Part 1 of this article covered the basics, i.e., Exchange 2016 installation and side-by-side hybrid license activation. In this part 2, we will cover the configuration update and migration of Hybrid Exchange 2010 to Hybrid Exchange 2016.
Update the Service Connection Point (SCP)
Open Exchange Management Shell to run the following command.
Get-ClientAccessServer -Identity “Server Name” | fl
Note the auto discover URL https://<FQDN>/Autodiscover/Autodiscover.xml
Set-ClientAccessServer -Identity “New Server Name FQDN “ -AutoDiscoverServiceInternalURI https://<FQDN>/Autodiscover/Autodiscover.xml
To check the update, run this command.
Get-ClientAccessServer -Identity “New Server name” |fl
Import the Exchange UCC certificate
Note: Before importing the certificate, make sure you have added the new Exchange Server FQDN as DNS in your exchange certificate.
To import the certificate from the Exchange Admin Center, the file path should be \\Localhost\c$\Cert\cert.pfx
Put the certificate password if you are running ECA from the new Exchange Server.

Update Exchange Virtual Directories & Outlook Anywhere settings
$ServerName = “Exch01(FQDN For server)”
$FQDN = “Web address you want to use” (Ie. Webmail.company.com)
Get-OWAVirtualDirectory -Server $ServerName | Set-OWAVirtualDirectory -InternalURL https://$($FQDN)/owa -ExternalURL “https://$($FQDN)/owa”
Get-ECPVirtualDirectory -Server $ServerName | Set-ECPVirtualDirectory -InternalURL “https://$($FQDN)/ecp” -ExternalURL “https://$($FQDN)/ecp”
Get-OABVirtualDirectory -Server $ServerName | Set-OABVirtualDirectory -InternalURL “https://$($FQDN)/oab” -ExternalURL “https://$($FQDN)/oab”
Get-ActiveSyncVirtualDirectory -Server $ServerName | Set-ActiveSyncVirtualDirectory -InternalURL https://$($FQDN)/Microsoft-Server-ActiveSync -ExternalURL “https://$($FQDN)/Microsoft-Server-ActiveSync”
Get-WebServicesVirtualDirectory -Server $ServerName | Set-WebServicesVirtualDirectory -InternalURL “https://$($FQDN)/EWS/Exchange.asmx” -ExternalURL https://$($FQDN)/EWS/Exchange.asmx -BasicAuthentication $true
Get-MapiVirtualDirectory -Server $ServerName | Set-MapiVirtualDirectory -InternalURL “https://$($FQDN)/mapi” -ExternalURL “https://$($FQDN)/mapi”
Get-OutlookAnywhere -Server $ServerName | Set-OutlookAnywhere -ExternalHostname $FQDN -InternalHostname $FQDN -ExternalClientsRequireSsl $true -InternalClientsRequireSsl $true -DefaultAuthenticationMethod NTLM
IIS setting to make sure everything works.
SSL Settings and HTTP Redirect settings for all virtual directories in Exchange 2016 and ensure it is set properly.
Virtual Directory SSL enabled HTTP Redirect
Default website NO Yes
aspnet_client Yes NO
Autodiscover Yes NO
ecp Yes NO
EWS Yes NO
owa Yes NO
Microsoft-Server-ActiveSync Yes NO
OAB Yes NO
PowerShell NO NO
Rpc Yes NO
Add anonymous SMTP relay connector
PowerShell to create custom Receive Connector
New-ReceiveConnector -Name "External" -Usage Custom -TransportRole FrontendTransport -AuthMechanism Tls,Integrated,BasicAuth,ExchangeServer -PermissionGroups AnonymousUsers, ExchangeUsers, ExchangeServers, ExchangeLegacyServers, Partners -Bindings X.X.X.X:25 -RemoteIPRanges Y.Y.Y.Y -MaxMessageSize 25MB
X.X.X.X will be your Exchange Server IP
Y.Y.Y.Y will be your client Application Server or IP pool
Update DNS and firewall rules, and update send connectors
Now, we can update any local DNS entries like “mail.” or “autodiscover.” The traffic on the local LAN segment will start to flow through the new Exchange Server.
