[{"data":1,"prerenderedAt":1786},["ShallowReactive",2],{"sc:header-data-is":3,"sc:footer-data-is":489,"author-is-thorsten-kunzi-1f055f71c9741a":518,"content-is-thorsten-kunzi":548,"content-events-is-thorsten-kunzi":1774,"authors_data:Thorsten Kunzi|​Thorsten Kunzi​":1775},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"is":13},{"title":14,"url":15,"alt":16},"Heim","/is","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"is":21},{"title":22,"description":23},"Workplace","Knúið af Microsoft 365 fyrir snjalla, örugga og sveigjanlega vinnustaði, með nútímalegri tækni og auðkennisþjónustum samþættum.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"is":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"is":34},{"title":35,"url":36},"Managed Intune","/is/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"is":40},{"title":41,"url":42},"Managed Entra","/is/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"is":46},{"title":47,"url":48},"Managed Workplace","/is/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"is":52},{"title":53,"url":54},"Consulting Services","/is/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"is":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"is":64},{"title":65,"url":66},"Microsoft Entra Suite","/is/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"is":70},{"title":71,"url":72},"Microsoft Intune","/is/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"is":76},{"title":77,"url":78},"Microsoft Windows","/is/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"is":82},{"title":83,"url":84},"Windows 365 Cloud PC","/is/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"is":88},{"title":89,"url":90},"Cloud Workplace Foundation","/is/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"is":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"is":100},{"title":101,"url":102},"Microsoft 365 Copilot","/is/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"is":106},{"title":107,"url":108},"Teams","/is/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"is":112},{"title":113,"url":114},"SharePoint & Power Platform","/is/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"is":118},{"title":119,"url":120},"Exchange Online","/is/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"is":124},{"title":125,"url":126},"Information Protection & Compliance","/is/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"is":130},{"title":131,"description":132},"Azure","Vöxtur með Azure: lækkaðu cloud-kostnað, auktu skilvirkni og knýðu áfram nýsköpun með IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"is":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"is":142},{"title":143,"url":144},"Azure Managed Services","/is/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"is":148},{"title":149,"url":150},"Azure Consulting","/is/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"is":154},{"title":155},"Sviðsmyndir",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"is":160},{"title":161,"url":162},"Skipuleggðu skýið þitt","/is/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"is":166},{"title":167,"url":168},"Flyttu í skýið","/is/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"is":172},{"title":173,"url":174},"Nýsköpun í rekstrinum þínum","/is/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"is":178},{"title":179,"url":180},"Endurhugsaðu VMware-stefnuna þína","/is/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"is":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"is":190},{"title":191,"url":192},"Azure Foundation","/is/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"is":196},{"title":197,"url":198},"Azure AI Foundation","/is/azure/azure-ai-foundation",{"name":86,"languages":200},{"is":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"is":205},{"title":206,"url":207},"Azure Data Foundation","/is/azure/azure-data-foundation",{"name":188,"languages":209},{"is":210},{"title":211,"url":212},"Azure Container Foundation","/is/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"is":216},{"title":217,"url":218},"Managed Dark Tenant","/is/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"is":222},{"title":223,"url":224},"Cloud Adoption Framework","/is/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"is":228},{"title":229,"url":230},"Cloud Competence