Exchange Migration 2010 to 2016 to online

[mthomas08]

Apologies, I know there are other threads but not quite matching what we're doing or the issue we currently face.

 

Long story short: We're on Exchange 2010 and installed a 2nd Exchange 2016 server for a hybrid migration. After a lot of steps and all sorts of issues, it is progressing nicely for the summer.

 

So the issue right now - using the hybrid wizard, it now sits

 

Looking through the EAC it shows an error when trying to manually modify the share domain. Connection closed - this to me says we need our broadband provider to enable the microsoft exchange domains (outlook / our domain.onmicrosoft) and some IPs listed here: https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#bkmk_exo&preserve-view=true

 

During the full hybrid wizard config we get up to the DNS part - our provider added our TXT record - we stopped getting an error. Now it just sits there "Adding federated domain".

 

Just wondering if anyone has an idea? I don't fancy asking them to add that long list of IPs - unless it just needs our domainname.onmicrosoft.com ??

 

And yes I know.. exchange 2010 - all my fault for putting so much on hold. We plan on putting everything over to 2016 and migrating online - I am trying to make sure we are in full prep so things can 'just go'.

 

Thank you!

[Jawloms]

I'm not sure it will help overall, but I went from Exchange 2010 to M365 at Easter using the hybrid stuff, didn't need 2016.

 

Sorry, but I'm unsure why it stalls at "Adding federated domain". So long as you've done the TXT record and port 443 is open to your onsite Exchange, it should talk I thought.

[HPlum78]

Whats in the HCW logs?

 

%appdata%\Microsoft\Exchange Hybrid Configuration

[mthomas08]

It is the same error I get within the EAC in Organisation.

 

The research I've gone through gave all sorts of ideas:

Disabling TLS 1.0 through regedit.

Manually creating it within EAC.

Fully updated (the error apparently got fixed in update 7).

Creating a INI file with some exchange powershell text.

 

None of it worked.

 

If it's one of those things that won't go away until we migrate everything over and switch to this 2016 - I'll have to accept. But hoping we can at least get as much done as possible before the go go.

 

Thank you!

 

[Client=UX, Activity=Domain Ownership, Session=OnPremises, Cmdlet=Set-FederatedOrganizationIdentifier, Thread=21]

FINISH Time=517.3ms Results=PowerShell failed to invoke 'Set-FederatedOrganizationIdentifier': An error occurred while attempting to provision Exchange to the Partner STS. Detailed Information "An error occurred accessing Windows Live. Detailed information: "The underlying connection was closed: An unexpected error occurred on a send.".". {CategoryInfo={Activity=[system.String] Set-FederatedOrganizationIdentifier,Category=[system.Management.Automation.ErrorCategory] InvalidResult,Reason=[system.String] ProvisioningFederatedExchangeException,TargetName=[system.String] ,TargetType=[system.String] },ErrorDetails=,Exception=[system.Management.Automation.RemoteException] An error occurred while attempting to provision Exchange to the Partner STS. Detailed Information "An error occurred accessing Windows Live. Detailed information: "The underlying connection was c

losed: An unexpected error occurred on a send.".".,FullyQualifiedErrorId=[system.String] [server=XXXXXXXX,RequestId=83aac2e7-be29-4fa2-89a4-1e4ed1c7df81,TimeStamp=6/26/2024 11:24:56 AM] [FailureCategory=Cmdlet-ProvisioningFederatedExchangeException] 5B0E61D1,Microsoft.Exchange.Management.SystemConfigurationTasks.SetFederatedOrganizationIdentifier}

2024.06.26 11:24:56.608 *ERROR* 10224 [Client=UX, Page=DomainProof, Thread=21]

[Jawloms]

Does your server support TLS 1.2?

[howartp]

Have you any geoblocking in place?

 

We migrated (hybrid) to 365 earlier this year having banged my head for ages - one of the commands in the hybrid wizard was talking to a server we had geoblocked.

 

Peter

[mthomas08]

We have no geoblocking in place.

 

TLS enabled for 1.2 and disabled 1.1 and 1.0.

 

Unless I need to configure Azure.

Edited June 27, 2024 by mthomas08

[Jawloms]

We have no geoblocking in place.

 

As for TLS, you have given me an idea - TLS is tied to .net packages?? I will double check 1.2 and .net.

 

https://testtls.com/ will tell you.

[mthomas08]

https://testtls.com/ will tell you.

 

Ah, maybe this is the issue I have - the external IP doesn't exist yet. The external mail IP is pointing to our main server not the 2nd one.

The main server is still the main transport protocols and connectors etc. I've simply built a 2nd exchange with all the usual mailbox settings etc.

[Jawloms]

If by "main one" you mean your original 2010 server, so long as you can get tls 1.2 working on it, you can hybrid that and migrate up to M365. Unless you've already started moving over to 2016?

[HPlum78]

https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-set-up-hybrid-deployment

 

The above outlines what maybe the issue and if so you are calling MS on it....

here is a load of helpful info on HCW failures that may also help:

https://techcommunity.microsoft.com/t5/exchange-team-blog/how-to-address-federation-trust-issues-in-hybrid-configuration/ba-p/1144285

[mthomas08]

https://learn.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-set-up-hybrid-deployment

 

The above outlines what maybe the issue and if so you are calling MS on it....

here is a load of helpful info on HCW failures that may also help:

https://techcommunity.microsoft.com/t5/exchange-team-blog/how-to-address-federation-trust-issues-in-hybrid-configuration/ba-p/1144285

 

This was going to be my next step.

 

As for migrating exchange 2010 to online, this had issues on every attempt I made to get things going. Read through all the documentation and what others attempted etc (had all sorts of other issues).

Already got the exchange 2016 setup and connected, have only migrated test accounts - so I could try another 2010 > 365 again.

Edited June 27, 2024 by mthomas08

[mthomas08]

Think the issue must be down to the connection.

 

Migration using the endpoint M365 now giving a network error after entering the FQDN (research indicates connection closed).

Same error during the Hybrid Wizard within the log and error appears in the federation trust creating it manually.

 

Possible broadband provider adding these? I don't fancy asking that long list of IPs to be added. I'm thinking something on the firewall is blocking the connection between our servers and M365.

 

https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#exchange-online

[chaplic]

To be in hybrid the following are required, off the top of my head

 

 

1) Externally autodiscover to be pointing at your Exhange 2016 box

2) Exchange 2016 box to be accepting https connections from big microsoft range for free busy lookups and similar org relationship stiff

3) exchange 2016 box to accept incoming smtp port 25 connection form big MS ip ranges to route mail between O365 and on prem

4) exhange 2016 box to sent email to big o365 ip ranges

5) exchange 2016 box to be able to connect to ms IP ranges on https for free busy lookup and similar.

 

some firewalls dont flatly deny the connection but helpfully show message which is confusing when troubleshooting.

[mthomas08]

To be in hybrid the following are required, off the top of my head

 

 

1) Externally autodiscover to be pointing at your Exhange 2016 box

2) Exchange 2016 box to be accepting https connections from big microsoft range for free busy lookups and similar org relationship stiff

3) exchange 2016 box to accept incoming smtp port 25 connection form big MS ip ranges to route mail between O365 and on prem

4) exhange 2016 box to sent email to big o365 ip ranges

5) exchange 2016 box to be able to connect to ms IP ranges on https for free busy lookup and similar.

 

some firewalls dont flatly deny the connection but helpfully show message which is confusing when troubleshooting.

 

Thank you, this actually makes sense and likely the issue.