To make the same change for external users/services, you can just update your firewall NAT rules to point at the new server as well update the send connectors to new Server For Outbound to EOP and Outbound to Office 365
Uninstall the Legacy Exchange Server
#Remove default Public folders
Get-PublicFolder "\" -Recurse -ResultSize:Unlimited |
Remove-PublicFolder -Recurse -ErrorAction:SilentlyContinue
#Remove system Public folders
Get-PublicFolder "\Non_Ipm_Subtree" -Recurse -ResultSize:Unlimited |
Remove-PublicFolder -Recurse -ErrorAction:SilentlyContinue
#Remove Offline Address Book
Get-OfflineAddressBook -Server “Old Server “ | Remove-OfflineAddressBook
#Remove Public Folder database (Exchange 2010 Only)
Get-PublicFolderDatabase | Remove-PublicFolderDatabase
#Remove arbitration mailboxes (Exchange 2010 Only)
Get-Mailbox -Arbitration | Disable-Mailbox -Arbitration -DisableLastArbitrationMailboxAllowed
#Remove mailboxes
Get-Mailbox -server “ Old Server “ | Disable-Mailbox
Exchange uninstaller -- Run command Prompt as administrator, Navigate to C:\Program Files\Microsoft\Exchange Server\v14\Bin and run:
setup.com /mode:uninstall
Run the new hybrid configuration wizard
By running Hybrid Configuration wizard we update all the setting between Exchange Online and Exchange On-Prem. Like Send connector, Receive connector, and certificate for Secure mail flow.







In this part we have covered Step by Step configuration update and migration of Hybrid Exchange-2010 to Hybrid Exchange 2016.
Feel free to reach out if you have any question or concerns.
Thank you for reading.

Al SantiPosted Apr 11, 2024, 7:32 PM
Hi Krunal, I've followed your steps and would like to install a second Exchange 2016 hybrid server. How do I go about doing that? Is it just a simply Exchange install or do I follow some of the steps you've outlined above?
John LeighPosted Dec 9, 2021, 6:18 PM
Krunal - are the steps under "Uninstall the Legacy Exchange Server" performed from the desktop of the old 2010 server or the new 2016 server?
Abdul FarooqPosted Aug 8, 2021, 7:11 PM
Hi Krunal, Thank you, my question is regarding schema update. You did it in a different way because you had already hybrid deployment, right? I have four ex2010, I will introduce ex2016 and will setup co-existence first, than I will setup ex2016 as hybrid exchange and move to cloud. My current AD is configured with azure AD connect with options "Configure Hybrid AD Join". Do Still need to update schema as you have done in this article or the Normal schema update?
Sandy KPosted Apr 3, 2021, 6:40 PM
Hi Kunal, Thanks for the great article.I am also planning to upgrade my environment from Exchange 2010 Hybrid to Exchange 2016. I just want to make sure that can we use the different namespace for OnpremisesSmartHost(The step where it is asking to enter the FQDN of your onprem organization)? when I configured Exchange 2010 Hybrid I used mail.xyz.com so now while configuring hybrid with Exchange 2016 Can I use mailnew.xyz.com? or Do we need to go with same namespace that I used in Exchange 2010 Hybrid Configuration? I will point mailnew.xyz.com to my new exchange 2016 servers.
James AndersonPosted Nov 17, 2020, 8:00 AM
Hi, after completing the install of Exchange 2016, it's ECP keeps redirecting to Exchange 2010 after the login screen. I have tried https://localhost/ecp?ExchClientVer=15.1 but that does the same. I have removed any/all HTTP redirects from 2010 Exchange but that hasn't made any difference. Is it linked with Administrator mailbox sitting on On-Prem database? Is there any way I can bypass this redirect and get to Exchange 2016 ECP?
Andreas ZueglerPosted Oct 9, 2020, 5:14 AM
Hi. Is there any reason for disabling the arbitration and system mailboxes instead of moving them? We found several posts with different opinions - please advise.
