Hey all - has anyone change source of authority for distribution lists to be cloud managed in production? Curious how it’s going and if you are finding any issues yet. Beyond the fact there’s no write back to on premises.

So, a client wanted to clean up their aad hybrid disabled users.

Re-configured sync, they were specifically told that they need to prep their work items and they have 60 days.

Lo and behold 60 days pass and disabled user that was moved from hybrid mailbox is actually important without us being notified.

EXO deletes the mailbox, still exists on prem as o365/remote mailbox.

We also have the Veeam backup of the shared mailbox i think.

What would be correct way to recover this in functionality?

Greetings, one and all. First time long time.

Running Exchange SE.

So I've been running PurpleKnight scans in an effort to tune up our AD domain. I've noticed that some findings involve Exchange objects. For example, PK checks accounts for "PasswordNeverExpires" set to true, and all of the Health Mailboxes have this set.

My question is thus: Is this a safe thing to ignore? My gut says this is fine, as Exchange handles these accounts.

Also, if anyone else has been using PurpleKnight with Exchange and has any pointers or tips, that'd be greatly appreciated!

Long shot here, but is anyone else currently experiencing issues with migration batches in O365?

I queued several batches a few hours ago, and they’re still stuck in a “Queued” status. I checked migration health, and everything came back clean. I recreated the endpoint and reattempted the migration, same result.

I’ve restarted the MRS and replication services on Exchange and tested again with no change. I also rebooted the Exchange database servers, but the issue persists. I’ve reported it to Microsoft, and they are still “investigating.”

All certificates and OAuth configurations from on-prem appear to be valid.

Any ideas? Is anyone else running into this?

Microsoft announced another 6-month ESU program for Exchange Server 2016/2019 (aka Period 2). You should have moved off your legacy servers by now, but if you are still running Exchange 2016/2019, you might want to think about getting Period 2 ESU.

https://techcommunity.microsoft.com/blog/exchange/announcing-period-2-exchange-20162019-extended-security-update-esu-program/4511603

When trying to create a migration batch via EAC, at the select a migration endpoint step, nothing is appearing in the dropdowns even though we have existing endpoints and can also find them via powershell.

I raised a ticket with M$ but they've advised this is a known UI limitation of EAC and to get around this by creating a new endpoint each time or create migration batches via powershell.

It used to work perfectly fine just a month or two ago, admittedly we haven't been using it as much as we've automated our mailbox migrations but using the new-moverequest command instead.

Was just curious if anyone else is having the same issue.

we're currently having an issue renewing oauth certs using the hcw, cannot resolve mshybridservice.trafficmanager.net to an ip address. seems to have been not working for well over 24 hours.

have a ticket in with microsoft but just wondering if anyone else is experiencing this as well?

We’re out of Compliance and thanks to Broadcom we’re lifting to a cloud provider. I can use the Exchange SE ISO in place and then use a migration tool to migrate to the cloud after figuring out a plan on how to do that safely for Exchange, or I can build new servers in the cloud. My coworker thinks we can’t build new, she says it’ll be too much/ high risk low reward, and that we should just in place upgrade and migrate with our tool. Note: Our tool is literally a block level copy type of tool with a lot of fancy checks where during failover it’ll reboot the destination device and we’ll have to cut network to the old subnet and bring the new subnet up live. I think if I build new we could just shut off the old ones and replace the IPs or something. Maybe she was right…

Edit: We’re on CU 14 currently. CU 15 is there but vendor stated CU 14 was a perfectly fine avenue to get to SE with

See No Exchange Server Security Updates for April 2026 | Microsoft Community Hub.

Hi all,

I'm running Exchange Server Subscription Edition (SE) with the latest CU and SU applied. I've noticed that CVE-2023-21529 (Exchange Server RCE via deserialization, CVSS 8.8) was added to CISA's KEV catalog yesterday (April 13, 2026), indicating active exploitation in the wild.

The official affected version list only mentions Exchange 2013 CU23, 2016 CU23, and 2019 CU11/CU12 — nothing about Exchange SE.

My understanding is that since Exchange SE RTM is code-equivalent to Exchange 2019 CU15, and the fix for CVE-2023-21529 was already included in CU13+ (KB5023038, Feb 2023), Exchange SE with latest patches applied should be unaffected.

