Exchange Server end of support: what to do with on-prem email archives

What Exchange Server end of support changes for on-prem mail#

Exchange Server end of support means Microsoft no longer provides security updates, bug fixes or technical help for the affected versions, which include Exchange Server 2016 and 2019. The servers keep delivering mail, which is exactly why they linger: nothing breaks on the day support ends, but every new vulnerability stays open.

Most manufacturers take one of three paths: move mailboxes to Exchange Online, move to the Subscription Edition of Exchange Server where mail must stay on premises, or retire the server once its contents are exported. Many end up with a leftover, an on-prem server kept alive only because it still holds old mailboxes, a journal or public folders.

That leftover server is the real decision point. It holds years of email nobody migrated, and it is often the only copy.

What old mail stores hold in a manufacturing company#

Old mail stores in a manufacturing company hold the conversations behind quotes, orders, quality problems and supplier delays. The ERP records that an order shipped late; the email thread records why, who was told and what was offered to keep the customer.

• 1Shared mailboxes for RFQs, order entry, purchasing and customer service.
• 2Quality mailboxes with customer complaints, corrective action requests and supplier quality escalations.
• 3Mailboxes of departed employees, often left as disabled accounts or converted to shared mailboxes.
• 4Journaling mailboxes that capture a copy of all mail for compliance.
• 5Public folders that teams used years ago as filing cabinets.
• 6PST files on file shares, laptops and old backup media.

Why PST files need their own plan#

PST files need their own plan because they live outside the server and outside most retention controls. Mailbox databases can be exported in an orderly way; PST files are scattered, duplicated and often unknown to IT until a laptop is reimaged or a file share is cleaned out.

Search file shares, home drives and backup media for PST files, log their location and owner, and decide each one under the retention schedule. Collecting them centrally before the Exchange project ends avoids a second, messier cleanup later.

Checklist before you delete an old mail store#

A deletion checklist for an old Exchange mail store keeps every option open until the server is switched off. Work through it in order and keep a dated record of each step.

• 1Inventory every database, mailbox, journal, archive mailbox and public folder on the server, with owners and date ranges.
• 2Ask counsel whether any litigation hold, investigation or regulatory request covers the mail.
• 3Export each mail store to a durable format, record item counts and hashes, and test that the exports open.
• 4Store exports on encrypted, access-controlled storage with a named custodian.
• 5Apply the retention schedule: what must be kept, for how long and what may be destroyed.
• 6Run a metadata-only assessment of shared operational mailboxes before any of them are destroyed.
• 7Decommission the server with sign-off from IT, legal and the business owner.

Migrate, archive or delete: deciding mailbox by mailbox#

The migrate, archive or delete decision is easier to make mailbox by mailbox than server by server. Each mailbox type has a usual path, and the exceptions are what counsel and the business owner need to see.

The assessment step in the checklist needs no mail content, only mailbox names, departments, date ranges and rough volumes. It can run in parallel with the retention decision, so it rarely delays decommissioning.

Retention, legal holds and privacy before any reuse#

Retention and legal holds come before any reuse of old email, because a hold or a records requirement overrides every business plan for the mail. Counsel confirms holds and the retention schedule decides what is kept; only then does licensing enter the discussion.

Email carries more personal and confidential content than structured systems: personal messages, HR matters, customer contacts and pasted pricing. Privacy laws such as the CCPA may apply depending on who appears in the mail and where they live, and that is assessed deal by deal with counsel. Customer drawings and specifications attached to messages, and anything tied to export-controlled work, are excluded.

Automated de-identification helps but does not finish the job. Presidio, an open-source toolkit for finding and anonymizing personal information in text and images, states in its own documentation that it cannot guarantee it will find all sensitive information and that additional protections should be used. Plan for human review of samples.

Illustrative: a plastics molder retiring its last Exchange server#

Illustrative: a fictional injection molding company moved its users to Exchange Online years ago but kept one on-prem Exchange 2016 server for a journaling mailbox, departed staff mailboxes and shared mailboxes for RFQs, purchasing and quality. End of support finally forces a decision.

The IT director exports every store, records counts and hashes, and confirms with counsel that no hold applies. Departed staff mailboxes go into retention storage only. The RFQ and quality mailboxes are assessed on metadata: years covered, departments, rough volume and how often threads reference job numbers and corrective action requests.

The quality mailbox is scoped for a de-identification review, with customer drawings and one defense program's threads excluded. The RFQ mailbox is held for a later decision. The server is decommissioned once IT, legal and the COO sign off.

How SourceX looks at legacy Exchange archives#

SourceX looks at legacy Exchange archives for operational threads rather than personal correspondence. The fit check asks for metadata only, such as mailbox types, departments, date ranges and the systems the mail refers to; no mail is shared during the initial assessment.

Packages that proceed follow the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization, and the manufacturer approves each step. Large archives stay in the company's own storage or ship on encrypted drives.