Center","/is/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"is":234},{"title":235,"description":236,"emergency":237},"Security","Árvekni í skýinu með margverðlaunaðri 24/7 managed service, incident response og nútímalegri vörn fyrir innviðina þína.",{"text":238,"href":239,"skin":240,"icon":241},"Undir árás?","/is/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"is":249},{"title":250,"url":251},"Managed Red Tenant","/is/security/managed-red-tenant",{"name":214,"languages":253},{"is":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"is":259},{"title":260,"url":261},"Sentinel Data Lake","/is/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"is":265},{"title":266,"url":267},"Security Consulting","/is/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"is":274},{"title":275,"url":276},"Cloud Security Operations Center","/is/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"is":280},{"title":281,"url":282},"Global Secure Access","/is/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"is":286},{"title":287,"url":288},"MyWorkID","/is/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"is":295},{"title":296,"url":297},"Preventive Services","/is/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"is":301},{"title":302,"url":303},"Data Security Service","/is/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"is":307},{"title":308,"url":309},"Security Copilot Agents","/is/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"is":313},{"title":314,"url":315},"Innleiðing NIS2","/is/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"is":319},{"title":320,"description":321},"Vörur","Fylgivörur fyrir öruggt, 100 % cloud-native Microsoft-umhverfi sem styrkja samstarf, netauðkenningu og hugbúnaðarstjórnun.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"is":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Skýbundin hugbúnaðardreifing",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"is":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Skírteinadreifing úr skýinu",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"is":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Vinndu með staðbundnu Office 365-gögnin þín",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"is":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Flyttu gögnin þín milli netþjóna",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"is":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"is":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Auðkenning fyrir netið þitt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"is":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finndu tengiliði í Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"is":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Rauntímaeftirlit með Windows Autopilot",{"name":396,"languages":397},"casestudies",{"is":398},{"title":399,"url":400,"description":401},"Case Studies","/is/casestudies","Frumkvöðull í skýinu: Microsoft-samstarfsaðilinn þinn fyrir cloud-lausnir með blueprint-nálgun og sérþekkingu í Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"is":405},{"title":406,"description":401},"Fyrirtækið",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"is":411},{"title":412},"Um okkur",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"is":417},{"title":418,"url":419},"Staðreyndir og tölur","/is/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"is":423},{"title":424,"url":425},"Tengiliðir og staðsetningar","/is/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"is":429},{"title":430,"url":431}," glueckkanja Switzerland","/is/company/switzerland",{"name":433,"languages":434},"austria",{"is":435},{"title":436,"url":437},"glueckkanja Austria","/is/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"is":441},{"title":442},"Störf",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"is":447},{"title":448,"url":449},"Yfirlit yfir störf","/is/career",{"name":451,"languages":452},"company-young-professionals",{"is":453},{"title":454,"url":455},"Young Professionals","/is/young-professionals",{"name":457,"languages":458},"company-jobs",{"is":459},{"title":460,"url":461},"Laus