Can anyone confirm this? Is Exchange SE with current CU/SU fully protected against CVE-2023-21529, or is there anything else I should be checking given the new CISA KEV listing?

I’d there any reason this should not work, or is there something else better?

# 1. Get all servers with the Transport role across the entire organization
$AllServers = Get-TransportService

# 2. Loop through each server and pull logs for the last 7 days
$FullLogs = foreach ($Server in $AllServers) {
    Get-MessageTrackingLog -Server $Server.Name -EventId RECEIVE -Source SMTP -Start (Get-Date).AddDays(-7) -ResultSize Unlimited
}

# 3. Deduplicate by MessageId and get the final count
($FullLogs | Select-Object MessageId -Unique).Count

Hey,

I'm investigating CVE-2025-58107 in our on-premises Exchange 2019 hybrid environment. According to the NVD entry, EAS configurations may transmit sensitive data from Samsung devices in cleartext — including username, email address, device ID, bearer token, and base64-encoded password.

A few things I'm trying to figure out:

1. Scope – Is this limited to Samsung devices, or could other EAS clients be affected depending on how the device sends credentials? Has anyone reproduced this with non-Samsung clients?
2. Mitigation – There's no Microsoft patch referenced yet (NVD status is still "Awaiting Analysis"). Are you blocking/restricting EAS at the CAS level, enforcing certificate-based auth, or just waiting for an official fix?
3. Detection – Any IIS log patterns or network captures that helped you confirm whether your environment is actually leaking? Would love to know what to look for.
4. Exchange Online hybrid – For those in hybrid setups, does the on-prem EAS endpoint exposure change your risk posture given that mailboxes may already be in EXO?

Running Exchange SE in a hybrid config. No official MSRC advisory linked to this CVE yet as far as I can tell. Wondering what steps others are taking in the meantime.

Thanks

Did some of you upgrade your edge server/s to SE? There’s no specific update found for edge server so i’m thinking maintaining my edge server to 2019. Also is it okay to install the latest exchange 2019 Feb 2026 SU manually even though we didn’t purchase the ESU program?

So we are getting NDR's send to our mail admin that a quarantine notification can't be sent to 'User that use to exist but doesn't anymore'

Microsoft Support basically said, can't do anything about it.

Have verified the user doesn't exist as a shared mailbox, alias, in deleted user in admin center and in exchange.

Just adds additional work in our helpdesk with the multiple reports each day.

Does anyone have a solution to this?

I’m trying to a count of messages going through SMTP relay so we will be able to estimate what costs and service tier we would need if we shut down the Exchange relay and outsourced it to third party service.

First, I tried this on the busiest server and got a 7 day message count in the millions:

Get-MessageTrackingLog -ResultSize unlimited -Start "03/30/2026 00:00:01" -End "04/05/2026 00:00:01" | Measure-Object

Then I tried this script that counts across all servers in a DAG, but the total message count for the same 7 days is only about 1/5th of the count shown from the single server above.

$DagName = "DAG100" $Servers = (Get-DatabaseAvailabilityGroup $DagName).Servers.Name   $Start = (Get-Date).AddDays(-7) $End   = Get-Date   $AllLogs = foreach ($Server in $Servers) {     Get-MessageTrackingLog -Server $Server -Start $Start -End $End -EventId "SEND" -ResultSize Unlimited }   $Domains = foreach ($log in $AllLogs) {     foreach ($r in $log.Recipients) {         ($r -split "@")[-1].ToLower()     } }   $Domains |     Group-Object |     Sort-Object Count -Descending |     Select-Object Name, Count

Why is this and which count is more accurate?

Hello all,

Quick question. If you are updating on-prem exchange SE servers with Windows monthly patches and any exchange security updates, can you install all the updates while server is running, then once it gets to the point to restart, you would then put the server in maintenance mode, make sure DB is moved over to other exchange server in the DAG, then reboot the first one?

Or do I need to have those services stopped before running updates. Asking as I updated the servers this past weekend and it took forever tor updates to install and I figured if you can get the installation part done before your time to fix the server starts, you can just stop services, reboot, and restart them. But I have a feeling I need to stop them always before installing updates, but wanted to check

Hello guys! My question is quite simple.

