Deploying Microsoft Exchange

Written by

Updated at August 14, 2025

Get your cloud ready
- Required paid resources
Create a cloud network and subnets
Create a script to manage a local administrator account
Create a VM for Active Directory
Create a VM for File Share Witness
Install and configure Active Directory
Configure the second domain controller
Install Microsoft Exchange
Set up Microsoft Exchange servers
- Set up the first Exchange server
- Create the second Exchange server
Create a database availability group
- Create disks for VM databases
- Configure the database availability group
Configure Client Access
Configure a network load balancer
Configure accepted domains and the email address policy
Create a VM for Edge Transport servers
- Create a VM for the vm-edge-a server
- Create a VM for the vm-edge-b server
Configure Edge Transport servers
- Configure the Edge Transport server in the ru-central1-a zone
- Configure the Edge Transport server in the ru-central1-b zone
Add the Edge Transport servers to Exchange
- Set up a subscription on the vm-edge-a server
- Set up a subscription on the vm-edge-b server
How to delete the resources you created

Warning

In Yandex Cloud, you can only use Microsoft products with your own licenses and on dedicated hosts. For more information, see Using personal licenses for Microsoft products.

This tutorial describes how to deploy Microsoft Exchange servers in Yandex Cloud. You will install two Microsoft Exchange mail servers, two Active Directory servers, and two Edge Transport servers in the ru-central1-a and ru-central1-b availability zones. A network load balancer will distribute load across the servers. To manage the servers, you will use a separate VM with internet access hosted in the ru-central1-d availability zone.

If you no longer need the resources you created, delete them.

Get your cloud ready

Navigate to the management console and log in to Yandex Cloud or create a new account.
On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure.

Learn more about clouds and folders here.

Note

Make sure that the billing account contains user details required to meet the Microsoft licensing policy requirements. You can launch the product only if you have these details.

Required paid resources

The cost of running a Microsoft Exchange instance includes:

Fee for continuously running virtual machines (see Yandex Compute Cloud pricing).
Fee for load balancing (see Yandex Network Load Balancer pricing).
Fee for using dynamic or static public IP addresses (see Yandex Virtual Private Cloud pricing).
Fee for Yandex Cloud outbound internet traffic (see Yandex Compute Cloud pricing).

Create a cloud network and subnets

Create a cloud network named exchange-network with subnets in all availability zones that will host your VMs.

Create a cloud network:
Management console

CLI
To create a cloud network:
1. Open the Virtual Private Cloud section in the folder where you want to create a cloud network.
2. Click Create network.
3. Specify exchange-network as the network name.
4. Click Create network.
To create a cloud network, run this command:
```
yc vpc network create --name exchange-network
```
Create three subnets in exchange-network:
Management console

CLI
To create a subnet:
1. Open the Virtual Private Cloud section in the folder where you want to create a subnet.
2. Click the name of your cloud network.
3. Click Add subnet.
4. Specify exchange-subnet-a as the name and select the ru-central1-a availability zone from the drop-down list.
5. Enter the subnet CIDR: IP address and subnet mask 10.1.0.0/16. For more information about IP address ranges, see Cloud networks and subnets.
6. Click Create subnet.
Repeat these steps for two more subnets, exchange-subnet-b and exchange-subnet-d, in the ru-central1-b and ru-central1-d availability zones with 10.2.0.0/16 and 10.3.0.0/16 as the CIDR, respectively.
To create subnets, run these commands:
```
yc vpc subnet create \
  --name exchange-subnet-a \
  --zone ru-central1-a \
  --network-name exchange-network \
  --range 10.1.0.0/16

yc vpc subnet create \
  --name exchange-subnet-b \
  --zone ru-central1-b \
  --network-name exchange-network \
  --range 10.2.0.0/16

yc vpc subnet create \
  --name exchange-subnet-d \
  --zone ru-central1-d \
  --network-name exchange-network \
  --range 10.3.0.0/16
```

Create a script to manage a local administrator account

Create a file named setpass with a script that will set a password for the local administrator account when you create VMs via the CLI:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your_password>" -AsPlainText -Force)

The password must meet the complexity requirements.

To learn about the best practices for securing Active Directory, see this MS article.

Create a VM for Active Directory

Create two virtual machines for Active Directory. These VMs will not have internet access.

