How to remove multiple users from a dynamic distribution group in exchange 2010

You can exclude a specific user from a DD group with the Set-DynamicDistributionGroup commandlet. Specifically with the -RecipientFilter option.

Example: Set-DynamicDistributionGroup -Identity MadeUpName -RecipientFilter {((RecipientType -eq 'UserMailbox') -and -not(Name -like 'Journal User'))}

Note that this example is just with recipient type = userMailbox. You can get the current recipientFilter of your DD group and modify it however from powershell.

(get-DynamicDistributionGroup -Identity MadeUpName).RecipientFilter

I'd use a POP3 connector. Here's how I'd do it:

1. Setup the accepted domain as an Internal relay in Exchange. This will allow Exchange to deliver messages to itself when the mailbox exists and forward them when it doesn't.

2. Migrate users in batches. Reset their POP3 passwords to whatever suits you (because they won't need them after the migration). Create an Exchange mailbox for these users then setup the POP3 connector on the server (you could set it up in Outlook but I believe this adds unnecessary complexity). Migrate users 1 department at a time or 1 manageable batch at a time. After setting up their Exchange profile, import their PST back into Exchange. You may take as long as you want to do this as impact is minimal.

3. When all users have been migrated, change the domain type to authoritative and move the MX records to point to your anti-spam solution (Your appliance, or better yet, a cloud solution). Wait 48 hours then remove the POP3 connectors.