störf","/is/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"is":465},{"title":466},"Nýjast",[468,474],{"name":469,"languages":470},"company-blog",{"is":471},{"title":472,"url":473},"Blogg","/is/blog",{"name":469,"languages":475},{"is":476},{"title":477,"url":478},"Viðburðir","/is/events",[480],{"name":481,"languages":482},"career-meta",{"is":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"is":487},{"title":488,"url":425,"active":484},"Tengiliður",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksIs":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/is/privacy",{"title":514,"url":515},"Imprint","/is/imprint",{"title":507,"url":517},"/is/cookies",{"id":519,"title":520,"body":521,"description":527,"extension":532,"meta":533,"name":520,"navigation":325,"otherLanguages":534,"path":544,"seo":545,"stem":546,"__hash__":547},"authors/thorsten-kunzi.md","Thorsten Kunzi",{"type":522,"value":523,"toc":528},"minimal",[524],[525,526,527],"p",{},"Als Consultant in den Bereichen Exchange Online, Identity und Modern Workplace unterstützt Thorsten Kunzi seit vielen Jahren Kunden bei der Planung und Umsetzung von Cloud-Projekten. Aufgrund seiner Erfahrung im Bereich der On-Premises Active Directory Security ist er auch im Hardening aktiv und hilft als Teil der APT Response Taskforce bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":529,"searchDepth":530,"depth":530,"links":531},"",2,[],"md",{},{"en":535,"es":536,"sv":537,"fi":538,"da":539,"ko":540,"nl":541,"no":542,"ja":543},"As a consultant in the areas of Exchange Online, Identity and Modern Workplace, Thorsten Kunzi has been supporting customers in the planning and implementation of cloud projects for many years. Due to his experience in the area of on-premises Active Directory Security, he is also active in hardening and helps as part of the APT Response Taskforce with compromised or encrypted customer environments.","Como Consultant en las áreas de Exchange Online, Identity y Modern Workplace, Thorsten Kunzi lleva muchos años apoyando a los clientes en la planificación y ejecución de proyectos en la nube. Gracias a su experiencia en el ámbito de la seguridad de Active Directory on-premises, también trabaja en el hardening y ayuda, como parte de la APT Response Taskforce, en entornos de clientes comprometidos o cifrados.","Som Consultant inom områdena Exchange Online, Identity och Modern Workplace har Thorsten Kunzi i många år stöttat kunder i planeringen och genomförandet av molnprojekt. Tack vare sin erfarenhet inom on-premises Active Directory-säkerhet arbetar han även med hardening och hjälper som en del av APT Response Taskforce till i komprometterade eller krypterade kundmiljöer.","Consultantina Exchange Onlinen, Identityn ja Modern Workplacen alueilla Thorsten Kunzi on jo useiden vuosien ajan tukenut asiakkaita pilviprojektien suunnittelussa ja toteutuksessa. On-premises Active Directory -tietoturvan kokemuksensa ansiosta hän työskentelee myös hardeningin parissa ja auttaa osana APT Response Taskforce -tiimiä vaarantuneissa tai salatuissa asiakasympäristöissä.","Som Consultant inden for områderne Exchange Online, Identity og Modern Workplace har Thorsten Kunzi gennem mange år hjulpet kunder med planlægning og gennemførelse af cloud-projekter. På grund af sin erfaring inden for on-premises Active Directory-sikkerhed arbejder han også med hardening og hjælper som en del af APT Response Taskforce ved kompromitterede eller krypterede kundemiljøer.","Exchange Online, Identity, Modern Workplace 분야의 Consultant로서 Thorsten Kunzi는 오랜 기간 동안 고객의 클라우드 프로젝트 계획과 구현을 지원해 왔습니다. 온프레미스 Active Directory 보안 분야의 경험을 바탕으로 하드닝 작업에도 참여하고 있으며, APT Response Taskforce의 일원으로서 침해되거나 암호화된 고객 환경을 지원합니다.","Als Consultant voor Exchange Online, Identity en Modern Workplace ondersteunt Thorsten Kunzi klanten al vele jaren bij de planning en realisatie van cloudprojecten. Door zijn ervaring met On-Premises Active Directory Security is hij ook actief in hardening en helpt hij als onderdeel van de APT Response Taskforce bij gecompromitteerde of versleutelde klantomgevingen.","Som Consultant innen Exchange Online, Identity og Modern Workplace har Thorsten Kunzi i mange år bistått kunder med planlegging og gjennomføring av cloud-prosjekter. På grunn av erfaringen sin innen on-premises Active Directory Security er han også aktiv i hardening og hjelper som del av APT Response Taskforce ved kompromitterte eller krypterte kundemiljøer.","Exchange Online、Identity、Modern Workplaceの領域を担当するコンサルタントとして、Thorsten Kunziは長年にわたりクラウドプロジェクトの計画と実装でお客様を支援しています。