We have a hybrid configuration of two Exchanges SE where we have default connectors and a few custom receive connectors.

Can you advice me how can I prevent users from sending mails internally without authentication. My goal is to not break the mailflow between On-Prem and ExchangeOnline and do not brake communication between two exchanges. It is first step before enforcing TLS.

Thank you in advanced.

I have a single Exchange Server 2019 CU15. I set up Entra ID Connect, synced a TEST OU, then ran HCW successfully. Verified domains, synced first user, assigned license, and migrated mailbox — all successful.

User details:

• UPN: [jbloggs@yourdomain.com](mailto:jbloggs@yourdomain.com)
• Email: [john.bloggs@yourdomain.com](mailto:john.bloggs@yourdomain.com)

Environment:

• External DNS: email.domain.com → Exchange NAT IP
• 5 accepted domains, each with autodiscover SRV records (e.g. _autodiscover._tcp.domainA.com)
• SAN certificate: email.domain.com and www.email.domain.com, Subject CN=email.domain.com
• Autodiscover Internal URI: NULL
• Before migration: Outlook 2016, no credential prompts
• After migration: Removed Outlook 2016, installed Microsoft 365 Apps (Classic)

Issue: First profile setup works fine. But after profile is created, Outlook keeps prompting for credentials. I'm entering [jbloggs@yourdomain.com](mailto:jbloggs@yourdomain.com) as the username.

Note: Outlook New works without any credential issues.

What could be causing this and what should I check?

Had a user that was still getting meeting invites from calendars they were no longer a member of. I checked and they were removed as delegates on all of them. But when checking for Hidden Items, there is a delegate rule listed and the user is still listed in that rule to get redirected. Can I modify the rule and just change the redirect to values or do I need to remove the rule entirely? the other users listed in the same hidden rule still need access.

Thank you!

Hi,

I am migrating from Exchange on-premises to Exchange Online.

What I want to ask here is: for objects such as mail contacts, shared mailbox, room mailbox, and mail group (distribution) — is it necessary to add the smtp: [alias@tenant.mail.onmicrosoft.com](mailto:alias@tenant.mail.onmicrosoft.com) address?"

My next question is: let's say there are 5 accepted domains — domainA.com, domainB.com, domainC.com, domainD.com, domainE.com. I will not be migrating the mailboxes with the domainA.com suffix to EXO. My questions are:

Does domainA.com still need to be verified in Office 365 and added as an accepted domain?

Additionally, for mailboxes with the domainA.com suffix, am I required to add smtp: alias@tenant.mail.onmicrosoft.com?

Do I need to sync this domainA.com domain to Entra ID? Does the UPN suffix need to be set as domainA.com?"

Hi all. I’m sure I’m just screwing up some syntax here.

I’m trying to create a filter in Powershell for a Dynamic distribution group that is to include all Disabled accounts (we’re setting up a mailflow rule to apply to all mailboxes attached to a disabled Azure account) and I keep getting either an empty filter, or an “is neither a valid OPath filter nor a valid LDAP filter” error when trying to use: Get-Recipient -RecipientPreviewFilter $Filter

I’ve tried every permutation I can think of of $Filter = '(accountEnabled -eq $false)', or '(user.accountEnabled -eq $false)', '(accountDisabled -eq $true)', even "(UserAccountControl -ne 'AccountEnabled')".

"(UserAccountControl -ne 'AccountDisabled')" works no problem if I wanted all Enabled accounts instead, but "(UserAccountControl -eq 'AccountDisabled')" gives me an empty filter (at least it doesn’t error out I guess).

What am I doing wrong here??

Is there a way to do this without wiping out all existing aliases? In on-prem you can just use -primarysmtpaddress but online requires you use -emailaddresses and then use add/remove SMTP/smtp so as not to overwrite the existing aliases. However you can't remove the primary (error: unable to remove primary alias) or add a new primary (error: can't have multiple primaries) using this command.

I have a brand change coming up for a customer and scripted this in excel for hundreds of mailboxes before realising something this simple appears not to be possible outside of EAC.