove the folders or move the replicas to another public folder database. For detailed instructions about how to remove a public folder database, see http://go.microsoft.com/fwlink/?linkid=81409&clcid=0x409

Set-OrganizationConfig -PublicFolderMigrationComplete $True

Remove-PublicFolderDatabase "Public Folder Database" -RemoveLastAllowed

6. Disable and Delete Mailboxes

The next step is to disable all mailboxes. When you disable a user mailbox using either the Exchange Management Console or Exchange Management Shell, mail-related attributes are removed from the On-Premises Active Directory for that user.

To handle this, we need to convert the disabled user mailbox to a Mail User, as demonstrated in the next section. It’s important to ensure that Entra connect sync is stopped by running the Set-ADSyncScheduler -SyncCycleEnabled $false command.

If Entra sync is not paused and you disable a mailbox, it will remove the mail-related attributes from the On-Premises Active Directory user. Once the AD Sync runs, it will convert the users email addresses to onmicrosoft.com addresses in Microsoft 365.

Note

Below mail attributes are removed from user when you disable a user mailbox.

• EmailAddress
• legacyExchangeDN
• mailNickname
• mail  
• msExchHomeServerName
• textEncodedORAddress
• showInAddressBook
• proxyAddresses
• msExchUserAccountControl
• msExchVersion
• msExchMailboxSecurityDescriptor
• msExchRBACPolicyLink
• msExchPoliciesIncluded
• homeMDB
• homeMTA 
• mDBUseDefaults        

6.1 Disable Mailbox and Convert User Mailbox to Mail User

For One User

1. Launch Powershell on the Entra connect server.
2. Import-Module ADSync.
3. Set-ADSyncScheduler -SyncCycleEnabled $false.

Before disabling a user mailbox, please ensure you take a backup of the user’s email aliases. Converting a user to a mail user will not automatically restore the aliases; only the primary SMTP address is restored after the conversion.

To restore or add user aliases, follow these steps:

1. Go to Active Directory > User account properties.
2. Navigate to Attribute Editor.
3. Locate proxyAddresses.
4. Type the aliases in the format smtp:<user email alias> (e.g., smtp:[email protected]).
5. Use Uppercase SMTP: for the primary SMTP email address and lowercase smtp: for all user email aliases.

4. Open Exchange Management Console > Recipient configuration > Mailbox > Select User Mailbox > right click on it and select disable.

5. Alternatively, you can use Powershell (Exchange management shell), command. Disable-Mailbox -Identity <user’s unique Identifier e.g. Name, Alias etc>.

If you’ve disabled a user mailbox and don’t see it immediately appear in the Disconnected Mailbox folder in Exchange Management Console, you can force it to appear. Use the command Get-Mailboxdatabase | Clean-mailboxdatabase, then return to the EMC and refresh the Disconnected Mailbox Folder.

6.1.1 Convert User Mailbox to Mail User

Before converting a User mailbox to a mail user, it’s important to determine the externalEmailAddress value. You can provide this value explicitly or you can use userprincipalname or samAccountName as a reference to populate the value.

In below command, I’ve used userprincipalname because the primary SMTP address of Exchange users matches the userprincipalname in Active directory in our case.

Once you have identified the externalEmailAddress value, you can run below command against one user to convert disabled User to Mail User.

Important Note:

Please note that I am assuming users Entra ID UPN matches the Primary SMTP Address. If not, you can use a script to match UPN to the primary SMTP address (pSMTP). If you prefer not to match UPN to pSMTP, you can use the samAccountname parameter instead of userprincipalname or copy the externalmailaddress for each user in a CSV file and modify the command below according to your specific requirements.

$userlist = get-user -Identity "Username"
$userlist | foreach {Enable-MailUser $_ -externalEmailAddress “$($_.userprincipalname)” }

If you want to use samAccountName instead of userprincipalname, use below commands:

$userlist = get-user -Identity "Username"
$userlist | foreach { Enable-MailUser $_ -externalEmailAddress “$($_.samaccountname)@DOMAIN.COM” }

Now the user has been converted to mail user, you can check in the on-premise active directory, Users email attributes will be restored. Below email attributes are restored to the on-premise user:

1. EmailAddress
2. InternetEncoding
3. legacyExchangeDN
4. mail
5. mailNickname
6. msExchPoliciesIncluded
7. msExchRecipientDisplayType
8. msExchRecipientTypeDetails
9. msExchVersion
10. proxyAddresses
11. showInAddressBook
12. targetAddress
13. textEncodedORAddress

6.1.2 Resume Entra Connect Sync

Set-ADSyncScheduler -SyncCycleEnabled $true

• Test email Flow for this mail user.
• Purge the disabled/disconnected user mailbox

• Check the mailboxes which are in disconnected state or in disabled state. Note Down the mailbox guid of the user which you want to purge from database.

Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

If you want to purge a specific disconnected or disabled mailbox, use the mailboxguid noted above and replace it in the command below. This command will capture the disconnected user matching the mailbox guid in the $mailboxes variable.