Management console

CLI

On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
Under Boot disk image:
- Navigate to the Custom tab.
- Click Select and select Create in the window that opens.
- In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
- Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
- Click Add disk.
Under Location, select the ru-central1-a availability zone.
Under Disks and file storages, set 50 GB as your boot disk size.
Under Computing resources, navigate to the Custom tab and specify the platform, number of vCPUs, and RAM size:
- Platform: Intel Ice Lake.
- vCPU: 4.
- Guaranteed vCPU performance: 100%.
- RAM: 8 GB.
Under Network settings, specify:
- Subnet: exchange-subnet-a.
- Public IP address: No address.
Under General information, specify the VM name: ad-vm-a.
Click Create VM.

Wait for the VM status to change to Running and reset the password:

Select the VM.
Click Reset password.
Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
Click Generate password.
Save the New password. It will become unavailable once you close the window.

Repeat these steps for ad-vm-b in the ru-central1-b availability zone and connect it to exchange-subnet-b.

yc compute instance create \
  --name ad-vm-a \
  --hostname ad-vm-a \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-a \
  --network-interface subnet-name=exchange-subnet-a,ipv4-address=10.1.0.3 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --metadata-from-file user-data=setpass

yc compute instance create \
  --name ad-vm-b \
  --hostname ad-vm-b \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-b \
  --network-interface subnet-name=exchange-subnet-b,ipv4-address=10.2.0.3 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --metadata-from-file user-data=setpass

Note

The commands yc compute instance create | create-with-container | update | add-metadata support substitution of environment variable values into VM metadata. When you execute a Yandex Cloud CLI command, these values, specified in the user-data key in $<variable_name> format, will be substituted into the VM metadata from the environment variables of the environment the command is executed in.

To change such behavior, i.e. to provide a variable name to the VM metadata in $<variable_name> format rather than take the variable value from the CLI command runtime environment, use the two-dollar syntax, e.g., $$<variable_name>.

For more information, see Specifics of providing environment variables in metadata via the CLI.

Create a VM for File Share Witness

You will use a file server with internet access to configure VMs with Active Directory.

Management console

CLI

On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
Under Boot disk image:
- Navigate to the Custom tab.
- Click Select and select Create in the window that opens.
- In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
- Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
- Click Add disk.
Under Location, select the ru-central1-d availability zone.
Under Disks and file storages, set 50 GB as your boot disk size.
Under Computing resources, navigate to the Custom tab and specify the required platform, number of vCPUs, and amount of RAM:
- Platform: Intel Ice Lake.
- vCPU: 2.
- Guaranteed vCPU performance: 100%.
- RAM: 4 GB.
Under Network settings:
- In the Subnet field, select exchange-subnet-d.
- In the Public IP address field, leave Auto.
Under General information, specify the VM name: fsw-vm.
Click Create VM.

Wait for the VM status to change to Running and reset the password:

Select the VM.
Click Reset password.
Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
Click Generate password.
Save the New password. It will become unavailable once you close the window.

yc compute instance create \
  --name fsw-vm \
  --hostname fsw-vm \
  --memory 4 \
  --cores 2 \
  --zone ru-central1-d \
  --network-interface subnet-name=exchange-subnet-d,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --metadata-from-file user-data=setpass

Install and configure Active Directory

Active Directory VMs do not have internet access. To configure them, use fsw-vm through RDP.

Connect to fsw-vm through RDP. Use Administrator as your username and enter your password.
On fsw-vm, run RDP and connect to ad-vm-a. Use Administrator as your username and enter your password.

Run PowerShell on ad-vm-a and set a static address:

netsh interface ip set address "eth0" static 10.1.0.3 255.255.255.0 10.1.0.1

Create a temporary folder:
```
mkdir C:\Windows\temp
```

Assign Active Directory roles:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Result:

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {Active Directory Domain Services, Group P...

Create an Active Directory forest:
```
Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
```
Windows will restart automatically. After the reboot, connect to ad-vm-a using the yantoso\Administrator account and your password. Relaunch PowerShell.

Rename the default site to ru-central1-a:

Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a'

Create two more sites for the other availability zones:

New-ADReplicationSite 'ru-central1-b'
New-ADReplicationSite 'ru-central1-d'

Create subnets and link them to the sites:

New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a'
New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b'
New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-d'

Rename the site link and configure replication:

Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | `
    Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | `
    Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | `
    Rename-ADObject -NewName 'ru-central1'

Set the DNS server forwarder:
```
Set-DnsServerForwarder '10.1.0.2'
```

Configure the DNS client:

Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1"

Configure the second domain controller

Connect to fsw-vm through RDP. Use Administrator as your username and enter your password.
On fsw-vm, run RDP and connect to ad-vm-b. Use Administrator as your username and enter your password.
Create a temporary folder:
```
mkdir C:\Windows\temp
```

Assign Active Directory roles:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Result:

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {Active Directory Domain Services, Group P...

