[{"data":1,"prerenderedAt":1782},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"author-da-thorsten-kunzi-1f055f71c9741a":519,"content-da-thorsten-kunzi":549,"content-events-da-thorsten-kunzi":1770,"authors_data:Thorsten Kunzi|​Thorsten Kunzi​":1771},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"body":522,"description":528,"extension":533,"meta":534,"name":521,"navigation":325,"otherLanguages":535,"path":545,"seo":546,"stem":547,"__hash__":548},"authors/thorsten-kunzi.md","Thorsten Kunzi",{"type":523,"value":524,"toc":529},"minimal",[525],[526,527,528],"p",{},"Als Consultant in den Bereichen Exchange Online, Identity und Modern Workplace unterstützt Thorsten Kunzi seit vielen Jahren Kunden bei der Planung und Umsetzung von Cloud-Projekten. Aufgrund seiner Erfahrung im Bereich der On-Premises Active Directory Security ist er auch im Hardening aktiv und hilft als Teil der APT Response Taskforce bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":530,"searchDepth":531,"depth":531,"links":532},"",2,[],"md",{},{"en":536,"es":537,"sv":538,"fi":539,"da":540,"ko":541,"nl":542,"no":543,"ja":544},"As a consultant in the areas of Exchange Online, Identity and Modern Workplace, Thorsten Kunzi has been supporting customers in the planning and implementation of cloud projects for many years. Due to his experience in the area of on-premises Active Directory Security, he is also active in hardening and helps as part of the APT Response Taskforce with compromised or encrypted customer environments.","Como Consultant en las áreas de Exchange Online, Identity y Modern Workplace, Thorsten Kunzi lleva muchos años apoyando a los clientes en la planificación y ejecución de proyectos en la nube. Gracias a su experiencia en el ámbito de la seguridad de Active Directory on-premises, también trabaja en el hardening y ayuda, como parte de la APT Response Taskforce, en entornos de clientes comprometidos o cifrados.","Som Consultant inom områdena Exchange Online, Identity och Modern Workplace har Thorsten Kunzi i många år stöttat kunder i planeringen och genomförandet av molnprojekt. Tack vare sin erfarenhet inom on-premises Active Directory-säkerhet arbetar han även med hardening och hjälper som en del av APT Response Taskforce till i komprometterade eller krypterade kundmiljöer.","Consultantina Exchange Onlinen, Identityn ja Modern Workplacen alueilla Thorsten Kunzi on jo useiden vuosien ajan tukenut asiakkaita pilviprojektien suunnittelussa ja toteutuksessa. On-premises Active Directory -tietoturvan kokemuksensa ansiosta hän työskentelee myös hardeningin parissa ja auttaa osana APT Response Taskforce -tiimiä vaarantuneissa tai salatuissa asiakasympäristöissä.","Som Consultant inden for områderne Exchange Online, Identity og Modern Workplace har Thorsten Kunzi gennem mange år hjulpet kunder med planlægning og gennemførelse af cloud-projekter. På grund af sin erfaring inden for on-premises Active Directory-sikkerhed arbejder han også med hardening og hjælper som en del af APT Response Taskforce ved kompromitterede eller krypterede kundemiljøer.","Exchange Online, Identity, Modern Workplace 분야의 Consultant로서 Thorsten Kunzi는 오랜 기간 동안 고객의 클라우드 프로젝트 계획과 구현을 지원해 왔습니다. 온프레미스 Active Directory 보안 분야의 경험을 바탕으로 하드닝 작업에도 참여하고 있으며, APT Response Taskforce의 일원으로서 침해되거나 암호화된 고객 환경을 지원합니다.","Als Consultant voor Exchange Online, Identity en Modern Workplace ondersteunt Thorsten Kunzi klanten al vele jaren bij de planning en realisatie van cloudprojecten. Door zijn ervaring met On-Premises Active Directory Security is hij ook actief in hardening en helpt hij als onderdeel van de APT Response Taskforce bij gecompromitteerde of versleutelde klantomgevingen.","Som Consultant innen Exchange Online, Identity og Modern Workplace har Thorsten Kunzi i mange år bistått kunder med planlegging og gjennomføring av cloud-prosjekter. På grunn av erfaringen sin innen on-premises Active Directory Security er han også aktiv i hardening og hjelper som del av APT Response Taskforce ved kompromitterte eller krypterte kundemiljøer.","Exchange Online、Identity、Modern Workplaceの領域を担当するコンサルタントとして、Thorsten Kunziは長年にわたりクラウドプロジェクトの計画と実装でお客様を支援しています。