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {($_.DisconnectDate –notlike ‘’) -and ($_.Mailboxguid -eq '87b867e5-b0ol-4jj2-b0d9-13a3n78933e49')}} | select displayname, mailboxguid, database

Purge the mailbox which is captured/stored in $mailboxes variable.

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

Verify that the disconnected or disabled mailbox have been purged.

Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

For All Users

When you want to disable all users at once and convert it to mail users, you can follow below steps. Most of the process will be same as applied for one user. The only difference is that the commands will run against all mailboxes.

1. Pause Entra Connect Sync

• Launch Powershell on the Entra connect server.
• Import-Module ADSync.
• Set-ADSyncScheduler -SyncCycleEnabled $false.

Before disabling a user mailbox, make sure to back up the user’s email aliases. Converting a user to a mail user will not automatically restore the aliases; only the primary SMTP address is restored after the conversion.

To restore or add user aliases, follow these steps:

1. Go to Active Directory > User account properties.
2. Navigate to Attribute Editor.
3. Locate proxyAddresses.
4. Type the aliases in the format smtp:<user email alias> (e.g., smtp:[email protected]).
5. Use Uppercase SMTP: for the primary SMTP email address and lowercase smtp: for all user email aliases.

2. Disable All mailboxes

Get-Mailbox -Resultsize Unlimited | Disable-Mailbox

3. Once the Mailboxes are disabled, convert each disabled user to mail User using below commands.

$userlist = Get-user -Filter { RecipientType -eq “user” } 
$userlist | foreach {Enable-MailUser $_ -externalEmailAddress “$($_.userprincipalname)” }

If you want to use samAccountName instead of userprincipalname. Use below commands:

$userlist = Get-user -Filter { RecipientType -eq “user” }
$userlist | foreach { Enable-MailUser $_ -externalEmailAddress “$($_.samaccountname)@DOMAIN.COM” }

4. Resume Entra Connect sync.

Set-ADSyncScheduler -SyncCycleEnabled $true

5. Test email Flow for few random users to confirm the mail flow.

6. Now, Check all the disconnected/disabled mailboxes.

Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

7. Run below command to store all the disconnected mailboxes in a variable:

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

8. Purge all mailboxes.

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

9. Verify if all the mailboxes are now purged

Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

7. Disable Arbitration mailboxes

1. Get a list of Arbitration/system mailboxes.

Get-Mailbox -Arbitration

2. Disable the Arbitration Mailboxes using below command:

Get-mailbox -Arbitration | Disable-Mailbox -Arbitration -DisableLastArbitrationMailboxAllowed

3. Once arbitration mailboxes are disabled. Make sure you do not see any Arbitration Mailboxes when you run Get-Mailbox -Arbitration command:

Get-Mailbox -Arbitration

8. Delete SystemMailbox objects from Active Directory

Open Active Directory Users and Computers > Search for System Mailbox accounts and right click on them > Select Delete.

9. Remove Send and Receive Connectors

You can use Exchange Management Console (EMC) or Powershell to remove the send connectors. I have used Powershell command as shown below.

1. Remove Send Connector.

Get-SendConnector | Remove-SendConnector

2. Remove Receive Connector.

Get-ReceiveConnector | Remove-ReceiveConnector

10. Delete Mailbox Import Requests

Run below command to check if there are mailbox import requests in the queue.

Get-MailboxImportRequest

1. Remove MailboxImport Requests.

Get-MailboxImportRequest | Remove-MailboxImportRequest

2. Make sure all Mailbox Import Requests are deleted.

Get-MailboxImportRequest

11. Uninstall Microsoft Exchange 2010 from the server

Before starting this process, Please make sure Exchange Management Shell (EMS) window is closed, Else you will receive an error about Powershell has open files.

1. Go to Start > Run > type appwiz.cpl and press Enter.
2. Select Microsoft Exchange Server 2010 > Right click > Uninstall

12. Test Email Flow

• Check Inbound / outbound email flow.
• Check Entra sync health status.
• Login to M365 admin center to check the users accounts and make sure there are no issues/errors.

13. Uninstall Other Softwares from Exchange server

Uninstall other software(s) from exchange server like Anti-Virus, Backup Software, Veritas backup exec agent, or any other third party tools to cleanup the meta-data and release the licenses (if any).

14. Disjoin Exchange Sever from domain

Now, you can remove the server from domain. Please make sure to create local admin account on the server so that you can login on the server if required. Delete the meta-data of the Exchange Server(s) like computer account in AD etc.

15. Power down Exchange Server

You can Power down the exchange server and remove it from monitoring systems if it was added to monitoring systems.

16. Monitoring and Deletion of Exchange Server from the disk

You can monitor the server after power down and then if its a virtual server, delete it from disk if there are no issues reported.

17. Update Documentation

Update the documentation related to Exchange Server where applicable.

External Reference / Links:

• Exchange 2010 end of support roadmap.
• How and when to decommission your on-premises Exchange servers in a hybrid deployment | Microsoft Learn