Deliverable: Complete, step-by-step runbook including timeline, preparations, PowerShell commands & scripts, checklists, cutover, post-tasks, rollback plan, and references.

Table of Contents

• 1) Scope & Assumptions (FULL)
• 2) Timeline & Big-Bang Approach (T-14 ? T+1)
• 3) Technical Preparation in Detail
• 4) Migration Execution – Step by Step
• 5) Cutover, Post-Tasks & Validation
• 6) Rollback Plan
• Appendix A: PowerShell Snippets (concise)
• Appendix B: Checklists
• Appendix C: Performance & Operations
• Script Bundle (01–06)
• CSV Template (BigBang.csv)
• References

Get-WebServicesVirtualDirectory |
  fl Identity,ExternalUrl,InternalUrl,MRSProxyEnabled,BasicAuthentication,WindowsAuthentication,MRSProxyMaxConnections

Set-WebServicesVirtualDirectory -Identity "EWS (Default Web Site)" `
  -MRSProxyEnabled $true `
  -ExternalUrl "https://mail.contoso.com/EWS/Exchange.asmx" `
  -InternalUrl "https://mail.contoso.local/EWS/Exchange.asmx" `
  -BasicAuthentication $true -WindowsAuthentication $true `
  -MRSProxyMaxConnections 100

Restart-WebAppPool MSExchangeServicesAppPool

Disable-Mailbox -Identity user1@fabrikam.net -Confirm:$false

cd "$env:ExchangeInstallPath\Scripts"
$SrcDC   = "dc01.contoso.com"
$TgtDC   = "dc01.fabrikam.net"
$SrcCred = Get-Credential   # Source admin
$TgtCred = Get-Credential   # Target admin
$TargetOU = "OU=MailUsers,OU=Exchange,DC=fabrikam,DC=net"
$DeliveryDomain = "contoso.com"

# Goal: MailUsers with correct attributes (LegacyExchangeDN/X500/ProxyAddresses)
.\Prepare-MoveRequest.ps1 `
  -RemoteForestDomainController $SrcDC -RemoteForestCredential $SrcCred `
  -LocalForestDomainController  $TgtDC -LocalForestCredential  $TgtCred `
  -TargetMailUserOU $TargetOU -MailboxDeliveryDomain $DeliveryDomain `
  -UseLocalObject -OverWriteLocalObject

Test-MigrationServerAvailability -ExchangeRemoteMove `
  -RemoteServer mail.contoso.com `
  -Credentials (Get-Credential)

$cred = Get-Credential -Message "Enter SOURCE (contoso) admin credentials"
New-MigrationEndpoint -Name "SRC2016" -ExchangeRemoteMove `
  -RemoteServer "mail.contoso.com" `
  -Credentials $cred `
  -Autodiscover:$false

EmailAddress
user1@fabrikam.net
user2@fabrikam.net
...

$csv = [System.IO.File]::ReadAllBytes("C:\\CFMig\\BigBang.csv")
New-MigrationBatch -Name "BigBang" -CSVData $csv -AutoStart -AutoComplete:$false

Get-MigrationBatch
Get-MigrationUser -BatchId "BigBang" | Get-MigrationUserStatistics | ft Identity,Status,PercentComplete,ItemsTransferred,BytesTransferred -AutoSize

Get-MigrationUser -BatchId "BigBang" | Get-MigrationUserStatistics -IncludeReport | fl

New-MoveRequest -Identity user1@fabrikam.net -Remote `
  -RemoteHostName "mail.contoso.com" `
  -RemoteCredential (Get-Credential) `
  -TargetDatabase "DB01-Target" `
  -BatchName "BigBang" `
  -SuspendWhenReadyToComplete:$true

