Blog Post

Exchange Team Blog
4 MIN READ

Removing Your Last Exchange Server FAQ

The_Exchange_Team's avatar
The_Exchange_Team
Icon for Microsoft rankMicrosoft
Jun 01, 2022

In April, we released an update to the Management tools in Exchange Server 2019 that enables organizations that use Azure AD Connect and sync their Active Directory to manage Exchange recipients without the need for a running Exchange Server.

If you have one or more Exchange servers used only for recipient management, often referred to as last Exchange servers (LES), you can now install the updated tools on a domain-joined machine and shut down your last Exchange server(s). For more information, see Manage recipients in Exchange Server 2019 Hybrid environments.

We want to hear from you and get your feedback on this solution and we prepared a FAQ with questions that we hear most often. Please email your comments, questions, or suggestions to LESDiscussion@microsoft.com or post comments below!

FAQ

What are the system requirements for the Exchange Server 2019 Management Tools?
The Exchange Management tools are a lightweight installation and can be installed on any domain-joined Windows machine (see Supportability Matrix for supported operating systems). This can be a domain-joined workstation.

Why can’t we uninstall our last Exchange server?
Uninstalling your last Exchange Server will result in various configuration changes including the Exchange Organization container getting removed from Active Directory, which will make it impossible for our management tools package to manage Exchange attributes. Our recommendation is to shut down the server, and if you wish, repurpose it for something else.

If we run CleanupActiveDirectoryEMT.ps1, will it be possible to install an Exchange server again?
Yes. CleanupActiveDirectoryEMT.ps1 removes security groups, Exchange containers, and system mailboxes so that these can’t be misused by attackers in the event of a compromise. If you need an Exchange server later, you need to Prepare Active Directory and then install Exchange Server 2019. You won’t be able to install older versions of Exchange (only adding Exchange Server 2019 is supported).

We never had an Exchange Server, and all our users are in Exchange Online. We use Active Directory to provision users. Is the new Exchange Server 2019 Management tool package relevant for us? If yes, do we need to install an Exchange server to be supported?
The updated Exchange Management tools are supported in this scenario, and you don’t need to install an Exchange server to use them. If you have not extended your Active Directory Forest, you will need to extend your Active Directory schema, and then you can install the Management tools on a domain joined machine.

Are there any long-term issues from shutting down the last Exchange server?
If you don’t plan to use an Exchange server in the future, you can shut down and reformat your last server and repurpose or recycle the machine. If you are not sure, you can archive the server. Just don’t uninstall the Exchange server.

What happens if you have a domain with a sub-domain, where Exchange is installed in the root domain and the subdomain, and these are hybrid configurations with 2 different tenants?
It depends on the workstation and the connected domain. The Exchange Management tools can be used for recipient management in both domains.

We removed (uninstalled) the last Exchange server long ago. Can we now install the updated Exchange Server 2019 Management tools to help us manage recipients if we use Azure AD Connect?
Yes. Simply Prepare Active Directory and install the Exchange 2019 Server Management tools on a domain-joined machine.

When we install the new Exchange Server 2019 management tools package, should we remove the last Exchange server immediately?
Our recommendation is to shut down the last Exchange server and make sure that the new Management Tools will work for you. There is no reason to hurry with removal of your last server using the removal script. Once you are certain that the server is no longer needed, you can cleanup Active Directory using the CleanupActiveDirectoryEMT.ps1 script.

Our organization never installed any Exchange Server 2019 servers. Can we use this solution to manage our Exchange recipients? Do we need to install Exchange 2019 Server first to do it?
Exchange 2019 Management tools can be installed in any organization that currently has Exchange Server 2013 or newer version. You do not need to have a running Exchange Server 2019 before you can use the management tools. Simply Prepare Active Directory for Exchange Server 2019 (using the 2022 H1 Exchange Server 2019 CU or newer) and then install the Management tools on a domain joined machine.

Our organization currently uses the last Exchange server for user management but also for SMTP relay purposes. What should we do for SMTP relay in case we remove the last Exchange server?
If the last Exchange server is shut down, we recommend that you use the Exchange Edge Transport server to help you relay SMTP email.

How can we update the management tools only workstation to a newer Cumulative Update (CU) or Security Update (SU) if there are no more Exchange servers running in the organization?

Updating to the new CU:

  • Use the following command to perform PrepareAD:
    .\Setup.EXE /PrepareAD /IAcceptExchangeServerLicenseTerms_DiagnosticDataON
  • Use the following command to upgrade the Management tools only role:
         .\Setup.EXE /m:Upgrade /IAcceptExchangeServerLicenseTerms_DiagnosticDataON
  • If you had previously executed .\CleanupActiveDirectoryEMT.ps1in the environment as per Manage recipients in Exchange Hybrid environments using Management tools, run the .\CleanupActiveDirectoryEMT.ps1 script again (because /PrepareAD re-created some objects that the CleanupActiveDirectoryEMT.ps1 removes). Note: CleanupActiveDirectoryEMT.ps1 cannot be undone. It is important to do this only in the organizations where there are no working Exchange servers.

Updating to the new SU:

  • No special action is necessary. Simply download the security update package and run it to update management tools role to a newer SU.