オンプレミスのActive Directory Securityでの経験を活かしてHardeningにも携わり、APT Response Taskforceの一員として、侵害されたり暗号化されたりしたお客様環境に対応しています。","/thorsten-kunzi",{"title":521,"description":528},"thorsten-kunzi","YaiG705aTbfkaYxak0GKTbfT-5vntVpIpV6yaXJnw7I",[550,1133],{"id":551,"title":552,"author":553,"body":555,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":325,"layout":1106,"meta":1107,"moment":1111,"navigation":325,"path":1129,"seo":1130,"stem":1131,"tags":494,"webcast":484,"__hash__":1132},"content_da/posts/2026-01-27-exchange-active-directory.md","​​​Exchange AD Split Permissions uden fortrydelser​",[554],"​Thorsten Kunzi​",{"type":523,"value":556,"toc":1088},[557,562,565,572,576,603,606,610,616,631,637,640,644,680,699,704,710,719,723,739,743,750,754,764,769,774,793,797,823,827,847,855,871,885,945,949,973,990,1002,1015,1022,1026,1036,1047,1059,1063,1066,1069,1084],[558,559,561],"h3",{"id":560},"tldr-hvad-hvis-vi-fjerner-ulemperne","TLDR: hvad hvis vi fjerner ulemperne?",[526,563,564],{},"Jeg har fundet en måde at tildele AD- og RBAC-rettighederne igen der, hvor Exchange-brugerne, grupperne, kontakterne og så videre ligger. Dermed skal hverken administratorer eller identity management-systemer lægge om, og netop det har efter min erfaring været årsagen til, at de fleste virksomheder aldrig fik det implementeret. Samtidig beholder vi sikkerhedsgevinsten mod lateral movement og domænekompromittering.",[526,566,567],{},[568,569],"img",{"alt":570,"src":571},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[558,573,575],{"id":574},"det-opnås-i-tre-trin","Det opnås i tre trin:",[577,578,579,593,598],"ol",{},[580,581,582,583,590],"li",{},"Implementér ",[584,585,589],"a",{"href":586,"rel":587},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions",[588],"nofollow","AD split permission-modellen",[591,592],"br",{},[580,594,595,596],{},"Giv Exchange-serverne de tabte AD-rettigheder tilbage, men kun på de relevante OU’er",[591,597],{},[580,599,600,601],{},"Tildel Exchange RBAC for at genaktivere de manglende PowerShell-cmdletter",[591,602],{},[526,604,605],{},"Alt sammen via Microsofts vejledning, AD ACL’er eller Exchange RBAC-tildelinger.",[558,607,609],{"id":608},"hvorfor-er-det-vigtigt-nu","Hvorfor er det vigtigt (nu)?",[526,611,612,613,615],{},"Emnet er stort set blevet overset eller ignoreret, siden det blev introduceret med Exchange 2010 SP1. Men standardmodellen med delte rettigheder udgør en betydelig sikkerhedsrisiko for overtagelse af Active Directory. Kombineret med at Exchange gennem de seneste år har været berygtet for remote exploits, er det på tide at handle.",[591,614],{},"\nProblemet stammer fra privilegier, der tildeles i roden af et domæne og nedarves gennem hele domænet.",[617,618,619,622,625,628],"ul",{},[580,620,621],{},"ændre rettigheder på brugere og grupper (reelt fuld adgang)",[580,623,624],{},"ændre gruppemedlemmer",[580,626,627],{},"nulstille adgangskoder på brugere",[580,629,630],{},"oprette/slette brugere og grupper",[526,632,633],{},[568,634],{"alt":635,"src":636},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[526,638,639],{},"Kun bestemte højt privilegerede Tier0-brugere og -grupper er beskyttet af AdminSDHolder-processen (attributten admincount=1), og i mange miljøer findes der ubeskyttede brugere eller grupper, som kan give mulighed for at kompromittere domænet og/eller skoven eller i det mindste forvolde alvorlig skade.",[558,641,643],{"id":642},"fremtrædende-eksempler","Fremtrædende eksempler:",[617,645,646,649,669],{},[580,647,648],{},"Entra Connect Sync-kontoen, når der bruges PWHashSync",[580,650,651,652],{},"Standardgrupper\n",[617,653,654,657,666],{},[580,655,656],{},"Allowed RODC Password Replication Group sammen med EntraConnect-kontoen (hvis der findes en reel Windows RODC)",[580,658,659,660,665],{},"Se også ",[584,661,664],{"href":662,"rel":663},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[588],"Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps",", der viser flere veje (gruppen Account Operators udgør en tilsvarende trussel)",[580,667,668],{},"Tømning af Protected Users for at skabe angrebsvektorer ved at fjerne beskyttelser",[580,670,671,672],{},"Ubeskyttede brugerdefinerede grupper eller admin-/servicekonti\n",[617,673,674,677],{},[580,675,676],{},"Skriverettigheder på GPO’er (der anvendes på domænecontrollere)",[580,678,679],{},"Håndtering af adgang til AD-backups, backupserver, PKI-skabeloner, hypervisor, ...",[526,681,682,683,685,686,691,693,694],{},"Det er meget svært med tilbagevirkende kraft at inddæmme alle disse nuværende og fremtidige potentielle veje. For den brugerdefinerede OU _ADM kan du deaktivere ACL-nedarvning, men de fleste standardobjekter må ikke flyttes fra standard-OU’en Builtin eller containeren Users og forbliver sårbare.",[591,684],{},"\nDet er langt bedre at fjerne de vidtrækkende rettigheder fra roden, hvilket sker ved at implementere Active Directory split permissions-modellen. ",[584,687,690],{"href":688,"rel":689},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[588],"Configure Exchange Server for split permissions | Microsoft Learn",[591,692],{},"\nOg Microsoft er enig: “…encouraged to implement Active Directory split