7,023 questions
Active Directory and Exchange Server Hit by Ransomware Attack
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 86%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
Arief Hardiansyah
51
Reputation points
Hi All,
We have an active directory environment and an exchange server that we have hybrid configured.
and currently all our AD and Exchange servers are inaccessible and remote due to a ransomware virus attack.
we would like to ask the best option or plan for the case we are facing,
- is it possible if all users in AD On-Premise are converted to full cloud? (no need to sync again between cloud and on-premise)
- can we remove or delete the existing hybrid configuration considering all our On-Premise servers are inaccessible
- or maybe there are other options?
Really appreciate for your answer
Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Exchange | Hybrid management
2,310 questions
Microsoft Security | Microsoft Entra | Microsoft Entra ID
25,184 questions
{count} votes
-
KyleXu-MSFT 26,396 Reputation points2022-05-09T02:22:02.79+00:00 The Scenario one is the supported way to remove hybrid and only keep mailbox/AD account on Office 365. You need to access the Exchange server first.
If you cannot access the Exchange on-premises server, you may need to delete the existing mailbox (For migrated user, you could delete them from Azure AD) then recreate new mailboxes on Exchange online. You could import data from those mailboxes from Outlook client if they have been configured in Outlook before attacking.
Sign in to comment
Sign in to answer