Exchange Online Manageability Team

Updated Aug 15, 2023
Version 7.0
exchange 2019
hybrid
Tips 'n Tricks
  • LaurentFra's avatar
    LaurentFra
    Brass Contributor
    Jun 10, 2022

    After reading the article I can't understand, the 3 statements below seem to be conflicting :

    1> We can't uninstall the last Exchange Server because this would remove needed configuration objects and management tool package would not work.

    2> If we never had an Exchange server (this means configuration objects are not there), we can use the management tool package.

    3> If we uninstalled the latest Exchange Server a long time ago (this means configuration objects are no more there), we can install the management tool package  on a new domain member machine and use it

     

    Concerning keeping a server onprem for MFC and apps email relaying, I know IIS 6.0 SMTP engine is out of the game, but this would be a nice option. I would not use an Exchange server for email relaying. It would be buying a Ferrari to drive in narrow streets 🙂 Open sources alternatives like HMail Server will be lighter and more flexible.

  • LaurentF1000's avatar
    LaurentF1000
    Copper Contributor
    Jun 15, 2022

    R_MacBride The article states that "Uninstalling your LES will result in various configuration changes including the Exchange Organization container getting removed from Active Directory, which will make it impossible for our management tools package to manage Exchange attributes."

     

    But lower in the text it's written that if you never had Exchange in your AD, you can use the management tools package.

     

    This is contradictory.

  • Ildrosos's avatar
    Ildrosos
    Copper Contributor
    Jun 14, 2022

    LaurentFra is right . The 3 statements are conflicting each other! Which one is the right one ? Can we or can we not uninstall the last exchange server ? If we cannot why is statement 3 telling us we can install the management package ? Aren't the configuration objects lost already ? 

  • MikeUnibz's avatar
    MikeUnibz
    Copper Contributor
    Apr 06, 2023

    Hello again.
    Just FYI, after some testing in an Exchange test environment we tend to agree with this blog post here (and not with the newer document in the link above, which states that you can never run Exchange Server again). As it stands, at least in practice, a "...Prepare Active Directory and then install Exchange Server 2019..." is quite feasible and working.

     

    More than that, it must be working (to some degree at least). 
    We have found out that even the installation of the pure Management Role expects a "prepared AD", so if you ran the CleanupScript before, you have no choice but to run PrepareAD again! Which in turn recreates much of the classic Exchange objects, including containers, groups, permission assignments in AD, etc.

     

    This makes this role (or the current implementation of the "minimal role" concept) a bit awkward. Every time you want to install another management servers/computer (and this can happen more than once in the course of years), you must necessarily re-prepare the AD and afterwards re-run the CleanupScript! Not to mention the practical implications for all this in an AD with active security tiering concept (aka tier model, aka Enterprise access model; neither CleanupActiveDirectoryEMT.ps1 nor Add-PermissionForEMT.ps1 seem to be really built for this scenario, but that's another story).

     

    The_Exchange_Team
    At least that's our view of things and the result of our tests. If we have misunderstood something, please correct us.
    Just to be clear: we really appreciate the idea of a pure Management Role. And we will use it. But the implementation and use is currently more complicated than it seems.

     

    Thank you

  • Peter_Holdridge's avatar
    Peter_Holdridge
    Iron Contributor
    Jun 01, 2022

    We need to keep the last Exchange server (in fact we use a failover cluster) to manage secure SMTP relays. We have more controls over SMTP relay than simple IIS SMTP. It would be good if Microsoft had an advanced SMTP relay tool that gave the same or better features that Ex 2019 has without the need to install the full Exchange server.

  • fx1333X's avatar
    fx1333X
    Brass Contributor
    Jun 16, 2022

    This article does not make sense. It contractids itself. So, can I remove or not? One bullet point says no, the other one says you can remove it, other says if you never had Exchange is OK. Is the same team that worked on the last update to quick assist working on this too?

  • MikeUnibz's avatar
    MikeUnibz
    Copper Contributor
    May 31, 2023

    Hi , Nino_Bilic LukasSMSFT The_Exchange_Team :

    Can anyone please comment on the above question? 

    This is not a matter of detail, but a fundamental uncertainty in dealing with the "MinRole". By the way - as already posted in the 2023 H1 update blog - the problem extends to the Exchange CU updates as well (which also require an AD-Prep).

     

    Thank you

  • Arindam_Thokder's avatar
    Arindam_Thokder
    Icon for Microsoft rankMicrosoft
    Jun 01, 2022

    @PeterHoldridge79 - For relaying outbound email from on-premises application to EOP and then to internet, Edge Transport Server should be sufficient and should work perfectly, we don't need mailbox server for that. just FYI, SMTP component that is used in IIS for relaying email is part of IIS 6.0, support for which has ended long back with the support of Windows 2003

  • dreierdo's avatar
    dreierdo
    Copper Contributor
    Jun 02, 2022

    Would be great if there could be a lightweight version of a Exchange Control Panel which could be accessed through a browser to manage recipients. Some of our customers dont have experience in exchange-powershell, and are not using on-premises exchange for smtp relay. A GUI would be a nice improvement. Not needed for partners, but customers.