The Exchange 2016 and 2019 ESU ends and your last server needs a plan

This has been coming for a while. Exchange Server 2016 and 2019 left mainstream support in October 2025, and the Extended Security Updates (ESU) period ends for good in April 2026. If the end of ESU for Exchange 2016 and 2019 affects you, you now have a real decision to make. In many of the environments I work in, one last Exchange server has survived, sometimes for recipient management, sometimes only for SMTP relay. That server can't simply keep running anymore. You have to act.

The ESU end leaves Exchange 2016 and 2019 without security updates

This deadline is more than a formality. After April 2026 there will be no further security updates. Even if your remaining Exchange server only handles management, or sits in a role that is supposedly isolated, attackers are still interested in it. I keep running into the assumption that a "minimal" or "management-only" Exchange server is safe to leave alone. It isn't. These servers are being targeted more and more, and once they stop getting patches they become a liability. Treat the ESU end as a hard, final deadline and not as a gentle reminder to start planning.

An in-place upgrade to Exchange Server Subscription Edition bridges the gap

If you still need Exchange for hybrid recipient management or SMTP relay, Microsoft supports an in-place upgrade from Exchange 2019 to Exchange Server Subscription Edition (SE). In my experience it usually goes through without much trouble, as long as the server is patched and meets the prerequisites. If you're still on 2016, you should have moved to 2019 by now at the very least. Keep in mind that SE is a stopgap, not a long-term solution. I've written up what SE means in practice here: Exchange Server Subscription Edition in practice, upgrade and support.

Recipient management only needs the Exchange Management Tools

You no longer need a full Exchange server to manage Exchange Online users, groups and mailboxes. The Exchange Management Tools (PowerShell-only) install on any AD-joined server, with no Exchange roles at all. That shrinks your attack surface considerably, and the constant patching effort goes away. What matters is that you follow the official hybrid offboarding process and remove the last Exchange server cleanly. In real projects this step often gets stuck on old group types, legacy attributes or SMTP relay dependencies nobody remembered. If that's where you are, plan a clean-up and get it done. The effort pays off.

# Install Exchange Recipient Management Tools (on Windows Server, PowerShell 7, domain-joined)
Install-WindowsFeature RSAT-AD-PowerShell
# Download Exchange SE Management Tools setup (latest ISO)
# In the setup wizard: select "Management Tools" only

Pro tip: Once you've moved to the Management Tools, audit Exchange-related AD permissions on a regular basis. Old accounts that still hold Exchange rights turn up in pentest reports all the time.

SMTP relay has to move off Exchange

A lot of last remaining Exchange servers exist only to relay internal SMTP traffic, for example from scanners, applications or system alerts that don't come from users. With ESU ending, that setup needs replacing. Microsoft recommends that you set up SMTP relay via Exchange Online or use a dedicated SMTP gateway appliance. For trusted internal systems, authenticated SMTP in Exchange Online can be an option in some cases. If you go that way, always pair it with strict policies plus logging and monitoring, such as Conditional Access and audit trails.

A full hybrid exit removes the last Exchange server for good

If you can go all the way and remove Exchange completely, good for you, but it needs preparation. All mailboxes, groups and SMTP flows have to be migrated first, and no AD objects may still depend on Exchange attributes or linked mailboxes. Only then can you remove every Exchange component. I've documented the process in detail here: Exchange hybrid vulnerability and the dedicated hybrid app.

The diagram below shows the usual decision paths once ESU has ended. From April 2026 there are no security updates left, so every environment should be heading for one of these outcomes:

flowchart TD
   ESUEnd["ESU end reached"]
   UpgradeSE["Upgrade to SE"]
   MgmtTools["Use Recipient Management Tools"]
   SMTPRelay["Migrate SMTP relay"]
   HybridMinimal["Minimal hybrid server (SE)"]
   RemoveEx["Remove last Exchange server"]
   SMTPAlt["SMTP relay Exchange Online / Appliance"]

   ESUEnd --> UpgradeSE
   UpgradeSE --> HybridMinimal
   HybridMinimal --> MgmtTools
   MgmtTools --> RemoveEx
   ESUEnd --> SMTPRelay
   SMTPRelay --> SMTPAlt
   SMTPAlt --> RemoveEx

Figure: Decision paths after the Exchange 2016/2019 ESU end (upgrade, management tools or exit)

Zombie Exchange servers have no place in your network

I've seen it again and again. The last Exchange server stays online out of habit or "just in case", and later turns up as a security risk or, worse, as an incident. Once ESU for Exchange 2016 and 2019 has ended, running a zombie server like that is simply unsafe. Full exit is often the best option: move SMTP relay, switch to the management tools and then remove every remaining trace of Exchange. If you have to keep hybrid, upgrade to SE and keep working toward the exit anyway. The coming months matter. If you act now, you won't be scrambling the next time a pentest or a zero-day comes along.