Some questions preparing Exchange 2 Grommunio migration

Rene

I've got some question for the forum members that already have done the exchange -> grommunio migration.

So I've been reading the forums, the documentation and searching for other sources to find some answers but I still haven't found the information i'm looking for.

Currently I've got a home setup with AD and Exchange for 8 family members and around 5 mail enabled service accounts. I don't like the Microsoft move to a subscription Edition, and I certainly don't want to move to Exchange Online, so I've installed the Grommunio appliance on an ESXi host ( which also need to move over to Proxmox in the foreseeable future). This will be a test case for a small company migration of around 30 accounts, with some HUGE mailboxes.

I've already set up the appliance, and moved some test accounts with the Exchange2Grommunio script, which works after some minor modifications.

The first question is if after the initial import of the Exchange users, can we disable the LDAP sync, but keep AD authentication enabled? Is that simply setting the radio button for 'only LDAP authentication' on the LDAP configuration page?

If we cannot disable the sync of user properties then how did you remove the mailboxes from exchange without removing the email addresses and proxy addresses from AD? Or did you re-add that info back into AD after disabling the user mailbox?

How do you manage the proxy addresses / alias's for your domain users, do you manually update the users mail detail in AD for every change/ alias change? or did you 'decouple' the user from AD once migrated, and manage it via the Grommunio alias page?

I know i can work around this by using a powershell script for the various actions to add/change the AD properties, but I think the developers had some vision on how to manage this situation, and I just haven't seen the right way yet.

So I'm curious on how the forum members who have done the exchange migration are handling these day to day operations.

p.s. I'm Dutch, and my German reading is ok, writing not;-)

Norbert

Hello Rene,

at the end of a migration, the Exchange must also be uninstalled cleanly. This also removes all e-mail information of the users in AD!

I don't know how this information could be retained when Exchange is uninstalled!

So I document the e-mail addresses and groups at the beginning of a migration (EX to grom)

Get-Mailbox | fl name,EmailAddresses >c:\mailbox.txt
Get-DistributionGroup | fl displayname,EmailAddresses > c:\group.txt
Get-MailPublicFolder | fl displayname, EmailAddresses > c:\PublicFolder.txt

and create them again in grommunio or complete the users afterwards, if email addresses have been lost in grommunio due to LDAP synchronization

With LDAP I only see the possible advantage of a realizable SSO, otherwise I now prefer a clean separation between AD and grom. This means that I operate the e-mail system with separate user names and passwords because grom is hosted separately.

If the default e-mail address is to be used again for each user in AD, this could be set with PowerShell.

Hope this information helps you.

Translated with DeepL.com (free version)

WalterH

Norbert at the end of a migration, the Exchange must also be uninstalled cleanly.

It is enough to switch off the Exchange server, so you leave all e-mail information in AD.

Rene

Norbert

thanks for your thoughts on this Norbert. I'm indeed thinking on just repopulating the AD properties from the previously exported info just to be able to keep the LDAP as the authentication source (I'm also using LDAP auth for a NextCloud appliance).
It would have been nice to keep the authentication from LDAP while configuring the mail properties from Grommunio, but even clearing out the alias's LDAP template property clears out the SMTP aliasses on the next sync.

@WalterH , I don't think just shutting down the Exchange server is the 'proper' or best way to decommission an Exchange Server. Without the deinstallation all the other Exchange objects, groups, system mailboxes (users) etc still remain in your AD.
I think having all those remnants in your AD - possibly preventing schema updates or future installations- is worse than using a script to extract the info and later re-add that info to your users.