permissions” ",[584,695,698],{"href":696,"rel":697},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[588],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[700,701,703],"h2",{"id":702},"men-hvorfor-er-der-ingen-der-gør-det","Men hvorfor er der ingen, der gør det?",[526,705,706,707,709],{},"Da split permissions ikke fandtes før Exchange 2010 SP1, havde alle på det tidspunkt affundet sig med situationen, og det ser ud til, at sikkerhedsafdelingerne ikke fik presset det igennem, da muligheden endelig var der.",[591,708],{},"\nDet ville også have tvunget ændringer igennem i admin- og IDM-processer, som at oprette brugere eller distributionslister i AD først og derefter bruge Exchange til at “mail enable” dem.",[526,711,712,713,715],{},"Cmdletter, der ikke længere er tilgængelige eller virker:",[591,714],{},[716,717,718],"code",{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[558,720,722],{"id":721},"eksempler-på-omlægning","Eksempler på omlægning:",[617,724,725,736],{},[580,726,727,728],{},"New-Mailbox (hvor Exchange skriver til AD) ville blive:\n",[617,729,730,733],{},[580,731,732],{},"New-ADUser (hvor adm.jdoe skriver til AD)",[580,734,735],{},"Enable-Mailbox",[580,737,738],{},"Add-ADPermission for SendAs-rettigheder skulle udføres via Active Directory Users and Computers under fanen Security og krævede ofte yderligere AD-rettigheder til almindelige administratorer.",[700,740,742],{"id":741},"vis-mig-no-regrets-løsningen","Vis mig no-regrets-løsningen",[526,744,745,749],{},[746,747,748],"strong",{},"Ansvarsfraskrivelse",": Læs og forstå de følgende links og artikler fuldt ud, afprøv først i et testmiljø, og sørg for, at AD-backups er aktuelle, og at der er etableret recovery-procedurer.",[558,751,753],{"id":752},"kortlæg-den-nuværende-brug","Kortlæg den nuværende brug",[526,755,756,759,761],{},[746,757,758],{},"Du bør først undersøge, hvilke af de berørte cmdletter der er i brug på hvilke OU’er.",[591,760],{},[716,762,763],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[526,765,766],{},[716,767,768],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[526,770,771],{},[716,772,773],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[526,775,776,779,781,784,787,790],{},[746,777,778],{},"Hurtig analyse af caller og cmdletter:",[591,780],{},[716,782,783],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[716,785,786],{},"$CSVs|group Caller",[716,788,789],{},"$CSVs|group CmdletName",[716,791,792],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange relevant groups into dedicated OUs.",[558,794,796],{"id":795},"aktivér-split-permissions-modellen","Aktivér split permissions-modellen",[526,798,799,806,808,809,811,814,816,819,820],{},[746,800,801,802,805],{},"Følg anvisningerne under “Switch to Active Directory split permissions” i ",[584,803,690],{"href":586,"rel":804},[588]," (IKKE RBAC split permissions)",[591,807],{},"\nKort fortalt fjerner det de farlige rettigheder fra gruppen “Exchange Windows Permissions” og fjerner samtidig Exchange som gruppemedlem.",[591,810],{},[716,812,813],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[591,815],{},[746,817,818],{},"Brug blot dette for at rulle tilbage:"," ",[716,821,822],{},"/ActiveDirectorySplitPermissions:false",[558,824,826],{"id":825},"tildel-ad-rettigheder","Tildel AD-rettigheder",[526,828,829,832,834,835,837,840,842,844],{},[746,830,831],{},"Opret en brugerdefineret AD-gruppe, og gør Exchange-serverne til medlemmer.",[591,833],{},"\ntilpas OU-stien først!",[591,836],{},[716,838,839],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[591,841],{},[591,843],{},[716,845,846],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[526,848,849,852,854],{},[746,850,851],{},"genstart Exchange-serverne, for at rettigheder via gruppen kan træde i kraft",[591,853],{},"\nJeg har lavet et script, der gør det nemt at delegere AD-rettighederne pr. use case.",[856,857,858],"blockquote",{},[526,859,860,866,867,870],{},[746,861,862],{},[863,864,865],"em",{},"INFO:"," Uden disse rettigheder vil Exchange-serveren modtage fejlen ",[716,868,869],{},"“INSUFF_ACCESS_RIGHTS”"," fra AD.",[526,872,873,882,884],{},[746,874,875,876,881],{},"Download ",[584,877,880],{"href":878,"rel":879},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[588],"Add-ExchangeADSplitPermissionOnOU.ps1"," fra glueckkanja GitHub",[591,883],{},"\nDet kan tildele følgende PermissionTypes:",[617,886,887,900,920,933],{},[580,888,889,892],{},[746,890,891],{},"CreateUserAndContact",[617,893,894,897],{},[580,895,896],{},"Create/delete, ResetPassword og WriteAllProperties for Users og Contacts",[580,898,899],{},"Exchange-cmdletter: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact og de tilsvarende Remove-*",[580,901,902,905],{},[746,903,904],{},"GroupManage",[617,906,907,910,913],{},[580,908,909],{},"Create/Delete