r/exchangeserver

I'm looking to migrate my Windows server 2019 to 2022. Spinning up the 2022 from scratch. I need to migrate the Exchange server and was wondering if there's any good websites with step b step instructions or do I need to rely on GoogleAI?

Install Exchange, move all mailboxes and connectors over, and then decommission the old server..

I have already installed mailwizz on contabo server but it can’t push data as I expected. If anyone can help me this to install and configure. Our requirements is per day need to send 20lakh data in 8 hours .

Environment: Exchange Server SE, DAG with 4 members (2 production + 2 DR).

Here's exactly what I did, in order:

1. 08/10/2026, 11:56 AM — Ran New-ExchangeAuthCertificate on one of the DAG members to rotate the Auth Certificate.

2. Log output confirmed the new certificate was generated and staged:

   • New cert thumbprint: E6C74DBE...B5268 (masked)
   • Effective date is: 08/14/2026 12:11:31
   • Log explicitly stated: "The renewal action was successfully performed - the new Auth Certificate will become active on: 08/14/2026 12:11:31"
   • Log also recommended running Hybrid Configuration Wizard (HCW) once the new cert becomes active.

3. Confirmed via (Get-AuthConfig).NextCertificateThumbprint that the new cert is correctly staged as "Next":

   • Thumbprint: E6C74DBE...B5268
   • NotBefore: 8/10/2026 12:09:19 PM
   • NotAfter: 8/10/2031 12:09:19 PM (5-year self-signed cert)

4. Current cert, confirmed via (Get-AuthConfig).CurrentCertificateThumbprint:

   • Thumbprint: E31DFF2D...4497
   • NotBefore: 8/27/2021 1:16:50 AM
   • NotAfter: 8/27/2026 1:16:50 AM

   (So the current cert isn't even expired yet — about 11 days of validity left — which is a separate point but confirms this wasn't an emergency/forced rotation scenario.)

5. To make sure the AuthAdmin servicelet (which checks the effective date every 12 hours) would pick up the change without waiting, I manually restarted MSExchangeServiceHost on all 4 DAG members (2 prod + 2 DR).

6. Verified the restart worked by checking:

   [xml]$xml = Get-ExchangeDiagnosticInfo -Process "Microsoft.Exchange.ServiceHost" -Server $server
   $xml.Diagnostics.Components.AnchorApplication.AnchorServiceComponents.CacheScheduler.lastRunTime

on each server — all 4 servers show a recent lastRunTime (8/15/2026, evening), confirming the servicelet actually ran on every member.

Problem

Today is 8/16/2026 — 2 days after the stated effective date (8/14) — but:

(Get-AuthConfig).CurrentCertificateThumbprint

still returns the old certificate (E31DFF2D...4497). The new certificate is still sitting as NextCertificateThumbprint, it never got promoted to Current.

Questions

• Given the servicelet has clearly run (confirmed via lastRunTime) on all 4 members after the effective date, why hasn't the promotion from Next → Current happened?
• Is there something DAG/multi-AD-site specific I'm missing? (The tool's own log warned about Exchange being installed in multiple AD sites and mentioned the servicelet may fail to deploy the cert to other AD sites in rare cases.)
• Is Set-AuthConfig -PublishCertificate something I need to run manually here, even though the tool I used already set the NewCertificateEffectiveDate and the log said it was "successfully performed"?
• Could this be a timezone issue between when the effective date was stored vs. how the servicelet evaluates "now"?

Any input appreciated before I just run Set-AuthConfig -PublishCertificate manually and force it.

I currently have the problem that some users experience one or more of the following issues:
• Outlook won’t start (with a bit of luck, one out of four attempts succeeds)
• Outlook freezes and switches to “Not responding” when they try to send an email
• Emails get stuck in the Outbox
• Typed text disappears
• The connection to Exchange is interrupted
I have tested this with Office 2024 LTSC (July and August builds), Office 2019, and Office 365.
The interesting point is that the problem occurs both with a single Exchange SE host and with a DAG running Exchange SE — two completely separate environments.

Update 20:12: I performed a system restore to a restore point from before the problems started, but that did not resolve the issue.

We are now stuck with a dilemma of migrating mail enable security groups. We have around 800+ mail enabled security groups, around 600 coming from EAC which we are planning to strip away the exchange attributes. Yea, we are a big organization with stupid people who made these mail enabled security groups in the first place. Couple of these are being used for emails which we figured out using mail trace option, for that we will recreate it as a EXO DL, rest of them can just be stripped away and preserve it as security groups in AD. Now, we did couple of testing with some test groups and here is my understanding so far…

1. Stripping away the exchange attributes using the disable command removes only the domain email address, it still hold the tenant onmicrosoft.com address. However, it disappears from EAC but still valid in AD.
2. Since the group is synced from AD to azure, it still shows up on EXO with a valid onmicrosoft.com address.
3. Now, the only way to completely strip the exchange attributes and just keep it as security groups in AD, we must move it to a non sync OU for it to disappear from azure. Then moving back to the previous OU will mark this group as only security group in azure. This workaround was mentioned in couple of Microsoft and private blogs.
4. Now my question, if this groups which is being synced from AD to azure has some permission like file share or anything in AD which is also being used as a permission group in azure or is an approved sender for any DL or added as a permission for any shared mailbox, moving it to a non sync OU will break it from azure. How can we over come this ? Deleting and recreating it will break AD permissions as well.

What can be the best option to strip the exchange part and keep it synced between AD and azure without any breakage, so that the ones are being used we can recreate it on EXO as DL others can rest in peace in AD. I plan to do this and go home peacefully without working and fixing this mess all night long.