Configure the DNS client:

Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1"

Configure a static IP address:

netsh interface ip set address "eth0" static 10.2.0.3 255.255.255.0 10.2.0.1

Add the controller to the domain:
```
Install-ADDSDomainController `
    -Credential (Get-Credential "yantoso\Administrator") `
    -DomainName 'yantoso.net' `
    -Force:$true
```
Windows will restart automatically. After the reboot, connect to ad-vm-b using the yantoso\Administrator account and your password. Relaunch PowerShell.
Set the DNS server forwarder:
```
Set-DnsServerForwarder '10.2.0.2'
```

Install Microsoft Exchange

Connect to fsw-vm using RDP and run PowerShell.

Configure the DNS client:

Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,10.2.0.3"

Add the server to the domain:
```
$Credentials = Get-Credential # yantoso\Administrator
Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart
```
Windows will restart automatically. After the reboot, connect to fsw-vm using the yantoso\Administrator account and your password. Relaunch PowerShell.
Create the distrib folder:
```
mkdir c:\distrib
```
Download the Exchange Server distribution kit and required dependencies:
1. .NET Framework 4.7.2.
2. Visual C++ Redistributable Package for Visual Studio 2012. Rename the downloaded file to vcredist_x64_2012.exe.
3. Visual C++ Redistributable Package for Visual Studio 2013. Rename the downloaded file to vcredist_x64_2013.exe.
4. Microsoft Unified Communications Managed API 4.0, Core Runtime 64-bit.
Place the distribution kits in the C:\distrib directory.

Grant shared access from the domain to the distribution directory:

New-SmbShare -ReadAccess 'yantoso\domain users' -Path 'c:\distrib' -Name 'distrib'

Set up Microsoft Exchange servers

Set up the first Exchange server

Create a VM named vm-exchange-a:
Management console

CLI
1. On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
2. Under Boot disk image:
  - Navigate to the Custom tab.
  - Click Select and select Create in the window that opens.
  - In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
  - Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
  - Click Add disk.
3. Under Location, select the ru-central1-a availability zone.
4. Under Disks and file storages:
  - Set the boot disk size: 100 GB.
  - Click Add and add another 250 GB SSD named db-a.
5. Under Computing resources, navigate to the Custom tab and specify the required platform, number of vCPUs, and amount of RAM:
  - Platform: Intel Ice Lake.
  - vCPU: 8.
  - Guaranteed vCPU performance: 100%.
  - RAM: 32 GB.
6. Under Network settings, specify:
  - Subnet: exchange-subnet-a.
  - Public IP address: No address.
7. Under General information, specify the VM name: vm-exchange-a.
8. Click Create VM.
Wait for the VM status to change to Running and reset the password:
1. Select the VM.
2. Click Reset password.
3. Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
4. Click Generate password.
5. Save the New password. It will become unavailable once you close the window.
```
yc compute instance create \
  --name vm-exchange-a \
  --hostname vm-exchange-a \
  --memory 32 \
  --cores 8 \
  --zone ru-central1-a \
  --network-interface subnet-name=exchange-subnet-a \
  --create-boot-disk size=100,image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --create-disk type=network-ssd,size=250,auto-delete=false \
  --metadata-from-file user-data=setpass
```
Connect to fsw-vm through RDP.
Run RDP on fsw-vm and connect to vm-exchange-a. Use Administrator as your username and enter your password. Launch PowerShell.

Configure the DNS client:

Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3"

Add vm-exchange-a to the domain:

$Credentials = Get-Credential # yantoso\Administrator
Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart

After the reboot, log in to the VM with the yantoso\Administrator account and your password. Relaunch PowerShell.

Install the downloaded dependencies in the following order:
1. & \\fsw-vm\distrib\vcredist_x64_2012.exe /install /passive /norestart
2. & \\fsw-vm\distrib\vcredist_x64_2013.exe /install /passive /norestart
3. & \\fsw-vm\distrib\UcmaRuntimeSetup.exe /install /passive /norestart
4. & \\fsw-vm\distrib\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
Restart the VM: Restart-Computer -Force.