Groups, Modify Member",[580,911,912],{},"Exchange-cmdletter: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[580,914,915,916],{},"Yderligere use cases: brugere, der administrerer de DistributionGroups, de ejer, via https://",[917,918,919],"on-prem-exchange",{},"/EAC",[580,921,922,925],{},[746,923,924],{},"UserSendAs",[617,926,927,930],{},[580,928,929],{},"Modfiy AD Permissions on Users",[580,931,932],{},"Exchange-cmdlet: Add-ADPermission",[580,934,935,938],{},[746,936,937],{},"GroupSendAs",[617,939,940,943],{},[580,941,942],{},"Modfiy AD Permissions on Groups",[580,944,932],{},[558,946,948],{"id":947},"sådan-bruger-du-scriptet","Sådan bruger du scriptet:",[526,950,951],{},[716,952,953,819,956,819,962,819,965,819,970],{},[716,954,955],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[957,958,959],"b",{},[716,960,961],{},"\u003COU>",[716,963,964],{},"-PermissionType",[957,966,967],{},[716,968,969],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[716,971,972],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[526,974,975,976,978],{},"f.eks.",[591,977],{},[716,979,980,819,983,819,987],{},[716,981,982],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,984,985],{},[716,986,904],{},[716,988,989],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[526,991,992],{},[716,993,994,819,996,819,1000],{},[716,995,982],{},[957,997,998],{},[716,999,937],{},[716,1001,989],{},[526,1003,1004],{},[716,1005,1006,819,1009,819,1013],{},[716,1007,1008],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,1010,1011],{},[716,1012,924],{},[716,1014,989],{},[526,1016,1017],{},[716,1018,1019],{},[716,1020,1021],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[558,1023,1025],{"id":1024},"tildel-exchange-rbac","Tildel Exchange RBAC",[526,1027,1028,1031,1033],{},[746,1029,1030],{},"Genaktivér parameteren -BypassSecurityGroupManagerCheck for cmdletterne Add-DistributionGroupMember og Remove-DistributionGroupMember:",[591,1032],{},[716,1034,1035],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[856,1037,1038],{},[526,1039,1040,819,1044,1046],{},[746,1041,1042],{},[863,1043,865],{},[591,1045],{},"Ellers får du \"-BypassSecurityGroupManagerCheck parameter is not available\" eller \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1048,1049,1051,1054,1056],{},[591,1050],{},[746,1052,1053],{},"Genaktivér cmdletterne New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... med de nødvendige parametre:",[591,1055],{},[716,1057,1058],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1060,1062],{"id":1061},"konklusion","Konklusion",[526,1064,1065],{},"Jeg håber, at mange flere med denne vejledning tager det vigtige skridt og sikrer deres Active Directory mod kompromittering via Exchange. Jeg er endnu ikke stødt på problemer, hverken da jeg implementerede Exchange AD split permissions-modellen eller ved den omlægning, artiklen her beskriver, hos vores kunder.",[526,1067,1068],{},"Jeg håber, at Microsoft implementerer en indbygget måde at opnå denne granulære, OU-baserede tilgang på i stedet for den nuværende alt eller intet, så den kan blive udbredt.",[526,1070,1071,1072,1077,1078,1083],{},"Da AD Tiering ligger mig meget på sinde: Log desuden ikke på Exchange-servere med Domain Admin-konti (eller nogen anden Tier0-konto), men behandl dem som Tier1 fra nu af, og implementér AD Tiering hurtigst muligt.\nSom første skridt anbefaler jeg værktøjer som ",[584,1073,1076],{"href":1074,"rel":1075},"https://www.pingcastle.com/",[588],"PingCastle"," eller ",[584,1079,1082],{"href":1080,"rel":1081},"https://www.semperis.com/purple-knight/",[588],"Purple Knight"," til at vurdere jeres AD-sikkerhed og control paths.",[1085,1086,1087],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":530,"searchDepth":531,"depth":531,"links":1089},[1090,1092,1093,1094,1095,1098,1105],{"id":560,"depth":1091,"text":561},3,{"id":574,"depth":1091,"text":575},{"id":608,"depth":1091,"text":609},{"id":642,"depth":1091,"text":643},{"id":702,"depth":531,"text":703,"children":1096},[1097],{"id":721,"depth":1091,"text":722},{"id":741,"depth":531,"text":742,"children":1099},[1100,1101,1102,1103,1104],{"id":752,"depth":1091,"text":753},{"id":795,"depth":1091,"text":796},{"id":825,"depth":1091,"text":826},{"id":947,"depth":1091,"text":948},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},"post",{"lang":1108,"seoTitle":1109,"titleClass":1110,"date":1111,"blogtitlepic":1112,"socialimg":1113,"customExcerpt":1114,"keywords":1115,"scripts":1116,"asideNav":1117,"maxContent":325,"published":484},"da","Exchange AD Split Permissions: Sikr Active Directory med least privilege","h2-font-size","2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-premises Exchange Server-installationer er stadig udbredte, også i organisationer, der har flyttet alle postkasser til skyen. De har fortsat vidtrækkende rettigheder i Active Directory, og derfor findes der som regel en oplagt angrebsvej til at kompromittere hele AD’et og dermed store dele af virksomhedens IT. Skiftet til den såkaldte »AD split permissions«-model fjerner de kritiske rettigheder, og jeg har udviklet en løsning, der fjerner de ulemper, som hidtil har forhindret udbredelsen.