Advises please…. Thank you !!

Just to preface, i know this is technically not the correct way to create Shared mailboxes but it is how its currently done in my company.

Our service desk creates shared mailboxes by creating an Office 365 mailbox on-prem and once in EXO it gets converted to a shared mailbox. What I have found though is that the mailbox will appear directly in EXO without a license and in some cases I have found that when they forget to convert the mailbox to shared it somehow stays in EXO as a user mailbox and continues to work even after 30 days without a license. Has anyone ever seen this? I have no idea how these mailboxes are working.

Thanks!

I manage several users who use Outlook Classic as their primary email app. Today a single user noticed her calendar invites weren't going through. She had an email stuck in her outbox , and when I tried to clear it it said she didn't have permission to delete. I was able to delete it in safe mode, but new messages still get stuck and she is not receiving incoming messages despite the bottom ribbon saying "connected to MS Exchange". I tried making a new profile but the new profile gets hung on the "loading profile" step, same thing if i try to rename the existing OST to force a new one. The new profile's OST file is blank so I don't think it actually pulled any data. She has another user's mailbox added in the form of a second profile, and that one works just fine. New Outlook, mobile, and web worked fine so I assumed it must be an issue with either her cached credentials or something local, but here's the weird thing.

I made a new profile using her mailbox on my pc to test, and that failed. Creating the profile through the control panel gave me a notification that an encrypted connected could not be secured. Creating it through the profile selection menu worked including prompting the MS sign in popup, but trying to open the profile in or out of safe mode triggers the following error before crashing outlook; "Cannot start Microsoft Outlook. Cannot open the Outlook window. The set of folders cannot be opened. The attempt to log on to Microsoft Exchange has failed". This is a single user in our organization who is unable to sign into multiple PCs via outlook classic, and does not appear to be tied to her credentials based on them working for the other clients.

I've got a MS support ticket open, but last time it sat on their desk unassigned for months until it just timed out. Any Ideas? No major changes have been made on the back end that would impact authentication/sign ins.

Good day to all.

I work for a management company. Our IT department is small. Only 3 of us to manage about 300 active users and no MSP. We have a hybrid AD/Entra environment. Most of our users are 365 Business Premium licensed. Our company operates in the medical field, so we are subject to HIPAA and have a global 7 year data retention policy setup in Microsoft for Exchange and OneDrive/Sharepoint.

Without providing too much detail that I'm, for the most part, not privy to myself, we had some kind of incident with an employee doing some things they shouldn't have been doing. But like a lot of times, the IT department was left out of the loop. On 6/10/26, we were told the user was terminated, so we went through our normal process of disabling the user, removing permissions, the usual. We were not, and are almost never privy to the circumstances behind a termination.

I found out this Monday (8/10/26) that there is some litigation going on regarding this person's termination and we were asked to preserve the users emails and recover anything that was deleted. HR has been adamant about recovering their deleted emails that they are positive exist. When I found out about the litigation on Monday, I placed a litigation hold on the user's account.

I've started the process of trying to recover deleted emails through Exchange Admin > Mailboxes > [User] > Other > Recover deleted items. I've set the date filter for the entirety of their tenure with the company, which was only a couple of months, and I've come up with nothing that can be recovered. It's my understanding that even if the user deleted emails, deleted them from the deleted items folder, then purged them from the recovery window in Outlook, our data retention policies should still make them recoverable.

My question is: With our data retention policies in place, does this mean that they didn't delete anything? Or would the time that passed between the termination and the litigation hold being put in place be too much to recover anything?

Hi

A few days ago my tenant was sabotaged by Microsoft. Max send and receive limits for all plans were set to 150 KB.
Check your settings now!

https://preview.redd.it/gygsu5p9kpih1.png?width=376&format=png&auto=webp&s=282f1ab545b1436c39105709a9e7ed379d46e023

https://preview.redd.it/yj689x96kpih1.png?width=881&format=png&auto=webp&s=7391664ba0a7af47f8569ba41cc2bb12dc0892e5

Long short, we spent a few months running two SEGs in sequence, one of which we already had and one that came with an acquisition. Redundant yes, but double the distance covered.

Then an email came in impersonating the vendor payment details with just a believable note about changed bank details from a supplier we deal with every week. Two products, same miss. That was the moment it clicked that gateways are still built to scan payloads.

If you've eliminated the SEG and gone native plus something behavioral, what fell over?

Hi everyone, at my wits end with this one.

We have a hybrid setup and migrated everyone to exchange online. We have an Exchange SE server on prem that is just used for management and all mailboxes are in exchange online.

Random users get the following error when they try to set their out of office “Your automatic reply settings cannot be displayed because the server is currently unavailable. Try again later”

If tried so many things and none seem to resolve it.

EWE enabled for users, rules aren’t broke or to big, registry keys etc…

The autodiscover points to 365, have checked this on outlook

The only thing that seems to work is nuking the user profile (not the outlook profile, that’s does nothing),but that brings other problems and we have too many users to do this at scale.

Any help would be appreciated

Exchange Online Transport Rule Issue – Internal Folder Project
Objective

I'm implementing an Exchange Online solution that automatically files internal-only emails into an "Internal" folder in every mailbox.

Desired behaviour:

Scenario Expected Result
Internal → Internal Move to Internal folder
Internal → Internal + External (To/CC/BCC) Stay in Inbox
Internal → External Stay in Inbox
External → Internal Stay in Inbox
Guest/B2B involved Stay in Inbox

Tried a lot in Exchange Online Admin, Outlook Rules, Powershell etc, but not working.