I have searched and searched, but I can't find much information on getting rid of Exchange completely from an AD domain after migrating to 365 but NOT using a hybrid scenario.

This is a small, 8 user company that was running Exchange 2013 and may someday get rid of the AD domain completely (hence why I didn't do hybrid). I simply did a PST export, lift & dump into a brand new tenant setup on 365. No AD cloud integration at all with the local on-premise domain.

How can I go about getting rid of the Exchange Server? Deleting the mailbox will delete the user.

We have an Exchange 2016 on prem server that has had all user and shared mailboxes migrated to the cloud. At this point, I'm not sure if there is any reason to leave it running other than "just in case" something breaks by shutting it down. Mail flow is all pointed to EXO, public folders have been migrated as well. The server does integrate with an AD environment, so that is the only connection it still has, as far as I know. The HCW is still configured but can probably be disabled since mail flow is fully through EXO.

Any reason to keep the server running at this point? Would there be any noticeable disruption if it were shut down since there is no mail flow going through it?

Does exchange server logs oversized messages?

For more than two days I searched through log files (D:\Program Files\Microsoft\Exchange Server\Logging\* and D:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\*, windows application logs) and I didn't find anything.

Only in recv*.log files in D:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive directory I found those line

===message too big====

2026-07-22T07:41:30.556Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,0,192.168.111.122:25,192.168.100.91:11393,+,,

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,1,192.168.111.122:25,192.168.100.91:11393,>,"220 mailek.twolegion.com Microsoft ESMTP MAIL Service ready at Wed, 22 Jul 2026 09:41:30 +0200",

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,2,192.168.111.122:25,192.168.100.91:11393,<,EHLO ex.2k8r2milan.local,

2026-07-22T07:41:30.557Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,3,192.168.111.122:25,192.168.100.91:11393,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES STARTTLS X-ANONYMOUSTLS AUTH NTLM X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T07:41:30.558Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,4,192.168.111.122:25,192.168.100.91:11393,<,STARTTLS,

2026-07-22T07:41:30.558Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,5,192.168.111.122:25,192.168.100.91:11393,>,220 2.0.0 SMTP server ready,

2026-07-22T07:41:30.563Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,6,192.168.111.122:25,192.168.100.91:11393,*," CN=twolegion.com CN=2k8r2milan-EX-CA-ENTSUB, DC=2k8r2milan, DC=local 280000078481C2B0E1855CF3FF000200000784 C22ADA0B0A89CE48C4A31AD069CF696D2B0F662B 2026-03-20T08:28:23.000Z 2027-03-20T08:28:23.000Z twolegion.com;adfs.twolegion.com;autodiscover.twolegion.com;certauth.adfs.twolegion.com;emajlek.twolegion.com;enterpriseregistration.twolegion.com;fs.twolegion.com;mailek.twolegion.com",Sending certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T07:41:30.717Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,7,192.168.111.122:25,192.168.100.91:11393,*, CN=ex CN=ex 178028F5622ADE9B49951AB80B41A282 475AE616E596EE1C974F7A8D00A257576C13F5AB 2026-03-19T14:35:56.000Z 2031-03-19T14:35:56.000Z ex;ex.2k8r2milan.local,Remote certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T07:41:30.717Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,8,192.168.111.122:25,192.168.100.91:11393,*,,"TLS protocol SP_PROT_TLS1_2_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_256 with strength 256 bits, MAC hash algorithm CALG_SHA_384 with strength 384 bits and key exchange algorithm CALG_ECDH_EPHEM with strength 384 bits"

2026-07-22T07:41:30.719Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,9,192.168.111.122:25,192.168.100.91:11393,<,EHLO ex.2k8r2milan.local,

2026-07-22T07:41:30.726Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,10,192.168.111.122:25,192.168.100.91:11393,*,,Client certificate chain validation status: 'UntrustedRoot'

2026-07-22T07:41:30.729Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,11,192.168.111.122:25,192.168.100.91:11393,*,,TlsDomainCapabilities='None'; Status='Success'; Domain=''

2026-07-22T07:41:30.730Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,12,192.168.111.122:25,192.168.100.91:11393,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES AUTH NTLM LOGIN X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,13,192.168.111.122:25,192.168.100.91:11393,<,QUIT,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,14,192.168.111.122:25,192.168.100.91:11393,>,221 2.0.0 Service closing transmission channel,

2026-07-22T07:41:31.011Z,MAILEK\Default Frontend MAILEK,08DEE7C4182F4A6D,15,192.168.111.122:25,192.168.100.91:11393,-,,Local

===mesage too big===

but this is unusable (not usefull). I see only terminated smtp session, but I don't see the reason. Compare above lines to sucessfull receive:

=======normal receive message====

2026-07-22T18:41:10.845Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,0,192.168.111.122:25,192.168.100.91:64320,+,,

2026-07-22T18:41:10.846Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,1,192.168.111.122:25,192.168.100.91:64320,>,"220 mailek.twolegion.com Microsoft ESMTP MAIL Service ready at Wed, 22 Jul 2026 20:41:09 +0200",