After the reboot, log in to the VM with the yantoso\Administrator account and your password. Relaunch PowerShell.
Install Exchange Mailbox Server on vm-exchange-a. Mount the distribution image from the shared folder containing the distribution kits:
```
Mount-DiskImage \\fsw-vm\distrib\ExchangeServer2016-x64-cu13.iso
```

Install Exchange Mailbox Server:

& D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:Mailbox /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
Restart-Computer -Force

After the installation is complete, the VM will restart automatically.

Create the second Exchange server

Create a VM named vm-exchange-b:
Management console

CLI
1. On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
2. Under Boot disk image:
  - Navigate to the Custom tab.
  - Click Select and select Create in the window that opens.
  - In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
  - Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
  - Click Add disk.
3. Under Location, select the ru-central1-b availability zone.
4. Under Disks and file storages:
  - Set the boot disk size: 100 GB.
  - Click Add and add another 250 GB SSD named db-b.
5. Under Computing resources, navigate to the Custom tab and specify the required platform, number of vCPUs, and amount of RAM:
  - Platform: Intel Ice Lake.
  - vCPU: 8.
  - Guaranteed vCPU performance: 100%.
  - RAM: 32 GB.
6. Under Network settings, specify:
  - Subnet: exchange-subnet-b.
  - Public IP address: No address.
7. Under General information, specify the VM name: vm-exchange-b.
8. Click Create VM.
Wait for the VM status to change to Running and reset the password:
1. Select the VM.
2. Click Reset password.
3. Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
4. Click Generate password.
5. Save the New password. It will become unavailable once you close the window.
```
yc compute instance create \
  --name vm-exchange-b \
  --hostname vm-exchange-b \
  --memory 32 \
  --cores 8 \
  --zone ru-central1-b \
  --network-interface subnet-name=exchange-subnet-b \
  --create-boot-disk size=100,image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --create-disk type=network-ssd,size=250,auto-delete=false \
  --metadata-from-file user-data=setpass
```
Connect to fsw-vm through RDP.
Run RDP on fsw-vm and connect to vm-exchange-b. Use Administrator as your username and enter your password. Launch PowerShell.

Configure the DNS client:

Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3"

Add vm-exchange-a to the domain:

$Credentials = Get-Credential # yantoso\Administrator
Add-Computer -DomainName yantoso.net -DomainCredential $Credentials -Force -Restart

After the reboot, log in to the VM with the yantoso\Administrator account and your password. Relaunch PowerShell.

Install the downloaded dependencies in the following order:
1. & \\fsw-vm\distrib\vcredist_x64_2012.exe /install /passive /norestart
2. & \\fsw-vm\distrib\vcredist_x64_2013.exe /install /passive /norestart
3. & \\fsw-vm\distrib\UcmaRuntimeSetup.exe /install /passive /norestart
4. & \\fsw-vm\distrib\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart
Restart the VM: Restart-Computer -Force.

After the reboot, log in to the VM with the yantoso\Administrator account and your password. Relaunch PowerShell.
Install Exchange Mailbox Server on vm-exchange-b. Mount the distribution image from the shared folder containing the distribution kits:
```
Mount-DiskImage \\fsw-vm\distrib\ExchangeServer2016-x64-cu13.iso
```

Install Exchange Mailbox Server:

& D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:Mailbox /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg
Restart-Computer -Force

After the installation is complete, the VM will restart automatically.

Create a database availability group

A database availability group ensures fault tolerance for mailbox servers via DB replication and automatic DB failover in the event of a crash.

Connect to fsw-vm through RDP.

Grant the yantoso\Exchange Trusted Subsystem group administrator permissions for fsw-vm:

Add-LocalGroupMember -Group 'Administrators' -Member 'yantoso\Exchange Trusted Subsystem'

Create disks for VM databases

Run RDP on fsw-vm and connect to vm-exchange-a. Use yantoso\Administrator as your username and enter your password.

Create a secondary disk and format it:

Get-Disk | `
    Where-Object PartitionStyle -eq raw | `
    Initialize-Disk -PartitionStyle GPT -PassThru | `
    New-Partition -DriveLetter 'Z' -UseMaximumSize | `
    Format-Volume -FileSystem NTFS -NewFileSystemLabel "mdb" -Confirm:$false -AllocationUnitSize 65536

Install the Failover-Clustering role:

Install-WindowsFeature -Name 'Failover-Clustering' -IncludeManagementTools

Repeat these commands for vm-exchange-b.