Get-WebServicesVirtualDirectory | fl Identity,ExternalUrl,InternalUrl,MRSProxyEnabled,BasicAuthentication,WindowsAuthentication
Set-WebServicesVirtualDirectory -Identity "EWS (Default Web Site)" -MRSProxyEnabled $true -ExternalUrl "https://mail.contoso.com/EWS/Exchange.asmx" -InternalUrl "https://mail.contoso.local/EWS/Exchange.asmx" -BasicAuthentication $true -WindowsAuthentication $true -MRSProxyMaxConnections 100
Restart-WebAppPool MSExchangeServicesAppPool

cd "$env:ExchangeInstallPath\Scripts"
$SrcDC="dc01.contoso.com"; $TgtDC="dc01.fabrikam.net"
$SrcCred=Get-Credential; $TgtCred=Get-Credential
$TargetOU="OU=MailUsers,OU=Exchange,DC=fabrikam,DC=net"; $DeliveryDomain="contoso.com"
.\Prepare-MoveRequest.ps1 -RemoteForestDomainController $SrcDC -RemoteForestCredential $SrcCred -LocalForestDomainController $TgtDC -LocalForestCredential $TgtCred -TargetMailUserOU $TargetOU -MailboxDeliveryDomain $DeliveryDomain -UseLocalObject -OverWriteLocalObject

Test-MigrationServerAvailability -ExchangeRemoteMove -RemoteServer mail.contoso.com -Credentials (Get-Credential)

$cred = Get-Credential
New-MigrationEndpoint -Name "SRC2016" -ExchangeRemoteMove -RemoteServer "mail.contoso.com" -Credentials $cred -Autodiscover:$false
$csv = [System.IO.File]::ReadAllBytes("C:\\CFMig\\BigBang.csv")
New-MigrationBatch -Name "BigBang" -CSVData $csv -AutoStart -AutoComplete:$false

Get-MigrationBatch
Get-MigrationUser -BatchId "BigBang" | Get-MigrationUserStatistics | ft Identity,Status,PercentComplete -AutoSize
Complete-MigrationBatch -Identity "BigBang"

<# 01_Enable-MRSProxy_Source.ps1
   Enables MRSProxy on Source (EWS), sets URLs & auth, increases MaxConnections. #>

Get-WebServicesVirtualDirectory |
  fl Identity,ExternalUrl,InternalUrl,MRSProxyEnabled,BasicAuthentication,WindowsAuthentication,MRSProxyMaxConnections

Set-WebServicesVirtualDirectory -Identity "EWS (Default Web Site)" `
  -MRSProxyEnabled $true `
  -ExternalUrl "https://mail.contoso.com/EWS/Exchange.asmx" `
  -InternalUrl "https://mail.contoso.local/EWS/Exchange.asmx" `
  -BasicAuthentication $true -WindowsAuthentication $true `
  -MRSProxyMaxConnections 100

Restart-WebAppPool MSExchangeServicesAppPool
Write-Host "MRSProxy on Source is enabled. Validate certificate chain and reachability (443) from Target." -ForegroundColor Green

<# 02_PrepareMailUsers_Target.ps1
   Prepares MailUsers in Target using Prepare-MoveRequest.ps1.
   Removes existing empty target mailboxes and uses -UseLocalObject/-OverWriteLocalObject. #>

param(
  [string]$SourceDC = "dc01.contoso.com",
  [string]$TargetDC = "dc01.fabrikam.net",
  [string]$TargetOU = "OU=MailUsers,OU=Exchange,DC=fabrikam,DC=net",
  [string]$DeliveryDomain = "contoso.com",
  [string]$CsvPath = "C:\\CFMig\\BigBang.csv"
)

# 1) Remove empty target mailboxes (keep AD accounts)
Import-Csv -Path $CsvPath | ForEach-Object {
  $upn = $_.EmailAddress
  try {
    $mbx = Get-Mailbox -Identity $upn -ErrorAction Stop
    if ($mbx) {
      Write-Host "Disable-Mailbox for $upn (remove target mailbox)" -ForegroundColor Yellow
      Disable-Mailbox -Identity $upn -Confirm:$false
    }
  } catch {
    # No target mailbox ? OK
  }
}

# 2) Run Prepare-MoveRequest.ps1
$srcCred = Get-Credential -Message "SOURCE (contoso) admin credentials"
$tgtCred = Get-Credential -Message "TARGET (fabrikam) admin credentials"

Set-Location "$env:ExchangeInstallPath\Scripts"