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange-rettigheder, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1118},[1119,1121,1123,1125,1127],{"href":1120,"text":561},"#tldr-hvad-hvis-vi-fjerner-ulemperne",{"href":1122,"text":609},"#hvorfor-er-det-vigtigt-nu",{"href":1124,"text":703},"#men-hvorfor-er-der-ingen-der-gør-det",{"href":1126,"text":742},"#vis-mig-no-regrets-løsningen",{"href":1128,"text":1062},"#konklusion","/posts/2026-01-27-exchange-active-directory",{"title":552,"description":530},"posts/2026-01-27-exchange-active-directory","6t3oJRhaDzM5GzP8GT1sAaaFKZqn_pZwHth7rg6_79k",{"id":1134,"title":1135,"author":1136,"body":1137,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":484,"layout":1106,"meta":1750,"moment":1751,"navigation":325,"path":1766,"seo":1767,"stem":1768,"tags":494,"webcast":484,"__hash__":1769},"content_da/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions uden fortrydelse",[521],{"type":523,"value":1138,"toc":1737},[1139,1141,1144,1148,1153,1166,1169,1176,1181,1185,1193,1203,1208,1211,1215,1248,1266,1270,1278,1286,1291,1305,1309,1315,1317,1322,1382,1387,1424,1427,1429,1443,1450,1466,1475,1477,1479,1525,1528,1535,1541,1544,1558,1574,1586,1597,1601,1659,1661,1666,1686,1693,1717,1719,1722,1725,1735],[700,1140,561],{"id":560},[526,1142,1143],{},"Jeg har fundet en måde at gentildele AD- og RBAC-rettigheder præcis dér, hvor Exchange-brugere, -grupper og -kontakter ligger, uden at det kræver ændringer for administratorer eller identity management-systemer. Efter min erfaring har netop den friktion været den primære blokering for de fleste virksomheder. Og vi beholder stadig sikkerhedsgevinsten mod lateral movement og domænekompromittering.",[526,1145,1146],{},[568,1147],{"alt":570,"src":571},[526,1149,1150],{},[746,1151,1152],{},"Det sker i tre trin:",[577,1154,1156,1160,1163],{"style":1155},"margin: 0.25rem 0",[580,1157,582,1158],{},[584,1159,589],{"href":586},[580,1161,1162],{},"Giv Exchange-serverne de tabte AD-rettigheder tilbage, men kun på de relevante OU'er",[580,1164,1165],{},"Tildel Exchange RBAC for at genaktivere de manglende PowerShell-cmdlets",[526,1167,1168],{},"Alt sammen via Microsofts vejledning, AD-ACL'er eller Exchange RBAC-tildelinger.",[1170,1171],"video-frame",{"thumb":1172,"alt":1173,"id":1174,":full-width":1175},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","En oplægsholder sidder foran en bærbar computer og forklarer et slide med titlen Step 1: Active Directory Permissions fra glueckkanja. Slidet gennemgår, hvordan man implementerer Microsoft Exchange AD Split Permissions, herunder PowerShell-kommandoer til at oprette en delegeringsgruppe (New-ADGroup, Add-ADGroupMember) og tildele rettigheder via scriptet Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[1177,1178,1180],"div",{"style":1179},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions uden fortrydelse. En trin-for-trin-implementeringsguide",[700,1182,1184],{"id":1183},"hvorfor-er-det-relevant-nu","Hvorfor er det relevant (nu)?",[526,1186,1187,1188,1190,1192],{},"Modellen er stort set blevet overset eller ignoreret, siden den kom med Exchange 2010 SP1. Men standardmodellen med delte rettigheder udgør en stor sikkerhedsrisiko for en overtagelse af Active Directory. Kombineret med at Exchange de seneste år har været berygtet for remote exploits, er det på tide at handle.",[591,1189],{},[591,1191],{},"\nProblemet stammer fra rettigheder, der tildeles på roden af et domæne og nedarves gennem hele domænet.",[617,1194,1195,1197,1199,1201],{"style":1155},[580,1196,621],{},[580,1198,624],{},[580,1200,627],{},[580,1202,630],{},[526,1204,1205],{},[568,1206],{"alt":1207,"src":636},"Rettigheder",[526,1209,1210],{},"Kun visse højt privilegerede Tier 0-brugere og -grupper er beskyttet af AdminSDHolder-processen (attributten admincount=1), og i mange miljøer findes der ubeskyttede brugere eller grupper, som kan gøre det muligt at kompromittere domænet og/eller skoven eller i det mindste forvolde alvorlig skade.",[526,1212,1213],{},[746,1214,643],{},[617,1216,1217,1220,1237],{"style":1155},[580,1218,1219],{},"Entra Connect Sync-kontoen, når Password Hash Sync anvendes",[580,1221,1222,1223],{},"Standardgrupper",[617,1224,1226,1229,1235],{"style":1225},"margin: 0",[580,1227,1228],{},"Allowed