Aus SupportPosted Sep 6, 2020, 6:10 AM
Trying to decommission last exchange 2010 server and add the exchange 2016 and run theHybrid Configuration Wizard I came across the HCW8078 below error. Microsoft.Exchange.Migration.MigrationServerConnectionFailedException The connection to the server ‘webmail.domain.com’ could not be completed. Microsoft.Exchange.MailboxReplicationService.MRSRemoteTransientException The call to ‘https://webmail.domain.com/EWS/mrsproxy.svc’ failed because no service was listening on the specified endpoint. Error details: There was no endpoint listening at https://webmail.domain.com/EWS/mrsproxy.svc that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. –> Unable to connect to the remote server –> No connection could be made because the target machine actively refused it 202.183.94.21:443
Aus SupportPosted Aug 28, 2020, 3:19 AM
Hi Krunal, When i run get-Orgconfig i can see the name like prod no FQDN? so can i add external domain name or internal domain name?
Aus SupportPosted Aug 8, 2020, 12:25 AM
Hi Krunal All mailboxes are in 0365. Have ADFS and ADSync Servers. We have configured Internal DNS, point all exchange virtual url's to point to F5 internal load balancer. Ex: OWA Internla Url: webmail.internalname.com External Url: webmail.external.com Current 2010 Exchange use the Selfsign certificate. But this got the above Internal/external domain added. So can i use this self signed for SMTP relay in 2016? currently it is working. But do i need a SSL? Do i need to re run the HCW? I thought we need this server only for SMTP and management? If i need to re run , can i use the self sign in Transport certificate? How do i find current Organizing FQDN configured for?
Christian FlaggPosted Jul 17, 2020, 6:51 AM
We have migrated ALL of our mailboxes to Office 365 and will not have any on premise. We have set up a exchange 2016 just for management and smtp relay. Do I still need to import a cert since no client should be hitting it? Should my ex2016 box internal autodiscover point to Office 365 autodiscover or the existing internal autodiscover? Thanks for putting this article together.
Laurent MorelPosted Jul 14, 2020, 3:39 PM
I am still trying to understand the part about importing the certificate. I believe you said that we just need to include the new FQDN in that certificate them import it. I read in other sites that they seem to export the existing Exchange 2010 certificate then import it on the new Exchange 2016 server. How is that possible and/or do you have any concerns against it?
Admin OnPosted May 26, 2020, 7:27 PM
Can I reuse IP for SMTP relay connector?
Kåre PetersenPosted May 19, 2020, 3:51 AM
Is it possible to decommsion the Exchange 2010 server before adding the Exchange 2016 server? I am asking because we have an Exchange 2010 SP2, and we can?t update it due to the fact that our domain controller are 2019 and domain functional level is 2016.
Jesus SanchezPosted Feb 19, 2020, 9:19 AM
After migrating all mailboxes to office365 with hybrid exchange 2010 on premise server I want point dns to office365 urls not exchange 2010 server but I'm not sure how to do that with hybrid configuration. Can you help me with that? users have outlook 2016 clients.
Simon DuncanPosted Jan 23, 2020, 2:19 AM
After Migrating the mailboxes from 2010 to office 365, the decision to install a 2016 exchange server was made, following the decommissioning of the 2010 and commissioning of the 2016 we can no longer see any of the mailboxes groups resources contacts shared migration, everything is on the cloud, and users can access and use the mailboxes groups etc... the problem we have is that it is not possible to modify the mailboxes email addresses we get the error The operation on mailbox "wxyzl" failed because it's out of the current user's write scope. The action 'Set-Mailbox', 'EmailAddresses', can't be performed on the object 'AdminNational' because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.
max hunterPosted Dec 23, 2019, 4:18 PM
Hi how can we move mailboxes from exchange 2010 (some of the mail boxes are still on exchange 2010)
Carlos CórdovaPosted Nov 18, 2019, 4:56 PM
What about just moving Exchange (already hybrid, same version) to new hardware? Install, move Mailboxes, decomission the old one and run hybrid Wizard from the new one? or are there other things to consider? Regards.