オンプレミスのActive Directory Securityでの経験を活かしてHardeningにも携わり、APT Response Taskforceの一員として、侵害されたり暗号化されたりしたお客様環境に対応しています。","/thorsten-kunzi",{"title":520,"description":527},"thorsten-kunzi","YaiG705aTbfkaYxak0GKTbfT-5vntVpIpV6yaXJnw7I",[549,1132],{"id":550,"title":551,"author":552,"body":554,"cta":494,"description":529,"eventid":494,"extension":532,"hideInRecent":325,"layout":1105,"meta":1106,"moment":1110,"navigation":325,"path":1128,"seo":1129,"stem":1130,"tags":494,"webcast":484,"__hash__":1131},"content_is/posts/2026-01-27-exchange-active-directory.md","Exchange AD Split Permissions án eftirsjár",[553],"​Thorsten Kunzi​",{"type":522,"value":555,"toc":1087},[556,561,564,571,575,602,605,609,615,630,636,639,643,679,698,703,709,718,722,738,742,749,753,763,768,773,792,796,822,826,846,854,870,884,944,948,972,989,1001,1014,1021,1025,1035,1046,1058,1062,1065,1068,1083],[557,558,560],"h3",{"id":559},"tldr-hvað-ef-við-fjarlægjum-gallana","TLDR: hvað ef við fjarlægjum gallana?",[525,562,563],{},"Ég fann leið til að veita aftur AD- og RBAC-heimildir þar sem Exchange notendur, hópar, tengiliðir o.s.frv. eru staðsettir. Þannig þarf enga aðlögun hjá stjórnendum eða identity management kerfum, sem að minni reynslu var helsta hindrunin fyrir því að fyrirtæki tækju þetta upp. Og við fáum samt öryggisávinninginn gegn lateral movement og domain compromise.",[525,565,566],{},[567,568],"img",{"alt":569,"src":570},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[557,572,574],{"id":573},"þetta-næst-í-þremur-skrefum","Þetta næst í þremur skrefum:",[576,577,578,592,597],"ol",{},[579,580,581,582,589],"li",{},"Innleiða ",[583,584,588],"a",{"href":585,"rel":586},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions",[587],"nofollow","AD split permission líkanið",[590,591],"br",{},[579,593,594,595],{},"Veita Exchange serverum þær AD-heimildir sem tapast, en aðeins á viðeigandi OUs",[590,596],{},[579,598,599,600],{},"Veita Exchange RBAC til að endurvirkja PowerShell cmdlets sem vantar",[590,601],{},[525,603,604],{},"Allt í gegnum leiðbeiningar Microsoft, AD ACLs eða Exchange RBAC-úthlutanir.",[557,606,608],{"id":607},"af-hverju-skiptir-þetta-máli-núna","Af hverju skiptir þetta máli (núna)?",[525,610,611,612,614],{},"Þetta hefur að mestu verið vanrækt eða hunsað síðan það var kynnt með Exchange 2010 SP1. En sjálfgefna shared permissions líkanið felur í sér verulega öryggisáhættu fyrir yfirtöku á Active Directory. Þegar Exchange hefur að auki verið alræmt fyrir remote exploits síðustu ár, er kominn tími til að bregðast við.",[590,613],{},"\nVandinn stafar af heimildum sem veittar eru á rót lénsins og erfast í gegnum allt lénið.",[616,617,618,621,624,627],"ul",{},[579,619,620],{},"breyta heimildum á notendum og hópum (í raun fullur aðgangur)",[579,622,623],{},"breyta hópmeðlimum",[579,625,626],{},"endurstilla lykilorð notenda",[579,628,629],{},"búa til og eyða notendum og hópum",[525,631,632],{},[567,633],{"alt":634,"src":635},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[525,637,638],{},"Aðeins tilteknir Tier0 notendur og hópar með háar heimildir eru varðir af AdminSDHolder-ferlinu (attribute admincount=1), og í mörgum umhverfum eru óvarðir notendur eða hópar sem gætu gert kleift að taka yfir lénið og/eða skóginn, eða að minnsta kosti valdið alvarlegum skaða.",[557,640,642],{"id":641},"áberandi-dæmi","Áberandi dæmi:",[616,644,645,648,668],{},[579,646,647],{},"Entra Connect Sync reikningur þegar PWHashSync er notað",[579,649,650,651],{},"Sjálfgefnir hópar\n",[616,652,653,656,665],{},[579,654,655],{},"Allowed RODC Password Replication Group saman með EntraConnect reikningi (ef raunverulegt Windows RODC er til staðar)",[579,657,658,659,664],{},"Sjá einnig ",[583,660,663],{"href":661,"rel":662},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[587],"Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," sem sýnir fleiri leiðir (Account Operators hópurinn er sambærileg ógn)",[579,666,667],{},"Að tæma Protected Users til að búa til árásarleiðir með því að fjarlægja varnir",[579,669,670,671],{},"Óvarðir sérsniðnir hópar eða admin/þjónustureikningar\n",[616,672,673,676],{},[579,674,675],{},"Skrifheimildir á GPOs (sem beinast að domain controller)",[579,677,678],{},"Umsjón með aðgangi að AD backups, backup server, PKI templates, hypervisor, ...",[525,680,681,682,684,685,690,692,693],{},"Það er mjög erfitt að hefta afturvirkt