RODC Password Replication Group sammen med Entra Connect-kontoen (hvis der findes en rigtig Windows RODC)",[580,1230,659,1231,1234],{},[584,1232,664],{"href":1233,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta",", der viser flere angrebsveje (gruppen Account Operators er en tilsvarende trussel)",[580,1236,668],{},[580,1238,1239,1240],{},"Ubeskyttede brugerdefinerede grupper eller admin-/servicekonti",[617,1241,1242,1245],{"style":1225},[580,1243,1244],{},"Skriverettigheder på GPO'er (som gælder for domænecontrollere)",[580,1246,1247],{},"Styring af adgang til AD-backups, backupserver, PKI-skabeloner, hypervisor, ...",[526,1249,1250,1251,1253,1255,1256,1259,1261,693,1263],{},"Det er meget svært at inddæmme alle disse nuværende og fremtidige potentielle angrebsveje bagudrettet. For den brugerdefinerede _ADM-OU kan du slå ACL-nedarvning fra, men de fleste standardobjekter må ikke flyttes fra standard-OU'en Builtin eller containeren Users og forbliver dermed sårbare.",[591,1252],{},[591,1254],{},"\nDet er langt bedre at fjerne de kraftfulde rettigheder fra roden, hvilket sker ved at implementere Active Directory split permissions-modellen. ",[584,1257,690],{"href":688,"rel":1258},[588],[591,1260],{},[591,1262],{},[584,1264,698],{"href":696,"rel":1265},[588],[700,1267,1269],{"id":1268},"men-hvorfor-gør-ingen-det","Men hvorfor gør ingen det?",[526,1271,1272,1273,1275,1277],{},"Da split permissions ikke var tilgængelige før Exchange 2010 SP1, havde alle for længst accepteret status quo, og det ser ud til, at sikkerhedsteams ikke fik skubbet modellen igennem, da den først fandtes.",[591,1274],{},[591,1276],{},"\nOg den ville have tvunget ændringer igennem i admin- og IDM-processer, som at oprette brugere eller distributionslister i AD først og derefter bruge Exchange til at “mail enable” dem.",[856,1279,1280],{},[526,1281,1282,1285],{},[746,1283,1284],{},"Info:"," Følgende cmdlets vil ikke længere være tilgængelige eller fungere: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[526,1287,1288],{},[746,1289,1290],{},"Eksempler på tilpasning:",[617,1292,1293,1302],{"style":1155},[580,1294,1295,1296],{},"New-Mailbox (hvor Exchange skriver til AD) ville blive:",[617,1297,1298,1300],{"style":1225},[580,1299,732],{},[580,1301,735],{},[580,1303,1304],{},"Add-ADPermission til SendAs-rettigheder ville skulle udføres via AD-brugere og -computere under fanen Sikkerhed, og det kræver ofte yderligere AD-rettigheder til almindelige administratorer.",[700,1306,1308],{"id":1307},"vis-mig-den-her-no-regrets-mulighed","Vis mig den her no-regrets-mulighed",[526,1310,1311,1314],{},[746,1312,1313],{},"Disclaimer",": Læs og forstå de følgende links og artikler fuldt ud, afprøv det i et testmiljø først, og sørg for, at AD-backups er aktuelle, og at genoprettelsesprocedurer er på plads.",[558,1316,753],{"id":752},[526,1318,1319],{},[746,1320,1321],{},"Du bør først undersøge, hvilke af de berørte cmdlets der bruges på hvilke OU'er:",[1323,1324,1325,1333,1335,1341,1343],"code-block",{},[1326,1327,1328,1332],"span",{},[1326,1329,1331],{"style":1330},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,1334],{},[1326,1336,1337,1340],{},[1326,1338,1339],{"style":1330},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,1342],{},[1326,1344,1345,819,1348,1352,1353,819,1356,1358,1359,1362,1363,819,1366,819,1369,819,1371,1374,1375,1378,1379],{},[1326,1346,1347],{"style":1330},"Search-AdminAuditLog",[1326,1349,1351],{"style":1350},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1326,1354,1355],{"style":1350},"-Cmdlets",[1326,1357,1339],{"style":1330}," | ",[1326,1360,1361],{"style":1330},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1326,1364,1365],{"style":1330},"Export-Csv",[1326,1367,1368],{"style":1350},"-Path",[1326,1370,1331],{"style":1330},[1326,1372,1373],{"style":1350},"-Delimiter"," \";\" ",[1326,1376,1377],{"style":1350},"-Encoding"," Unicode ",[1326,1380,1381],{"style":1350},"-NoTypeInformation",[526,1383,1384],{},[746,1385,1386],{},"Hurtig analyse af caller og cmdlets:",[1323,1388,1389,1405,1407,1415,1417],{},[1326,1390,1391,1394,1395,819,1398,819,1400,819,1402,1404],{},[1326,1392,1393],{"style":1330},"$CSVs"," = ",[1326,1396,1397],{"style":1330},"Import-Csv",[1326,1399,1368],{"style":1350},[1326,1401,1331],{"style":1330},[1326,1403,1373],{"style":1350}," \";\"",[591,1406],{},[1326,1408,1409,1358,1411,1414],{},[1326,1410,1393],{"style":1330},[1326,1412,1413],{"style":1330},"Group-Object"," Caller",[591,1416],{},[1326,1418,1419,1358,1421,1423],{},[1326,1420,1393],{"style":1330},[1326,1422,1413],{"style":1330}," CmdletName",[526,1425,1426],{},"Analysér CSV-filen for at finde ud af, hvor AD-rettighederne bliver nødvendige. Du kan eventuelt