How to prevent Autodiscover to on-premises Exchange

autodiscoverexchangeexchange-2010microsoft-office-365

We have migrated a client from @example.co.uk and on-premises Exchange Server 2010 to @example.com and Office 365.

We are keeping the old Exchange server running for the time being in case any further data needs to be migrated.

We need to prevent AD domain-connected PCs' email apps (Microsoft Outlook, etc) from Autodiscovering to the old Exchange server. Thus far, I have done the following which hasn't worked:

  1. Used EMS to set the CAS' Autodiscover service internal URI to null.
  2. Used ADSI Edit to delete CN=%Exchange server hostname%,CN=Autodiscover,CN=Protocols,CN=%Exchange server hostname%,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=%AD DS NetBIOS domain name%,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=%AD DS DNS middle-level domain name%,DC=%AD DS DNS top-level domain name%.
  3. Used AD UC to reconfigure an AD user account clearing the attributes homeMDB and homeMTA

Ideally, I don't want to:

  1. Disable the Exchange Windows services.
  2. Disable the Exchange user mailboxes.
  3. Create registry entries defining the Autodiscover behavior (excluding SCP lookup, etc) on the clients.
  4. Delete the IIS virtual directories.

What has to be done to achieve this?

Best Answer

Option 1:

There are multiple "configuration" options which you can perform which depends on your environment and on your clients (e.g. MS Office for MAC or Windows).

For example if you wish to disable the AutoDiscovery on a MAC you can follow the howto here.

On windows you can finetune autodiscovery via:

  • PreferLocalXML
  • ExcludeHttpRedirect
  • ExcludeHttpsAutodiscoverDomain
  • ExcludeHttpsRootDomain
  • ExcludeScpLookup
  • ExcludeSrvRecord
  • ExcludeLastKnownGoodURL (only applies to Outlook 2010 version 14.0.7140.5001 and later versions)
  • ExcludeExplicitO365Endpoint (only applies to Outlook 2016 version 16.0.6741.2017 and later versions)

Conclusion:

I think "ExcludeScpLookup" is what you need here at least for Microsoft Office for Windows. You can find more infos here for the finetuning if needed.

Option 2 (but wouldn´t be a good one in my eyes):

You might try to point the internal autodiscovery settings to Exchange Online, you only need to adjust the following so that it fits your config:

Set-ClientAccessService -Identity "exch01" -AutoDiscoverServiceInternalUri "https://mbx01.contoso.com/autodiscover/autodiscover.xml"

and

Set-AutodiscoverVirtualDirectory -Identity "exch01\Autodiscover (Default Web Site)" -InternalUrl https://excashlb.int.contoso.com/autodiscover/autodiscover.xml -ExternalUrl https://oaw.contoso.com/autodiscover/autodiscover.xml

Then you might need to wait until it is replicated in your environment.

Related Topic