Configure the database availability group

Run RDP on fsw-vm and connect to vm-exchange-a through RDP. Use yantoso\Administrator as your username and enter your password.
Run the Exchange Management Shell.

Create a database availability group:

New-DatabaseAvailabilityGroup `
    -Name ycdag `
    -WitnessServer fsw-vm `
    -DatabaseAvailabilityGroupIpAddresses 255.255.255.255

Add the vm-exchange-a and vm-exchange-b servers to the DAG:

Add-DatabaseAvailabilityGroupServer -Identity ycdag -MailboxServer vm-exchange-a
Add-DatabaseAvailabilityGroupServer -Identity ycdag -MailboxServer vm-exchange-b

Check the status of your servers; both should be in the Operational Servers column:

Get-DatabaseAvailabilityGroup -Status

Result:

Name             Member Servers                                      Operational Servers
----             --------------                                      -------------------
ycdag            {VM-EXCHANGE-A, VM-EXCHANGE-B}                    {VM-EXCHANGE-A, VM-EXCHANGE-B}

Create a mailbox server database:

New-MailboxDatabase -Name yamdb -EdbFilePath 'Z:\MDB\yamdb\yamdb.edb' -LogFolderPath 'Z:\MDB\yamdb\log' -Server vm-exchange-a

Mount this database:
```
Mount-Database yamdb
```

Create a copy of this database on the second server:

Add-MailboxDatabaseCopy -Identity yamdb -MailboxServer vm-exchange-b -SeedingPostponed
Update-MailboxDatabasecopy yamdb\vm-exchange-b –CatalogOnly

Check the DB status:

Get-MailboxDatabaseCopyStatus -Server vm-exchange-a
Get-MailboxDatabaseCopyStatus -Server vm-exchange-b

Configure Client Access

To work with various client applications, you need to create virtual directories.

Set the mail domain:
```
$MailDomain = "mail.yantoso.net"
```

ECP:

Get-EcpVirtualDirectory | Set-EcpVirtualDirectory -ExternalUrl "https://$MailDomain/ecp"

EWS:

Get-WebServicesVirtualDirectory | Set-WebServicesVirtualDirectory -ExternalUrl "https://$MailDomain/ews/exchange.asmx"

Active Sync:

Get-ActiveSyncVirtualDirectory | Set-ActiveSyncVirtualDirectory -ExternalUrl "https://$MailDomain/Microsoft-Server-ActiveSync"

OAB:

Get-OabVirtualDirectory | Set-OabVirtualDirectory -ExternalUrl "https://$MailDomain/OAB"

OWA:

Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -ExternalUrl "https://$MailDomain/owa"

PowerShell:

Get-PowerShellVirtualDirectory | Set-PowerShellVirtualDirectory -ExternalUrl "https://$MailDomain/powershell"

MAPI:

Get-MapiVirtualDirectory | Set-MapiVirtualDirectory -ExternalUrl "https://$MailDomain/mapi"

Configure a network load balancer

It will distribute the load across the Exchange servers in various availability zones.

Management console

CLI

To create a network load balancer:

Open the Load Balancer section in the folder where you want to create a load balancer.
Click Create network load balancer.
Enter the load balancer name: exchange-lb.
In the Public address field, select Auto.
Click Add listener under Listeners.
Enter the listener name: yassl.
Set 443 as the listener port and target port and click Add.
Under Target groups, click Add target group.
In the Target group field, open the drop-down list and select Create target group.
Enter exchange-tg as the target group name.
Select vm-exchange-a and vm-exchange-b and click Create.
Click Configure.
Enter exchange-hc as the health check name.
Select the TCP check.
Set the port to 443.
Leave the default values for the other properties and click Apply.
Click Create.

Create a network load balancer:
```
yc lb nlb create --name exchange-lb
```
Create a target group:
```
yc lb tg create --name exchange-tg
```
Get information about the mailbox servers:
```
yc compute instance get vm-exchange-a
yc compute instance get vm-exchange-b
```
Copy the VM subnet IP addresses and IDs.

