Are you getting this error in Microsoft 365 Admin center when viewing mail tab of a user? And on-prem Exchange has already been decomissioned? Well, you kinda have to “fake” the migration and clear some user’s attributes:

In AD Users and Computers, make sure Advanced Features are activated (View > Advanced Features). Go to the users OU and double click on the user. Select AttributeEditor and clear the following attributes:

msExchMailboxGuid

msExchRecipientDisplayType

msExchRecipientTypeDetails

Run AD / Entra Sync:

Start-ADSyncSyncCycle -PolicyType Delta

Wait for 15-30min and now the user will get an Exchange Online Mailbox if he has a license.

References:

https://techpress.net/this-users-on-premises-mailbox-hasnt-been-migrated-to-exchange-online/

By default, if you send a mail on behalf of a Shared Mailbox, the sent item will be saved in the user’s primary mailbox and not the shared mailbox. If you want to change it to expected behaviour, i.e. save the items in the Shared Mailbox, execute following command. This works in Exchange Online and Exchange OnPrem.

set-mailbox -MessageCopyForSentAsEnabled $True

set-mailbox -MessageCopyForSendOnBehalfEnabled $True

References:

https://learn.microsoft.com/en-us/exchange/troubleshoot/user-and-shared-mailboxes/sent-mail-is-not-saved

By default on an on prem Exchange 2013/2016/2019 environment, internal server names are displayed in the message header analyzer, which you would not want to expose externally.

This is how it would look like:

To remove that information, execute this command in the Exchange Powershell. Make sure you have the right Send Connector Name.

Get-SendConnector “Internet” | Remove-ADPermission -User “NT Authority\ANONYMOUS LOGON” -ExtendedRights ms-Exch-Send-Headers-Routing

And now this is how it looks like:

References:

https://practical365.com/remove-internal-exchange-server-names-ip-addresses-message-headers/

Exchange Zero days are very common these days and there is a freshly baked one today (30th September 2022 as of writing). If you want to know what how the vulnerabilities work, take a look at the reference at the bottom. As a sysadmin I care about securing my systems.

Here are a few steps to mitigate this zero day vulnerability:

In IIS Manager on the Exchange Server, select the Autodiscover virtual directory and open URL Rewrite and add a new rule.

Select Request Blocking

Enter the string

.*autodiscover\.json.*\@.*Powershell.*

Using should be changed to Regular Expression.

Change URL to REQUEST_URI and save the changes.

References:

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

A good backup tool uses VSS Writers to achieve application consistent backups, which also truncates transaction log files. You can also achieve that without having to do a backup. Here are the few commands:

diskshadow

You can add multiple volumes, if database and log files are located on different disk drives:

add volume D:

add volume E:

begin backup

create

end backup