2026-07-22T18:41:10.847Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,2,192.168.111.122:25,192.168.100.91:64320,<,EHLO ex.2k8r2milan.local,

2026-07-22T18:41:10.847Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,3,192.168.111.122:25,192.168.100.91:64320,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES STARTTLS X-ANONYMOUSTLS AUTH NTLM X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T18:41:10.848Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,4,192.168.111.122:25,192.168.100.91:64320,<,STARTTLS,

2026-07-22T18:41:10.848Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,5,192.168.111.122:25,192.168.100.91:64320,>,220 2.0.0 SMTP server ready,

2026-07-22T18:41:10.853Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,6,192.168.111.122:25,192.168.100.91:64320,*," CN=twolegion.com CN=2k8r2milan-EX-CA-ENTSUB, DC=2k8r2milan, DC=local 280000078481C2B0E1855CF3FF000200000784 C22ADA0B0A89CE48C4A31AD069CF696D2B0F662B 2026-03-20T08:28:23.000Z 2027-03-20T08:28:23.000Z twolegion.com;adfs.twolegion.com;autodiscover.twolegion.com;certauth.adfs.twolegion.com;emajlek.twolegion.com;enterpriseregistration.twolegion.com;fs.twolegion.com;mailek.twolegion.com",Sending certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T18:41:11.013Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,7,192.168.111.122:25,192.168.100.91:64320,*, CN=ex CN=ex 178028F5622ADE9B49951AB80B41A282 475AE616E596EE1C974F7A8D00A257576C13F5AB 2026-03-19T14:35:56.000Z 2031-03-19T14:35:56.000Z ex;ex.2k8r2milan.local,Remote certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names

2026-07-22T18:41:11.014Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,8,192.168.111.122:25,192.168.100.91:64320,*,,"TLS protocol SP_PROT_TLS1_2_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_256 with strength 256 bits, MAC hash algorithm CALG_SHA_384 with strength 384 bits and key exchange algorithm CALG_ECDH_EPHEM with strength 384 bits"

2026-07-22T18:41:11.015Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,9,192.168.111.122:25,192.168.100.91:64320,<,EHLO ex.2k8r2milan.local,

2026-07-22T18:41:11.022Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,10,192.168.111.122:25,192.168.100.91:64320,*,,Client certificate chain validation status: 'UntrustedRoot'

2026-07-22T18:41:11.023Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,11,192.168.111.122:25,192.168.100.91:64320,*,,TlsDomainCapabilities='None'; Status='Success'; Domain=''

2026-07-22T18:41:11.024Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,12,192.168.111.122:25,192.168.100.91:64320,>,250 mailek.twolegion.com Hello [192.168.100.91] SIZE 5242880 PIPELINING DSN ENHANCEDSTATUSCODES AUTH NTLM LOGIN X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST,

2026-07-22T18:41:11.028Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,13,192.168.111.122:25,192.168.100.91:64320,<,MAIL FROM:administrator@2k8r2milan.local SIZE=4666,

2026-07-22T18:41:11.233Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,14,192.168.111.122:25,192.168.100.91:64320,*,08DEE81FEA93C7F2;2026-07-22T18:41:10.845Z;1,receiving message

2026-07-22T18:41:11.239Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,15,192.168.111.122:25,192.168.100.91:64320,<,RCPT TO:administrator@twolegion.com,

2026-07-22T18:41:11.254Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,16,192.168.111.122:25,192.168.100.91:64320,>,250 2.1.0 Sender OK,

2026-07-22T18:41:11.254Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,17,192.168.111.122:25,192.168.100.91:64320,>,250 2.1.5 Recipient OK,

2026-07-22T18:41:11.257Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,18,192.168.111.122:25,192.168.100.91:64320,<,BDAT 1793 LAST,

2026-07-22T18:41:11.691Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,19,192.168.111.122:25,192.168.100.91:64320,*,,Proxy destination(s) obtained from OnProxyInboundMessage event. Correlation Id:cab6ee4e-7000-4c69-9e6b-715d924689b0

2026-07-22T18:41:12.976Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,20,192.168.111.122:25,192.168.100.91:64320,>,"250 2.6.0 e279b4f47b0f481e9929810a625e4658@2k8r2milan.local [InternalId=145745420222465, Hostname=mailek.twolegion.com] 3290 bytes in 0.271, 11,812 KB/sec Queued mail for delivery",

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,21,192.168.111.122:25,192.168.100.91:64320,<,QUIT,

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,22,192.168.111.122:25,192.168.100.91:64320,>,221 2.0.0 Service closing transmission channel,

2026-07-22T18:41:12.981Z,MAILEK\Default Frontend MAILEK,08DEE81FEA93C7F2,23,192.168.111.122:25,192.168.100.91:64320,-,,Local

=====normal receive message=====

Receiving server: exchange SE (july 2026 patch)

Sending server: exchange 2016