By the end of 2020, a couple of interesting things regarding Exchange server are going on. The...
ENow Software's Exchange blog built by Microsoft MVPs for IT/Sys Admins.
Microsoft Exchange (5)
Decommissioning the last Exchange server
When you are in an Exchange hybrid configuration and you have migrated the last Mailbox to Office 365, you might wonder what to do with the last (couple of) Exchange server that is still running on-premises. Can you decommission your last Exchange server because all your Mailboxes are in the cloud? From a supportability point of view the answer is still “No, you can’t decommission the last Exchange server because you need it for management purposes” and most customers think this is disappointing. Let me explain why we still need this last Exchange server.
Securing Exchange Servers
Securing Exchange servers is hard. I mean it can be a giant pain sometimes. There are what, hundreds of millions or maybe billions of lines of code running on your Exchange servers, right? It doesn’t take much for a typo to get through and open a vulnerability that can then be exploited opening the most important and valuable data within your organization to all kinds of bad actors.
Exchange on-premises and Microsoft Teams
With the work from home going on due to the COVID-19 crisis there’s an increasing demand for tools like Zoom, Skype for Business and Teams. While Zoom is doing a great job for personal use, I prefer Skype for Business or Microsoft Teams for business use.
Since the early days of Exchange Server, the limits of user mailboxes were strictly regulated. In many Exchange organizations, these quota limits were configured on a mailbox database level and were therefore consistent for all mailboxes stored in the same database. This approach was selected because the existing hard disk space was scarce and expensive in the past.
The following example shows two databases (DB-USER-1 / -2) for standard users and one database with larger mailboxes for executives (DB-C level).
The approach to configuring quotas at a database level was never questioned when transitioning to modern versions of Exchange Server. The old operating patterns were merely taken over.
With modern Exchange Server versions and the Preferred Architecture recommendations this type of servicing of mailboxes no longer makes sense. One of the essential non-technical recommendations is to standardize and simplify the daily operation of the entire Exchange Server platform. Especially with a hybrid setup, which is the parallel operation of a local Exchange organization a and Exchange Online, it is recommended to simplify the service model.
You can standardize and simplify Exchange Server operations by configuring mailbox quotas at the mailbox level. This standardization eliminates the need for dedicated mailbox databases for different user groups. You can move mailboxes between any database, allowing you to respond to on-premises IT infrastructure challenges more flexible.
The following example illustrates this standardization with three mailbox databases (DB-1 / -2 / -3) which store a different number of mailboxes with varying quotas of mailbox.
The simplification becomes even more apparent when we look at the distribution of varying user mailboxes (MBX, blue/yellow) and activated online archive mailboxes (ARC, green).
In addition to user mailboxes and online archive mailboxes, there are other types of mailboxes:
- Room and resource mailboxes (RES, gray)
- Public folder mailboxes (PF, orange)
For simplified and standardized operation, these additional mailbox types provide the following example with mailboxes distributed across five mailbox databases.
With a modern implementation of Exchange Server utilizing a Database Availability Group (DAG), you do not need a traditional backup solution. All required functions to protect mailboxes and mailbox content are integrated into the Exchange Server product. Therefore, it does not matter in which database a particular mailbox is stored. This type of operation is the same as the operating model in Exchange Online. In Exchange Online a user mailbox is stored in "a" mailbox database on “some” Exchange Servers.
Are there any disadvantages for such a simplified and standardized operation of mailbox databases in an on-premises Exchange organization?
There is one disadvantage to a standardized operation in an on-premises Exchange organization, at least if you continue to rely on traditional backup methodology and regularly restore mailbox content from a classic (or legacy) backup. In this case, you need to know in which database a mailbox was stored at the time of backup to restore exactly that single database explicitly. The Active Directory object of a mailbox owner has no history of the previous locations of a mailbox. The object stores the current mailbox database location only.
There are no restrictions regarding security for the service operation and administration of Exchange mailboxes. With Exchange Server Role Based Access Control (RBAC) you have all the options to allow management of dedicated mailboxes, e.g., executive mailboxes, to only specific support personnel. You should refrain from restricting the access to Active Directory objects by adjusting object permissions directly. Modifying the object security settings is much more insecure compared to controlling access using RBAC.
Modern operation of an Exchange organization with database-independent control of mailbox quotas provides flexibility and standardization. In a hybrid setup with Exchange Online, you operate mailboxes in the local Exchange organization in the same way as in Exchange Online. Therefore, you have a consistent mode of operation. The only differences are the different mailbox quotas compared to Exchange Online. Ideally, you also adjust the mailbox quotas in the on-premises Exchange organization to match those in Exchange Online.
If your on-premises IT infrastructure does not provide the necessary operational parameters for secure and stable operation of Exchange Server, but mailbox availability is essential to your business, then Exchange Online is the better alternative.
- Exchange Server Requirements Calculator
- Exchange Server Role Based Access Control
- Set-MailboxQuota PowerShell Script at GitHub
Enjoy Exchange Server.
On December 17, 2019 Microsoft released Exchange 2019 CU4 and Exchange 2016 CU15 as part of their quarterly release cycle. As expected, no new features in these Cumulative Updates. According to the Microsoft vision, if you want the latest and greatest you need Exchange Online, if you’re satisfied with a rock solid on-premises deployment you’re good with these versions. And since Exchange 2013 is out of support, no Cumulative Update for Exchange 2013 is released.
Over the past 20 years we’ve seen some dramatic changes in Microsoft Exchange Server. Exchange server 2000 was the first version that was using Active Directory, after switching from its own directory that was in Exchange server version 4.0 until version 5.5.