Add the servers to the target group:

yc lb tg update --name exchange-tg \
  --target address=<vm-exchange-a_IP_address>,subnet-id=<vm-exchange-a_subnet_ID> \
  --target address=<vm-exchange-b_IP_address>,subnet-id=<vm-exchange-b_subnet_ID>

Add the listener to the network load balancer:

yc lb nlb add-listener --name exchange-lb --listener name=yassl,port=443,target-port=443,external-ip-version=ipv4

Get information about the target groups:
```
yc lb tg list
```
Copy the ID of the target group you created.

Connect the target group to the network load balancer using the target group ID:

yc lb nlb attach-target-group \
  --name exchange-lb \
  --target-group target-group-id=<target_group_ID>,healthcheck-name=exchange-hc,healthcheck-tcp-port=443

Configure accepted domains and the email address policy

By default, the system creates a domain for you. If you need to change the domain, use this command:

New-AcceptedDomain -Name yantoso.net -DomainName yantoso.net

Edit the email address policy:

Get-EmailAddressPolicy | Set-EmailAddressPolicy -EnabledPrimarySMTPAddressTemplate '@yantoso.net'

All new mailboxes will automatically get an alias with the @yantoso.net domain.

Create a VM for Edge Transport servers

The Edge Transport servers will take on the main user load, such as receiving emails from the internet, filtering out spam, and forwarding messages to internal Exchange mailbox servers.

Create a VM for the `vm-edge-a` server

Create a VM named vm-edge-a:

Management console

CLI

On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
Under Boot disk image:
- Navigate to the Custom tab.
- Click Select and select Create in the window that opens.
- In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
- Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
- Click Add disk.
Under Location, select the ru-central1-a availability zone.
Under Disks and file storages, set 50 GB as your boot disk size.
Under Computing resources, navigate to the Custom tab and specify the platform, number of vCPUs, and RAM size:
- Platform: Intel Ice Lake.
- vCPU: 4.
- Guaranteed vCPU performance: 100%.
- RAM: 8 GB.
Under Network settings:
- In the Subnet field, select exchange-subnet-a.
- Leave the Public IP address field set to Auto or select List and the public IP address from the list if you reserved one earlier.
Under General information, specify the VM name: vm-edge-a.
Click Create VM.

Wait for the VM status to change to Running and reset the password:

Select the VM.
Click Reset password.
Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
Click Generate password.
Save the New password. It will become unavailable once you close the window.

yc compute instance create \
  --name vm-edge-a \
  --hostname vm-edge-a \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-a \
  --network-interface subnet-name=exchange-subnet-a,nat-ip-version=ipv4 \
  --create-boot-disk size=50,image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --metadata-from-file user-data=setpass

Create a VM for the vm-edge-b server

Create a VM named vm-edge-b:

Management console

CLI

On the folder dashboard in the management console, click Create resource and select Virtual machine instance.
Under Boot disk image:
- Navigate to the Custom tab.
- Click Select and select Create in the window that opens.
- In the Contents field, select Image and then, the Windows Server 2016 Datacenter image from the list below. For more information on how to upload your own image for Microsoft products, see Importing a custom image.
- Optionally, enable Delete along with the virtual machine in the Additional field if you need this disk automatically deleted when deleting the VM.
- Click Add disk.
Under Location, select the ru-central1-b availability zone.
Under Disks and file storages, set 50 GB as your boot disk size.
Under Computing resources, navigate to the Custom tab and specify the platform, number of vCPUs, and RAM size:
- Platform: Intel Ice Lake.
- vCPU: 4.
- Guaranteed vCPU performance: 100%.
- RAM: 8 GB.
Under Network settings:
- In the Subnet field, select exchange-subnet-b.
- Leave the Public IP address field set to Auto or select List and the public IP address from the list if you reserved one earlier.
Under General information, specify the VM name: vm-edge-b.
Click Create VM.

Wait for the VM status to change to Running and reset the password:

Select the VM.
Click Reset password.
Specify the Username to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access.
Click Generate password.
Save the New password. It will become unavailable once you close the window.

yc compute instance create \
  --name vm-edge-b \
  --hostname vm-edge-b \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-b \
  --network-interface subnet-name=exchange-subnet-b,nat-ip-version=ipv4 \
  --create-boot-disk size=50,image-folder-id=standard-images,image-family=windows-2016-gvlk \
  --metadata-from-file user-data=setpass

Configure Edge Transport servers

Configure the Edge Transport server in the ru-central1-a zone

Connect to fsw-vm through RDP.
Connect to vm-edge-a through RDP. Use Administrator as your username and enter your password. Launch PowerShell.
Create a temporary folder:
```
mkdir C:\Windows\temp
```
Install the ADLDS roles on the server:
```
Install-WindowsFeature ADLDS
```

Configure the DNS client:

Get-NetAdapter | `
    Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,10.2.0.3"

Configure remote access to the distribution folder located on the fsw-vm server:

$Credential = Get-Credential # Username: yantoso\Administrator

New-PSDrive -Name 'fsw-vm' -PSProvider:FileSystem -Root '\\fsw-vm.ru-central1.internal\distrib' -Credential $Credential

Enter yantoso\Administrator as your username and your password.

