Skip to main content

Check if you have users with both mailboxes on-prem and online

An Exchange Online license was applied to the user before the Exchange GUID got synchronized from on-premises Active Directory. For synchronized accounts, having the Exchange GUID synchronized from on-premises is used to tell Exchange Online that the mailbox hasn’t been migrated yet, and is what allows customers to pre-license accounts prior to migration.
 From: My user has a mailbox both on-premises and in Exchange Online.

So, in my case many times we get into situation where license is applied before Exchange GUID is synchronized to O365. I am using this script to check whether user has two mailboxes. Script closes Exchange session BEFORE it opens connection to Exchange Online as both use same commands. You can use Get-Mailbox both on-prem and Online, therefore it is crucial to close connection before you open other.

# This code is provided "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
# Use at your own risk
# Use "install-module ExchangeOnlineManagement" if module is not yet installed 
# Use "import-module ExchangeOnline" to import it to session

# Connect to the on-premises Exchange server using remote PowerShell
$onPremisesExchangeServer = ""
$onPremisesSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$onPremisesExchangeServer/PowerShell/ -Credential
Import-PSSession $onPremisesSession
$OnPremisesMailboxes = Get-Mailbox -server $onPremisesExchangeServer -ResultSize unlimited -RecipientType UserMailbox -Filter {ExchangeGUID -ne $null}
# Disconnect the remote PowerShell session to the on-premises Exchange server
Remove-PSSession $onPremisesSession
# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName
# Initialize an array to store the users with both an on-premises and an Office 365 mailbox
$usersWithBothMailboxes = @()
# Loop through all mailboxes to check if any user has both an on-premises and an Office 365 mailbox
foreach ($OnPremisesMailbox in $OnPremisesMailboxes) {
    $userIdentity = $OnPremisesMailbox.UserPrincipalName
    $Office365Mailbox = Get-EXOMailbox -Identity $userIdentity -ErrorAction SilentlyContinue
    # Check if the user has both a mailbox in Office 365 and a mailbox on-premises that is not remote
    if ($Office365Mailbox -ne $null) {
        Write-Host -BackgroundColor DarkRed -ForegroundColor White "User $userIdentity has both an on-premises and Office 365 mailbox"
        $usersWithBothMailboxes += $userIdentity
# Check if any users were found with both an on-premises and an Office 365 mailbox
if ($usersWithBothMailboxes.Count -eq 0) {
    Write-Host -BackgroundColor Green -ForegroundColor White "There are no users with both on-premises and Office 365 mailboxes"
# Disconnect from Exchange Online PowerShell
Disconnect-ExchangeOnline -Confirm:$false



Popular posts from this blog

Netscaler vs Exchange 2019 "time out during ssl handshake stage

If you are using Citrix Netscaler as load balancer in front of Exchange 2019 server you must know this: Microsoft Exchange 2019 is secured by default and allows only TLS 1.2. Therefore default schannel settings are as follows (using IISCrypto tool from Nartac Software): While Citrix Netscaler offers following Cipher Suites: TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 TLS_DH_anon_WITH_DES_CBC_SHA TLS_DH_anon_WITH_AES_128_CBC_SHA TLS_DH_anon_WITH_AES_256_CBC_SHA TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA Now, you will fi

Reason: [{LED=250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded};{MSG=};{FQDN=};{IP=};{LRT=}]

 If you got this error checking the mail flow for a distribution group, it means the distribution group is closed and only internal senders can send e-mail to this group. When outside user sends e-mail to this group you get  Reason: [{LED=250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded};{MSG=};{FQDN=};{IP=};{LRT=}] Set Delivery for this group to internal and external users and your problem will be solved. 

Ports that need to be open on Firewall for Edge Transport servers

Ports that need to be open on firewall for Edge Server subscription with Hub Server to function properly: For Inbound traffic: SMTP - TCP port 25 (from Internet) SMTP - TCP port 25 (from Edge server to Hub server on internal network) For Outbound traffic: SMTP - TCP/UDP port 25 (from Edge to Internet) SMTP - TCP/UDP port 25 (from Hub to Edge server) LDAP for EdgeSync - TCP port 50389 (from Hub to Edge server) Secure LDAP for EdgeSync - TCP port 50636 (from Hub to Edge server) Since Edge server needs to communicate with Hub server it is important that it can resolve Hub transport servers by FQDN and Hub transport servers must be able to resolve Edge servers by its FQDNs. To accomplish this you need to either open 53 (DNS) port and configure internal network adapter to use internal DNS but as a security precaution I would suggest to enter DNS records for Edge servers on local DNS manually and to fill hosts file on Edge servers with FQDNs for Hub transport servers.