HOW TO: Hide Exchange Servers from Active Roles (4258768)

During the Active Roles Administration Service startup, Active Roles will detect available Microsoft Exchange servers in the environment based on their Active Directory service object entries.

Once the Microsoft Exchange Servers are detected, Active Roles will order known servers based on internal logic into a preference list, and then connect to those servers, in order, for every necessary Microsoft Exchange operation.

It some scenarios, it may be necessary to prevent Active Roles from connecting to specific Exchange Servers in an environment.

While Active Roles does not currently provide a method to configure which Exchange Servers it can utilize, the issue can be worked around by preventing Active Roles from discovering the specific Exchange Servers in Active Directory.

Enhancement Request 493018 has been created to have an Active Roles configuration to allow direct control of which on-prem Microsoft Exchange servers are leveraged.

To prevent Active Roles from discovering an Exchange Server, follow the guidance below:

1. Open ADSIEdit.msc, right-click on ADSI Edit, and then Connect to...
2. In the Connection Settings window, under the Select a well known naming context dropdown field, select Configuration and ensure the correct domain is specified under Computer
3. Expand Configuration | CN=Configuration | CN=Services | CN=Microsoft Exchange | CN=| CN=Administrative Groups | CN=Exchange Administrative Group | CN=Servers
4. Locate the desired Exchange server in the list, and deny the ARS Service Account read permissions to the object
5. Restart the Active Roles service