Install the dependencies:

& fsw-vm:\vcredist_x64_2012.exe /install /passive /norestart
& fsw-vm:\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart

Copy the Microsoft Exchange distribution kit to the vm-edge-a server:

copy-item fsw-vm:\ExchangeServer2016-x64-cu13.iso c:\windows\temp\ExchangeServer2016-x64-cu13.iso

Specify the primary DNS suffix:

$Suffix = 'ru-central1.internal'

Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name Domain -Value $Suffix

Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name 'NV Domain' -Value $Suffix

Restart the VM:
```
Restart-Computer -Force
```
Reconnect to vm-edge-a through RDP and run PowerShell.

Mount the Exchange Server distribution kit:

Mount-DiskImage c:\windows\temp\ExchangeServer2016-x64-cu13.iso

Install Edge Transport Server on the vm-edge-a server:

& D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:EdgeTransport /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg

Configure the Edge Transport server in the ru-central1-b zone

Connect to fsw-vm through RDP.
Connect to vm-edge-b through RDP. Use Administrator as your username and enter your password. Launch PowerShell.
Create a temporary folder:
```
mkdir C:\Windows\temp
```
Install the ADLDS roles on the server:
```
Install-WindowsFeature ADLDS
```

Configure the DNS client:

Get-NetAdapter | `
    Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,10.1.0.3"

Configure remote access to the distribution folder located on the fsw-vm server:

$Credential = Get-Credential # Username: yantoso\Administrator

New-PSDrive -Name 'fsw-vm' -PSProvider:FileSystem -Root '\\fsw-vm.ru-central1.internal\distrib' -Credential $Credential

Enter yantoso\Administrator as your username and your password.

Install the dependencies:

& fsw-vm:\vcredist_x64_2012.exe /install /passive /norestart
& fsw-vm:\NDP472-KB4054530-x86-x64-AllOS-ENU.exe /install /passive /norestart

Copy the Microsoft Exchange distribution kit to the vm-edge-b server:

copy-item fsw-vm:\ExchangeServer2016-x64-cu13.iso c:\windows\temp\ExchangeServer2016-x64-cu13.iso

Specify the primary DNS suffix:

$Suffix = 'ru-central1.internal'

Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name Domain -Value $Suffix

Set-ItemProperty -path HKLM:\system\CurrentControlSet\Services\tcpip\parameters -Name 'NV Domain' -Value $Suffix

Restart the VM:
```
Restart-Computer -Force
```
Reconnect to vm-edge-b through RDP and run PowerShell.

Mount the Exchange Server distribution kit:

Mount-DiskImage c:\windows\temp\ExchangeServer2016-x64-cu13.iso

Install Edge Transport Server on the vm-edge-b server:

& D:\Setup.exe /Mode:Install /InstallWindowsComponents /Role:EdgeTransport /IAcceptExchangeServerLicenseTerms /OrganizationName:MyOrg

Add the Edge Transport servers to Exchange

Each Edge Transport server must subscribe to a site in its own availability zone.

Set up a subscription on the `vm-edge-a` server

Create the subscribe folder:
```
mkdir c:\subscribe
```
Run the Exchange Management Shell. Create a subscription file on the vm-edge-a server:
```
New-EdgeSubscription -FileName "C:\subscribe\$(hostname).xml"
```
Copy the C:\subscribe\vm-edge-a.xml file to the vm-exchange-a server, to the C:\root\vm-edge-a.xml folder.
Log in to the vm-exchange-a server and run the Exchange Management Shell.

Subscribe the vm-edge-a Edge Transport servers to the ru-central1-a site:

New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\root\vm-edge-a.xml" -Encoding Byte -ReadCount 0)) -Site "ru-central1-a"

Use this command to check the subscription:

Get-EdgeSubscription

Result:

Name            Site                 Domain
----            ----                 ------
vm-edge-a       yantoso.net/Confi... ru-central1.internal

Check the sync status:
```
Test-EdgeSynchronization
```
The SyncStatus parameter should change to Normal.

