chaplic

For an extra gold star, review those same attribtues to say if AADC has updated them ;-) BTW just noticed you're in suffolk, howdy neighbour

The scary stuff you have seen will likely be accurate. If you a) license the account b) delete all the MsExch* attributes from the AD account (take a note of them), it will create a new mailbox in the cloud, after a couple of syncs. MsExchangeRemoteRecipientType and a few other attributes define where the mailbox is hence why this should work. BTW M365 can still see your on prem stuff as it's all synced via AD in terms of user config

Ive done this on three and bit times (once for a firm swallowing its previously arms-length companies, once three companies into one, once for a major pharmacy and their us partner, then reversing that migration half way through - not due to tech I hasten to add…) The stated desired outcome is the right one. MS has made some advances recently with tenant sharing but its still far from seamless. And economies of scale on management is a payoff too. It is a tough piece of work. The best and gold-plated outcome would be azure-ad joined machines, intune managed and using sharepoint against a single tenant. If you dig into the requirement the desire is for easy collaboration, so I would consider keeping all AD domains as-is (with trusts everywhere) but all using a single O365 tenant. You get most of the collab benefits can have the single email address and over time consolidate the desktop estate to being azure ad managed and new user accounts from a single source. I did this approach for the big firm swallowing the little ones; for the second piece of work they started doing a gold plated version roughly at the same time and despite being 20 times smaller had not got anwywhere near the end goal. At the very least Id suggest you need bought-in expertise on how to do it (so a design and early life implementation) as I just cannot see how you’d have the ‘head time’ never mind actual time. Rollout of it is a bit cookie cutter after a while, so can be distrubuted across teams u o

My recommendation would be "I woudn't start from here". Lets assuming you can fight through all the O365 settings stopping this from working you might run into your source IP is prohibited from sending SMTP as well. Using Graph API to send the mail would be much more future proof and portable.

Pop up a command prompt running as system, go into regedit and see if that key is present.

So you're looking in hkey_current_user, but what account is the install /detection running as - system?

I do lots of infrastructure migrations, fileservers and the like. Always someone says "ooh wouldn't it be good to ask users to tidy up". Always I push back saying it's a bad idea, users who do bother will spend a age deleting tiny files we dont care about. ​Alwayes​ someone conspires to lose a file and it's IT fault I ​If you really do need to save space, as an admin find stuff that's large and low risk, OST files on the network. TempBackup.bkf etc. But to your bigger point, sharepoint is terrible at doing things in bulk with lots of files. I'm currently one week into dealing with an issue where edge managed to create 1.4 million shortcuts into a document library that's used for desktop and it's a flipping nightmare. If your license allows for it, turning on retention policies can be handy, albeit doesnt help with volume.

Is your on prem boxes on the very latest patch levels? I have a memory about MS starting to deliberately delay messages from on prem if the sending servers weren't the latest version A good google showed nothing, but the whisky I had last night wasn't THAT strong..

from memory If you take All the proxy addresses with you, especially the x500: addresses and also port the LegacyExchangeDN to an x500 I think it's ok..

Yeah if you’re doing some magic so password is the same in both domains, should end up the same. Test test test, of course and the only thing I can think of is you might need to revoke tokens for the user, forcing them to login again (or just wait a while) How are you squaring off Group and DLs?

So it’s either your DNS was having a lie down at precisely that moment or MS were having issues. This strikes me as ‘ignore unless it happens again’ type problem

Done roughly this for a few hundred accounts. Being pedantic ms-ds-consistencyguid being the same ​ is what’s important. You might need to consider MsExchMailboxGUID as well. I would also add user_ to the on the source AD to immediately stop the account being syncd from the old domain before you do stuff. Interesting you have same UPN in both forests. Also be aware the person will have to use their new passsword, assuming both old and new also use password hash sync

Were the newsletters sent from O365 not a dedicated service?

Disk2VHD does it well, and you dont even need to power off the VM. i cant remember if your OS has VM extensions built in which my be a headache but it will work.

You see to be saying you're time short, but minded to do the most time consuming possible approach (greenfield everything). A fresh, clean start sounds appealing with a promise of a wonderful future but it rarely works out like that. I back the approach of Jmak and others both as being the least amount of time and lowest impact/ highest quality approach.

FWIW I was asked to be an expert witness at a tribunal of someone sacked for causing (what sounds like) the problem you have. I refused, partially because I know enough, but also know enough to know I wouldn’t consider myself an expert (and, frankly could have done exactly what that poor guy did). So yeah I agree with the masses, feels like a lower-level physical/ looping type problem 100% not cert/ dns, thats layer 7 and this is much lower. On a lan it should be very rare lots of pings are being dropped so its either due to dodgy cabling, the network being busy or just something bonkers. Could be a NIC in something going nuts and screaming electrical noise everywhere. Divide, simplify and conquer.

Exchange on prem doesnt really have an understanding of Office365 mailboxes, there's no system where it's reaching out to Office365 querying if if there's a mailbox present. Instead, it's looking at AD values like MsExchRecipientDisplayType and MsExchRemoteRecipientType for that AD Account. I am guessing MsExchRemoteRecipientType is 4 which would represent a normal mailbox, migrated to O365 Also guessing, was the mailbox migrated to O365 (licensed) then decomissioned/de-licensed? This would cause AD to be updated, thus Exchange server but a sebsequent de-licensing would not show as no O365 mailbox in Exchange server

Is your old IP Address listed in your SPF record? Looksee at SPF Check & SPF Lookup - Sender Policy Framework (SPF) - MxToolBox

Receive connectors are used where you want to tell Office365 something special about the sending party, so for example to allow SMTP relay Conditional Access doesnt apply to SMTP so none of that applies (unless you were using authentication on prem to send as a user)

Is your old IP address in your SPF record and not the new one?

Ive used DHCPServer.DE for DHCP and DNS, it also provides a simple web server which at one point I used for hosting a proxy.pac. I found one bug in it years ago that the developer fixed and it's been utterly flawless otherwise in years. I had a DNS zone called proxy.pac with an entry called pac, pointing at the IP of the server hosting the DHCP server. So clients try to resolve pac.proxy.pac and if the server is down connect to the other DNS server and get a IP of that machines thats up.

The 300 seat requirement is related to the fact the hardware required to achieve this is considerable. I’ve used it to summarise meetings and take notes and it’s excellent, albeit with a dry sense of humour. You could imagine a teacher using it to make notes from a teaching session

Did this to the school I look after just before covid (completely serverless, everything in cloud) it's a small primary. works best for 1:1 stuff, I think you're suitably resilient network connectivity wise already, if you don't have internet connectivity most stuff these days will be useless no matter how much on prem stuff you've got. getting the basics working with intune and autopilot is pretty straightforward, and the in-box policies now are much more flexible than they used-to-be but I'd suggest you need to be comfortable crafting powershell scripts to get the look and feel just like you want it.

Not sure why youd need a new server to support windows 11, but in any case as others have said Entra ID and Intune, and licensing is decent value for schools. The learning curve is high but once you get there its plain sailing and opens up more opportunities. Do Not touch SCCM. It’s yesterdays tech, complex and has little benefits. You can actually deploy 3rd party software via WSUS if you’re feeling adventurous, and to that end basic MSI deployment is built into AD, but both approaches would be a step backwards compared to a proper tool.

Rather than a login script how about attaching to a scheduled task when a change of network is detected? but overall I'd agree with others to find a way to actually allow users to have the functionality.