Exchange Server skills are learned on servers, not in slides. Plenty of organisations still run Exchange on-premises or in hybrid, and someone has to keep it healthy. This path takes you from an empty lab to confident troubleshooting in about twelve weeks, with Microsoft's documentation as the textbook and this site's Exchange Server articles as the workbook.
Who this path is for#
- Windows Server or Microsoft 365 admins who've inherited Exchange Server SE, Exchange 2019 or a hybrid deployment.
- Exchange Online admins who need to understand the on-premises half of hybrid.
- Help desk engineers moving into messaging.
Prerequisites: comfortable with Windows Server, Active Directory and DNS, basic PowerShell, TLS certificates, and ports 25 and 443. Microsoft doesn't currently offer a certification exam dedicated to on-premises Exchange Server, so this is a skills path rather than exam prep. Your proof of progress is a lab you built, broke and fixed.
What you'll be able to do#
- Plan and install Exchange Server SE on a supported Windows Server, prepare Active Directory and publish one clean namespace with the right certificate.
- Run and troubleshoot mail flow: connectors, queues, NDRs, message tracking and protocol logs.
- Build and operate a database availability group (DAG), including maintenance mode, reseeds and database recovery.
- Keep Outlook, OWA and mobile clients connecting, and know where to look when they don't.
- Patch and harden servers with cumulative and security updates, Health Checker, Extended Protection and least-privilege RBAC.
- Run hybrid with Exchange Online: the Hybrid Configuration Wizard, mail flow, free/busy and mailbox moves.
Stage-by-stage plan#
Stage 1 (weeks 1–2): Architecture, lifecycle and the lab#
Learn the two server roles (Mailbox, which includes the client access services, and Edge Transport), how Exchange depends on Active Directory and DNS, and where the product stands. Exchange 2016 and 2019 reached end of support on 14 October 2025, and SE is the current release. Start with Microsoft's Exchange Server documentation and the Exchange Server supportability matrix. On this site, read Exchange Server SE explained and SE platforms and Windows Server 2025.
Practise: build the domain controller and DNS for the lab described below.
Stage 2 (weeks 3–4): Installation, AD preparation and namespaces#
Work through "Exchange Server system requirements", "Exchange Server prerequisites", "Prepare Active Directory and domains", "Install Exchange Server using unattended mode" and "Exchange Server post-installation tasks" in the documentation. Then set virtual directory URLs, Autodiscover and the certificate.
Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareSchema
Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /OrganizationName:"Contoso"
Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /Mode:Install /Roles:MailboxRead: setup prerequisite errors, PrepareSchema and PrepareAD errors, virtual directories and URLs and SAN and Auth certificates.
Stage 3 (weeks 5–6): Mail flow#
Learn the transport services, Send and Receive connectors, accepted domains, queues and back pressure, and how to read an NDR. Get fluent with Get-Queue, Get-MessageTrackingLog and protocol logs.
Read: message tracking, SMTP protocol logging, back pressure and anonymous relay.
Practise: an outbound Send connector, a scoped relay connector for an application, and one message traced from submission to delivery.
Stage 4 (weeks 7–8): Databases and high availability#
Understand ESE databases and transaction logs, DAGs, database copies, the witness server, activation and backups. Patch with maintenance mode, never around it.
Read: DAG maintenance mode, databases that won't mount, FailedAndSuspended copies and logs filling the disk.
Practise: build a two-member DAG with a witness, add copies, fail over, and reseed a copy.
Stage 5 (weeks 9–10): Client access, security and servicing#
Cover Autodiscover, MAPI over HTTP, OWA and the EAC, then the security baseline: cumulative and security updates, Health Checker, Extended Protection, the Emergency Mitigation service and AMSI, and RBAC.
Read: Autodiscover, Outlook can't connect, the CU pre-flight checklist, Health Checker, Extended Protection and Exchange Server RBAC.
Practise: patch the lab to the latest update, run Health Checker until it's clean, and delegate a scoped help desk role group.
Stage 6 (weeks 11–12): Hybrid, migration and lifecycle#
Learn classic versus modern hybrid, the hybrid connectors, OAuth-based free/busy, remote mailboxes, migration endpoints and batches, and the upgrade paths to SE.
Read: HCW failures, hybrid mail flow, migration endpoint errors, migration batches, in-place upgrade from 2019 and migrating from 2016.
Practise: if you have a test Microsoft 365 tenant and a public domain, run the HCW and move a mailbox both ways. Otherwise, rehearse an in-place upgrade on a lab server.
Hands-on practice (lab)#
| Machine | Purpose |
|---|---|
| DC01 | Domain controller and DNS on a supported Windows Server |
| EX01, EX02 | Exchange Server SE on Windows Server 2025, 2022 or 2019, later a DAG |
| CL01 | Windows client with Outlook for client tests |
| EDGE01 (optional) | Edge Transport role outside the domain |
Some details from Microsoft's supportability matrix that catch people out: Server Core is the recommended installation option, though Desktop Experience is supported and easier while you learn. In-place upgrades of Windows Server between major versions aren't supported with Exchange installed. And if a Windows Server 2025 domain controller holds the Schema Master role, it needs the November 2025 or later cumulative update before you run PrepareAD. Lab VMs can run far below production sizing, but checkpoint them before every update so you can repeat an exercise.
Once the lab works, break it on purpose and fix it with the matching article:
| Drill (lab only) | Fix it with |
|---|---|
| Fill the volume that holds the transport queue database | 452 4.3.1 back pressure |
Set-ServerComponentState EX01 -Component ServerWideOffline -State Inactive -Requester Maintenance, then "forget" it | components stuck Inactive |
| Add an Outlook URL that isn't on the certificate | certificate name mismatch |
| Suspend a database copy and reseed it | FailedAndSuspended copies |
| Send from a device without authentication to an external address | 550 5.7.54 relay |
| Remove your test admin from its role group | RBAC access denied |
After the path#
- Stay current: install security updates as they ship, follow the Exchange Team Blog and check Exchange Server known issues in 2026.
- Build your runbook from the Exchange Server error library: every error you reproduced in the lab is one you'll recognise in production.
- Go wider: the cloud half of hybrid in the MS-102 study plan, and identity in the SC-300 study plan.
- Still on 2016 or 2019? Start with your end-of-support options.
