Exchange Server Management Tools: EMS, EAC & Options

Our Exchange Server support engineers work across every tool in this list daily, and each one answers a different class of task. Exchange ships with four management surfaces — the Exchange Management Shell, the admin center, the Toolbox, and a management-tools-only install mode — and Exchange Online adds two more. This page lists what each tool does, when it is the correct one, and the cmdlets that cover the routine tasks.

The toolset at a glance

Exchange Management Shell

The Exchange Management Shell is a PowerShell environment that connects to an Exchange server over remote PowerShell. Cmdlet availability is filtered by role-based access control (RBAC): an administrator sees only the cmdlets and parameters their assigned roles permit. EMS is installed on every Exchange server and with every management-tools install, and it is the only interface with complete coverage — parameters and entire cmdlets exist that never appear in the admin center.

Common tasks and their cmdlets:

Get-MessageTrackingLog is the on-premises equivalent of the Exchange Online message trace; it reads the transport logs on each server rather than a central store, so multi-server organizations pipe the server list into it.

Exchange admin center (on-premises)

The on-premises Exchange admin center is a web application hosted on Mailbox servers, reached at the /ecp virtual directory of the server URL. It replaced the Exchange Management Console from 2010 and covers recipients, permissions, compliance settings, organization configuration, mail flow rules, and certificate management. It runs in a browser from any machine that can reach the server, which is why the management-tools install does not include it — there is nothing to install client-side. Tasks it does not expose (a long tail of transport, database, and diagnostic settings) fall back to EMS. The console layout, access URLs, and its differences from the cloud version are covered in Exchange admin center.

Exchange Online admin center and EXO PowerShell

Exchange Online has its own admin center at admin.exchange.microsoft.com and its own PowerShell path: the Exchange Online PowerShell module, published to the PowerShell Gallery as ExchangeOnlineManagement and referred to by Microsoft as the EXO V3 module. It uses modern authentication, works with or without MFA, and connects over REST rather than WinRM remoting. The session starts with Connect-ExchangeOnline -UserPrincipalName [email protected]; older approaches (basic auth, New-PSSession with an OAuth token) are retired. Setup steps, certificate-based auth for unattended scripts, and the REST cmdlet differences are in how to connect to Exchange Online PowerShell. In hybrid organizations both toolsets stay in use: on-premises EMS for synced-object attributes, the EXO module for cloud mailbox settings.

Exchange Toolbox

The Toolbox is an MMC console installed alongside EMS. Its remaining tools are Queue Viewer (a GUI over the transport queues, useful when watching a queue drain during a mail flow incident), the Details Templates Editor (edits the address-book property pages Outlook displays), and a shortcut to the web-based Remote Connectivity Analyzer. Earlier versions bundled more utilities; most were retired or folded into the admin center. Queue Viewer is the piece that still sees regular use.

Management-tools-only install

Exchange Setup can install only the management tools — EMS plus Toolbox — on any domain-joined computer, including client versions of Windows, per the install the Exchange management tools documentation. The standard use is a management workstation, so administrators do not RDP into production servers to run EMS.

The second use is the last-Exchange-server scenario. Hybrid organizations that migrated every mailbox to Exchange Online historically still had to run one Exchange server just to edit Exchange attributes on synced objects. Since Exchange Server 2019 CU12, the updated management tools remove that requirement: install the tools from the latest Exchange 2019 CU on a domain-joined machine and manage recipients through the RecipientManagement PowerShell snap-in with no running Exchange server. The supported cmdlet set covers remote mailboxes, mail users, mail contacts, distribution groups, and email address policies — documented in manage recipients using the management tools. Conditions apply: all mailboxes must be in Exchange Online, directory sync stays in place, there is no EAC and no RBAC in this mode, and the last server must be shut down and cleaned up with the provided script — never uninstalled, because uninstalling removes Active Directory objects the tools depend on. Microsoft's newer alternative, transferring source of authority for Exchange attributes to the cloud, allows full decommissioning and is the direction for organizations that want no on-premises Exchange footprint at all.

Monitoring options

• Managed Availability. Built into Exchange since 2013: probes, monitors, and responders grouped into health sets, with automatic recovery actions up to service restarts and bugchecks. Get-ServerHealth and Get-HealthReport read the current state; the framework is documented under Managed Availability.
• SCOM. System Center Operations Manager with the Exchange management pack was the standard enterprise monitoring layer for Exchange; the management pack surfaces Managed Availability health sets rather than defining its own checks. Organizations without SCOM feed the same signals into other monitoring platforms via PowerShell or event log collection.
• Performance counters. Exchange publishes counters for RPC latency, database page reads, transport queues, and IIS request rates. Baseline values and thresholds are published in the Exchange Server performance documentation on learn.microsoft.com.
• Event logs and crimson channels. Managed Availability writes its probe and responder activity to the Microsoft-Exchange-ActiveMonitoring and ManagedAvailability crimson channels, which is where recycling and failover decisions are recorded.

Third-party administration tools

A commercial category exists around Exchange administration: reporting suites that aggregate mailbox statistics and permissions across servers, migration tools that move data between organizations, recovery tools that read EDB files outside the database engine, and monitoring products with prebuilt Exchange dashboards. They supplement the native toolset rather than replace it — every one of them ultimately drives the same PowerShell and API surfaces described above, and nothing in routine administration requires them. Evaluate them where the native tools have a genuine gap: cross-forest reporting, delegated helpdesk consoles with tighter scoping than RBAC roles, and long-term statistics retention are the common ones.

When tooling is not the constraint

The tools above cover administration by someone who already knows what to run and when. Coverage of the hours when no one is watching is a staffing question, not a tooling question. Our Exchange team handles monitoring, patching (CUs and SUs on release), transport incidents, DAG failovers, and hybrid management as a managed service, with engineers available around the clock.