optimere ved at flytte alle Exchange-relevante grupper ind i dedikerede OU'er.",[700,1428,796],{"id":795},[526,1430,1431,1432,1435,1436,1440],{},"Følg Microsofts vejledning ",[746,1433,1434],{},"\"Switch to Active Directory split permissions\""," i\n",[584,1437,690],{"href":1438,"rel":1439},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[588],[863,1441,1442],{},"(IKKE RBAC split permissions)",[526,1444,1445,1446,1449],{},"Kort fortalt fjerner den de farlige rettigheder fra gruppen ",[746,1447,1448],{},"\"Exchange Windows Permissions\""," og fjerner samtidig Exchange som medlem af gruppen.",[1323,1451,1452],{},[1326,1453,1454,819,1457,819,1460,819,1463],{},[1326,1455,1456],{"style":1330},"Setup.exe",[1326,1458,1459],{"style":1350},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1326,1461,1462],{"style":1350},"/PrepareAD",[1326,1464,1465],{"style":1350},"/ActiveDirectorySplitPermissions:true",[1177,1467,1469,1470,1472,1473],{"style":1468},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[746,1471,1284],{}," For at rulle tilbage bruger du blot ",[716,1474,822],{},[558,1476,826],{"id":825},[526,1478,831],{},[1323,1480,1481,1487,1489,819,1492,1495,1496,1499,1500,1503,1504,819,1506,819,1509,1512,1513,1515,1495,1518,1521,1522],{},[1326,1482,1483],{},[1326,1484,1486],{"style":1485},"color:var(--color-black-40)","# adjust OU Path first!",[591,1488],{},[1326,1490,1491],{"style":1330},"New-ADGroup",[1326,1493,1494],{"style":1350},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1326,1497,1498],{"style":1350},"-GroupCategory"," Security ",[1326,1501,1502],{"style":1350},"-GroupScope"," DomainLocal ",[1326,1505,1368],{"style":1350},[746,1507,1508],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1326,1510,1511],{"style":1350},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,1514],{},[1326,1516,1517],{"style":1330},"Add-ADGroupMember",[1326,1519,1520],{"style":1350},"-Members"," \"Exchange Trusted Subsystem\"\n",[1326,1523,1524],{"style":1485},"# reboot Exchange servers for permissions via group to work",[526,1526,1527],{},"Jeg har lavet et script, der gør det nemt at delegere AD-rettighederne pr. use case.",[856,1529,1530],{},[526,1531,1532,1533,870],{},"Uden disse rettigheder ville Exchange-serveren få fejlen ",[716,1534,869],{},[526,1536,875,1537,1540],{},[584,1538,880],{"href":878,"rel":1539},[588]," fra glueckkanjas GitHub",[526,1542,1543],{},"Scriptet kan tildele følgende PermissionTypes:",[526,1545,1547,1549,1551,1552,1554],{"style":1546},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[746,1548,891],{},[591,1550],{},"Create/delete, ResetPassword og WriteAllProperties for brugere og kontakter",[591,1553],{},[1555,1556,1557],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` og tilsvarende `Remove-*`",[526,1559,1561,1563,1565,1566,1568],{"style":1560},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[746,1562,904],{},[591,1564],{},"Opret/slet grupper, ændr medlemmer",[591,1567],{},[1555,1569,1570,1571,1573],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1572],{},"Desuden: brugere, der administrerer de DistributionGroups, de ejer, via EAC",[526,1575,1576,1578,1580,1581,1583],{"style":1560},[746,1577,924],{},[591,1579],{},"Ændr AD-rettigheder på brugere",[591,1582],{},[1555,1584,1585],{},"Exchange-cmdlet: `Add-ADPermission`",[526,1587,1588,1590,1592,1593,1595],{"style":1560},[746,1589,937],{},[591,1591],{},"Ændr AD-rettigheder på grupper",[591,1594],{},[1555,1596,1585],{},[526,1598,1599],{},[746,1600,948],{},[1323,1602,1603,819,1605,1608,1609,1611,1612,1615,1616,1619,1621,819,1623,1625,1626,1628,1629,1615,1631,819,1633,1625,1635,1637,1638,1615,1640,819,1642,1644,1645,1647,1648,1615,1650,819,1652,1644,1654,1656,1657,1615],{},[1326,1604,880],{"style":1330},[1326,1606,1607],{"style":1350},"-TargetOU"," \u003COU> ",[1326,1610,964],{"style":1350}," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1326,1613,1614],{"style":1350},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1326,1617,1618],{"style":1485},"# For example",[591,1620],{},[1326,1622,880],{"style":1330},[1326,1624,1607],{"style":1350}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1326,1627,964],{"style":1350}," GroupManage ",[1326,1630,1614],{"style":1350},[1326,1632,880],{"style":1330},[1326,1634,1607],{"style":1350},[1326,1636,964],{"style":1350}," GroupSendAs ",[1326,1639,1614],{"style":1350},[1326,1641,880],{"style":1330},[1326,1643,1607],{"style":1350}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1326,1646,964],{"style":1350}," UserSendAs ",[1326,1649,1614],{"style":1350},[1326,1651,880],{"style":1330},[1326,1653,1607],{"style":1350},[1326,1655,964],{"style":1350}," CreateUserAndContact ",[1326,1658,1614],{"style":1350},[558,1660,1025],{"id":1024},[526,1662,1663],{},[746,1664,1665],{},"Genaktivér parameteren -BypassSecurityGroupManagerCheck for cmdlet'erne Add-DistributionGroupMember og Remove-DistributionGroupMember:",[1323,1667,1668],{},[1326,1669,1670,819,1673,1675,1676,1679,1680,1682,1683,1685],{},[1326,1671,1672],{"style":1330},"New-RoleGroup",[1326,1674,1494],{"style":1350}," \"SplitPermission Security Group Creation and Membership\" ",[1326,1677,1678],{"style":1350},"-Roles"," \"Security Group Creation and Membership\" ",[1326,1681,1520],{"style":1350}," \"Organization Management\",\"Recipient Management\" ",[1326,1684,1511],{"style":1350}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[856,1687,1688],{},[526,1689,1690,1692],{},[746,1691,1284],{}," Ellers får du \"-BypassSecurityGroupManagerCheck parameter is not available\" eller \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1694,1695,1697,1700,1702],{},[591,1696],{},[746,1698,1699],{},"Genaktivér New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... cmdlets med de nødvendige parametre:",[591,1701],{},[1323,1703,1704,819,1706,1708,1709,1711,1712,1682,1714,1716],{},[1326,1705,1672],{"style":1330},[1326,1707,1494],{"style":1350}," \"SplitPermission Mail Recipient Creation\" ",[1326,1710,1678],{"style":1350}," \"Mail Recipient Creation\" ",[1326,1713,1520],{"style":1350},[1326,1715,1511],{"style":1350}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1718,1062],{"id":1061},[526,1720,1721],{},"Jeg håber, at denne guide hjælper flere organisationer med at tage det vigtige skridt og sikre deres Active Directory mod kompromittering via Exchange. Med min erfaring fra implementeringer af Exchange AD Split Permissions-modellen hos flere kunder har jeg ikke stødt på problemer, og indførelsen er forløbet uden bump.",[526,1723,1724],{},"Jeg håber også, at Microsoft indfører en indbygget, OU-baseret tilgang til at opnå denne granularitet i stedet for den nuværende alt-eller-intet-model, hvilket ville gøre en bred udbredelse betydeligt lettere.",[526,1726,1727,1728,1077,1731,1734],{},"En bemærkning om AD Tiering: Log ikke på Exchange-servere med Domain Admin eller andre Tier 0-konti. Behandl Exchange-servere som Tier 1, og implementér AD Tiering hurtigst muligt. Som første skridt anbefaler jeg ",[584,1729,1076],{"href":1074,"rel":1730},[588],[584,1732,1082],{"href":1080,"rel":1733},[588]," til at vurdere jeres AD-sikkerhed og identificere control path-eksponeringer.",[1085,1736,1087],{},{"title":530,"searchDepth":531,"depth":531,"links":1738},[1739,1740,1741,1742,1745,1749],{"id":560,"depth":531,"text":561},{"id":1183,"depth":531,"text":1184},{"id":1268,"depth":531,"text":1269},{"id":1307,"depth":531,"text":1308,"children":1743},[1744],{"id":752,"depth":1091,"text":753},{"id":795,"depth":531,"text":796,"children":1746},[1747,1748],{"id":825,"depth":1091,"text":826},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},{"lang":1108,"seoTitle":1109,"titleClass":1110,"date":1751,"blogtitlepic":1752,"socialimg":1753,"customExcerpt":1754,"keywords":1115,"scripts":1755,"asideNav":1756,"maxContent":325,"published":325},"2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Selv organisationer, der har flyttet alle deres postkasser til skyen, kører ofte stadig Exchange-servere on-premises, og dermed en undervurderet sikkerhedsrisiko for Active Directory. Modellen »AD Split Permissions« fratager Exchange de brede AD-rettigheder, som angribere kan udnytte til at kompromittere hele domænet. Indtil nu er udbredelsen først og fremmest strandet på de procesændringer, modellen pålægger administratorerne. Denne artikel viser, hvordan du kommer elegant over netop den forhindring: et script, der målrettet gentildeler de tabte AD-rettigheder, men kun på de relevante OU'er, så det vante admin-workflow bevares, mens du stadig får den fulde sikkerhedsgevinst.",{"slick":325,"form":325},{"menuItems":1757},[1758,1759,1761,1763,1765],{"href":1120,"text":561},{"href":1760,"text":1184},"#hvorfor-er-det-relevant-nu",{"href":1762,"text":1269},"#men-hvorfor-gør-ingen-det",{"href":1764,"text":1308},"#vis-mig-den-her-no-regrets-mulighed",{"href":1128,"text":1062},"/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":1135,"description":530},"posts/2026-03-01-exchange-ad-split-permissions-hardening","-0_7SSTyRnUvpyYd2FqIKPjq-i0dqoVZ1KV9WTQ8gtI",[],{"id":1772,"extension":1773,"meta":1774,"stem":8,"__hash__":1781},"authors_data/authors.json","json",{"Thorsten Kunzi":1775},{"display_name":521,"avatar":1776,"permalink":1777,"twitter":1778,"linkedin":1779,"imageOffsetTop":1780},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi","glueckkanjagab","company/glueckkanja-gab","72%","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383993812]