Decommissioning the Last On-Prem Exchange Server Safely

The mailboxes moved months ago. The MX points at Microsoft. The server is still there, humming in the rack, because nobody is sure what will break when it goes. That is a reasonable fear. The last Exchange server does more than host mail, and removing it the wrong way leaves you unable to change an email address without editing raw Active Directory attributes.

This post walks through what the server still does, what has to be repointed first, and how to remove it with the management tools approach so recipient administration keeps working.

Why the last server is different

When Entra Connect syncs Active Directory to the cloud, the on-prem directory is the source of authority for synced users. Exchange attributes such as proxy addresses, mailbox type and forwarding are written on-prem and flow up. Exchange Online will not let you edit those attributes on a synced object. So you need a supported way to manage them on-prem, and until recently that meant keeping an Exchange server installed.

Beyond attribute management, the server usually still handles three jobs: SMTP relay for printers and applications, Autodiscover for any straggler devices, and the hybrid connectors that route mail between the two sides. Each has to be moved or retired before the server can go.

Get-Mailbox -ResultSize Unlimited | Where-Object { $_.RecipientTypeDetails -ne "DiscoveryMailbox" } | Measure-Object
Get-Mailbox -Arbitration | Format-Table Name, Database
Get-PublicFolder -Recurse -ResultSize Unlimited | Measure-Object
Get-MessageTrackingLog -Start (Get-Date).AddDays(-30) -EventId RECEIVE -ResultSize Unlimited | Where-Object { $_.Source -eq "SMTP" } | Group-Object ClientIp | Sort Count -Descending

Repointing everything else first

Start with the message tracking log query above. Every client IP still submitting mail is a device or application to repoint. Exchange Online offers three relay options: SMTP AUTH client submission on smtp.office365.com port 587 with a licensed mailbox, direct send to your MX host on port 25 for internal-only recipients, and a certificate or IP-based inbound connector for devices that must send anonymously to external recipients. For a fleet of old copiers that cannot do TLS 1.2 or authentication, a small internal relay such as the IIS SMTP service or a Linux Postfix box forwarding through a connector is the pragmatic answer.

Then confirm DNS. Autodiscover must point at Exchange Online, MX must have no reference to the on-prem host, and the SPF record should no longer include its IP. Check internal DNS as well, since the split-brain zone is often the last to be updated.

Finally, the hybrid pieces. Remove the organization relationship and the inbound and outbound connectors in Exchange Online that reference the on-prem server, and the send connector on-prem that points at Exchange Online. Leave the accepted domains alone.

Connect-ExchangeOnline
Get-InboundConnector | Format-Table Name, ConnectorType, SenderDomains, Enabled
Get-OutboundConnector | Format-Table Name, SmartHosts, RecipientDomains, Enabled
Get-OrganizationRelationship | Format-Table Name, DomainNames, Enabled

The management tools only option

Exchange 2019 CU12 and later, and Exchange SE, allow you to keep the Exchange management tools on a domain-joined workstation or server with no Exchange server role installed. Microsoft ships two scripts with the tools to make this work. Add-PermissionForEMT.ps1 grants the permissions the tools need to write Exchange attributes without a server, and CleanupActiveDirectoryEMT.ps1 removes the last server object from the configuration partition after the server is shut down.

The important detail is that you do not run the normal uninstall on the last server. You install the tools elsewhere, confirm you can manage recipients from that machine, shut the old server down, and then run the cleanup script. Uninstalling the server the classic way removes objects that the tools still need.

After cleanup, recipient management is done in PowerShell with the standard cmdlets, which now write to Active Directory directly. There is no Exchange admin center on-prem any more, so the team needs to be comfortable with Enable-RemoteMailbox, Set-RemoteMailbox and Set-MailUser.

Install the Exchange management tools on a member server that will stay.
From an elevated Exchange Management Shell on the tools machine, run Add-PermissionForEMT.ps1.
Test: create a remote mailbox for a test user and confirm it syncs and gets a mailbox in Exchange Online.
Shut down the old Exchange server. Do not uninstall it. Leave it off for at least a week.
Run CleanupActiveDirectoryEMT.ps1 to remove the server object.
Remove the computer account and the DNS records, and reclaim the certificate.

.\Add-PermissionForEMT.ps1
Enable-RemoteMailbox -Identity newuser -RemoteRoutingAddress newuser@contoso.mail.onmicrosoft.com
Set-RemoteMailbox -Identity someone -EmailAddresses @{add="alias@domain.com"}
.\CleanupActiveDirectoryEMT.ps1

The week of silence

Shut the server down rather than removing it, and wait. A week covers the weekly report that emails on Monday, the batch job that runs on the first of the month is worth a longer wait, and the finance system that only sends statements at quarter end may need a note in the runbook instead. Watch the Exchange Online message trace for anything that used to come through the on-prem connector and check the helpdesk queue for anything mail-related.

If something breaks, power the server back on, and it all works again. That is the entire value of shutting down instead of uninstalling. Once you are confident, run the cleanup, and take a final backup of the server's system state and Exchange databases before you wipe the hardware, in case a discovery request years later asks for a mailbox that was never migrated.

Frequently asked questions

Can I just uninstall the last Exchange server if Entra Connect is running?

You can, but you lose the supported way to manage Exchange attributes on synced users. Use the management tools only approach with the cleanup script instead, which is the documented path.

Do I still need the Exchange schema and attributes after the server is gone?

Yes. The Active Directory schema extensions stay, and the attributes on user objects keep syncing to Entra ID. The management tools write to them directly.

What about devices that can only send unauthenticated SMTP?

Use an inbound connector in Exchange Online restricted to your public IP for direct relay, or keep a small internal relay host that forwards to Exchange Online on behalf of the devices.

Takeaway

The last Exchange server can go, but not by hitting uninstall. Repoint relay and DNS, tear down the hybrid connectors, install the management tools somewhere that stays, shut the server down for a week, and only then run the cleanup script. If you want someone to walk that runbook with you, RackLedge has done it enough times to know where the surprises are.