.\Prepare-MoveRequest.ps1 `
  -RemoteForestDomainController $SourceDC -RemoteForestCredential $srcCred `
  -LocalForestDomainController  $TargetDC -LocalForestCredential  $tgtCred `
  -TargetMailUserOU $TargetOU -MailboxDeliveryDomain $DeliveryDomain `
  -UseLocalObject -OverWriteLocalObject

Write-Host "MailUsers in Target are prepared (LegacyExchangeDN/X500/ProxyAddresses set)." -ForegroundColor Green

<# 03_Create-MigrationEndpoint.ps1
   Creates the migration endpoint for cross-forest remote moves (pull). #>

$cred = Get-Credential -Message "SOURCE (contoso) admin credentials"
New-MigrationEndpoint -Name "SRC2016" -ExchangeRemoteMove `
  -RemoteServer "mail.contoso.com" `
  -Credentials $cred `
  -Autodiscover:$false

Write-Host "Migration Endpoint 'SRC2016' created." -ForegroundColor Green

<# 04_Create-And-Monitor-Batch.ps1
   Creates the BigBang batch, starts online seeding (AutoStart), and monitors progress. #>

param(
  [string]$CsvPath = "C:\\CFMig\\BigBang.csv",
  [string]$BatchName = "BigBang"
)

$csvBytes = [System.IO.File]::ReadAllBytes($CsvPath)
New-MigrationBatch -Name $BatchName -CSVData $csvBytes -AutoStart -AutoComplete:$false
Write-Host "MigrationBatch '$BatchName' created and started (AutoComplete=False)." -ForegroundColor Green

Write-Host "Monitoring (every 60s) - press CTRL+C to stop" -ForegroundColor Cyan
while ($true) {
  $stats = Get-MigrationUser -BatchId $BatchName | Get-MigrationUserStatistics
  $agg = $stats | Group-Object Status | Select-Object Name,Count
  Clear-Host
  Write-Host ("Batch '{0}' status (UTC {1}):" -f $BatchName, (Get-Date).ToUniversalTime().ToString("u")) -ForegroundColor White
  $agg | Format-Table -AutoSize
  $tot = $stats.Count
  $syn = ($stats | Where-Object {$_.Status -eq "Synced"}).Count
  $inprog = ($stats | Where-Object {$_.Status -eq "InProgress"}).Count
  $fail = ($stats | Where-Object {$_.Status -eq "Failed"}).Count
  Write-Host ("Total:{0}  Synced:{1}  InProgress:{2}  Failed:{3}" -f $tot,$syn,$inprog,$fail) -ForegroundColor Yellow
  Start-Sleep -Seconds 60
}

<# 05_Complete-Batch.ps1
   Final cutover (Complete phase). Switch DNS (Autodiscover/MX) beforehand. #>

param(
  [string]$BatchName = "BigBang"
)

Get-MigrationUser -BatchId $BatchName | Get-MigrationUserStatistics | ft Identity,Status,PercentComplete -AutoSize
Complete-MigrationBatch -Identity $BatchName
Write-Host "Complete-MigrationBatch triggered. Users are being switched." -ForegroundColor Green

<# 06_Delegation-Export-Import.ps1 (Template)
   Cross-forest moves do not carry delegations (FullAccess/SendAs/SendOnBehalf).
   Export before, re-apply after cutover. #>

param(
  [string]$DelegationCsv = "C:\\CFMig\\Delegations.csv"
)

Import-Csv $DelegationCsv | ForEach-Object {
  $mbx = $_.Mailbox
  $dlg = $_.Delegate
  switch ($_.Rights) {
    "FullAccess"    { Add-MailboxPermission -Identity $mbx -User $dlg -AccessRights FullAccess -AutoMapping:$true -ErrorAction SilentlyContinue }
    "SendAs"        { Add-ADPermission -Identity $mbx -User $dlg -ExtendedRights "Send As" -ErrorAction SilentlyContinue }
    "SendOnBehalf"  { Set-Mailbox -Identity $mbx -GrantSendOnBehalfTo @{add="$dlg"} -ErrorAction SilentlyContinue }
  }
}

EmailAddress
user1@fabrikam.net
user2@fabrikam.net
user3@fabrikam.net
...