Create the subscribe folder:
```
mkdir c:\subscribe
```
Run the Exchange Management Shell. Create a subscription file on the vm-edge-b server:
```
New-EdgeSubscription -FileName "C:\subscribe\$(hostname).xml"
```
Copy the C:\subscribe\vm-edge-b.xml file to the vm-exchange-b server, to the C:\root\vm-edge-b.xml folder.
Log in to the vm-exchange-b server and run the Exchange Management Shell.

Subscribe the vm-edge-b Edge Transport servers to the ru-central1-b site:

New-EdgeSubscription -FileData ([byte[]]$(Get-Content -Path "C:\root\vm-edge-b.xml" -Encoding Byte -ReadCount 0)) -Site "ru-central1-b"

Make sure the subscription was created using this command:

Get-EdgeSubscription

Result:

Name            Site                 Domain
----            ----                 ------
vm-edge-a       yantoso.net/Confi... ru-central1.internal
vm-edge-b       yantoso.net/Confi... ru-central1.internal

Check the sync status:
```
Test-EdgeSynchronization
```
The SyncStatus parameter should change to Normal.

How to delete the resources you created

To stop paying for the deployed servers, delete all VMs and the load balancer:

fsw-vm
ad-vm-a
ad-vm-b
vm-exchange-a
vm-exchange-b
vm-edge-a
vm-edge-b
exchange-lb load balancer

Deploying Microsoft Exchange

Get your cloud readyGet your cloud ready

Required paid resourcesRequired paid resources

Create a cloud network and subnetsCreate a cloud network and subnets

Create a script to manage a local administrator accountCreate a script to manage a local administrator account

Create a VM for Active DirectoryCreate a VM for Active Directory

Create a VM for File Share WitnessCreate a VM for File Share Witness

Install and configure Active DirectoryInstall and configure Active Directory

Configure the second domain controllerConfigure the second domain controller

Install Microsoft ExchangeInstall Microsoft Exchange

Set up Microsoft Exchange serversSet up Microsoft Exchange servers

Set up the first Exchange serverSet up the first Exchange server

Create the second Exchange serverCreate the second Exchange server

Create a database availability groupCreate a database availability group

Create disks for VM databasesCreate disks for VM databases

Configure the database availability groupConfigure the database availability group

Configure Client AccessConfigure Client Access

Configure a network load balancerConfigure a network load balancer

Configure accepted domains and the email address policyConfigure accepted domains and the email address policy

Create a VM for Edge Transport serversCreate a VM for Edge Transport servers

Create a VM for the serverCreate a VM for the vm-edge-a server

Create a VM for the vm-edge-b serverCreate a VM for the vm-edge-b server

Configure Edge Transport serversConfigure Edge Transport servers

Configure the Edge Transport server in the ru-central1-a zoneConfigure the Edge Transport server in the ru-central1-a zone

Configure the Edge Transport server in the ru-central1-b zoneConfigure the Edge Transport server in the ru-central1-b zone

Add the Edge Transport servers to ExchangeAdd the Edge Transport servers to Exchange

Set up a subscription on the serverSet up a subscription on the vm-edge-a server

Set up a subscription on the vm-edge-b serverSet up a subscription on the vm-edge-b server

How to delete the resources you createdHow to delete the resources you created

Was the article helpful?

Get your cloud ready

Required paid resources

Create a cloud network and subnets

Create a script to manage a local administrator account

Create a VM for Active Directory

Create a VM for File Share Witness

Install and configure Active Directory

Configure the second domain controller

Install Microsoft Exchange

Set up Microsoft Exchange servers

Set up the first Exchange server

Create the second Exchange server

Create a database availability group

Create disks for VM databases

Configure the database availability group

Configure Client Access

Configure a network load balancer

Configure accepted domains and the email address policy

Create a VM for Edge Transport servers

Create a VM for the `vm-edge-a` server

Create a VM for the vm-edge-b server

Configure Edge Transport servers

Configure the Edge Transport server in the ru-central1-a zone

Configure the Edge Transport server in the ru-central1-b zone

Add the Edge Transport servers to Exchange

Set up a subscription on the `vm-edge-a` server

Set up a subscription on the vm-edge-b server

How to delete the resources you created