allar þessar núverandi og framtíðar mögulegu leiðir. Fyrir sérsniðna _ADM OU væri hægt að slökkva á ACL-erfð, en flestir sjálfgefnir hlutir má ekki flytja úr sjálfgefinni Builtin OU eða Users container og verða áfram viðkvæmir.",[590,683],{},"\nMiklu betra er að fjarlægja þessar öflugu heimildir frá rótinni, sem er gert með því að innleiða Active Directory split permissions líkanið. ",[583,686,689],{"href":687,"rel":688},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[587],"Configure Exchange Server for split permissions | Microsoft Learn",[590,691],{},"\nOg Microsoft tekur undir: „…encouraged to implement Active Directory split permissions\" ",[583,694,697],{"href":695,"rel":696},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[587],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[699,700,702],"h2",{"id":701},"en-af-hverju-gerir-þá-enginn-þetta","En af hverju gerir þá enginn þetta?",[525,704,705,706,708],{},"Þar sem split permissions voru ekki til fyrr en með Exchange 2010 SP1 höfðu allir þá þegar sætt sig við ástandið, og svo virðist sem security-teymum hafi ekki tekist að ýta á breytingar með góðum árangri eftir að valkosturinn varð til.",[590,707],{},"\nOg þetta hefði kallað á breytingar á admin- og IDM-ferlum, eins og að búa til notendur eða distribution lists fyrst í AD og nota Exchange aðeins eftir á til að „mail enable\" þá.",[525,710,711,712,714],{},"Cmdlets sem ekki eru lengur til staðar eða virka:",[590,713],{},[715,716,717],"code",{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[557,719,721],{"id":720},"dæmi-um-aðlögun","Dæmi um aðlögun:",[616,723,724,735],{},[579,725,726,727],{},"New-Mailbox (þar sem Exchange skrifar í AD) yrði:\n",[616,728,729,732],{},[579,730,731],{},"New-ADUser (þar sem adm.jdoe skrifar í AD)",[579,733,734],{},"Enable-Mailbox",[579,736,737],{},"Add-ADPermission fyrir SendAs-réttindi þyrfti að framkvæma í gegnum AD users and computers í öryggisflipanum, og krefst oft viðbótarheimilda í AD fyrir venjulega stjórnendur.",[699,739,741],{"id":740},"sýndu-mér-þennan-valkost-án-eftirsjár","Sýndu mér þennan valkost án eftirsjár",[525,743,744,748],{},[745,746,747],"strong",{},"Fyrirvari",": Lestu og skildu eftirfarandi tengla og greinar til fulls, prófaðu fyrst í prófunarumhverfi, gakktu úr skugga um að AD backups séu uppfærð og að endurheimtarferlar séu til staðar.",[557,750,752],{"id":751},"skoðaðu-núverandi-notkun","Skoðaðu núverandi notkun",[525,754,755,758,760],{},[745,756,757],{},"Þú ættir fyrst að athuga hvaða af viðkomandi cmdlets eru í notkun á hvaða OUs.",[590,759],{},[715,761,762],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[525,764,765],{},[715,766,767],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[525,769,770],{},[715,771,772],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[525,774,775,778,780,783,786,789],{},[745,776,777],{},"Fljótleg greining á caller og cmdlets:",[590,779],{},[715,781,782],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[715,784,785],{},"$CSVs|group Caller",[715,787,788],{},"$CSVs|group CmdletName",[715,790,791],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange relevant groups into dedicated OUs.",[557,793,795],{"id":794},"virkjaðu-split-permissions-líkanið","Virkjaðu split permissions líkanið",[525,797,798,805,807,808,810,813,815,818,819],{},[745,799,800,801,804],{},"Fylgdu leiðbeiningum í „Switch to Active Directory split permissions\" í ",[583,802,689],{"href":585,"rel":803},[587]," (EKKI RBAC split permissions)",[590,806],{},"\nÍ meginatriðum fjarlægir þetta hættulegar heimildir hópsins „Exchange Windows Permissions\" og fjarlægir jafnframt Exchange sem meðlim í hópnum.",[590,809],{},[715,811,812],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[590,814],{},[745,816,817],{},"Til að afturkalla notaðu einfaldlega:"," ",[715,820,821],{},"/ActiveDirectorySplitPermissions:false",[557,823,825],{"id":824},"veittu-ad-heimildir","Veittu AD-heimildir",[525,827,828,831,833,834,836,839,841,843],{},[745,829,830],{},"Búðu til sérsniðinn AD-hóp og gerðu Exchange servera að meðlimum.",[590,832],{},"\nstilltu OU Path fyrst.",[590,835],{},[715,837,838],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[590,840],{},[590,842],{},[715,844,845],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[525,847,848,851,853],{},[745,849,850],{},"endurræstu Exchange servera svo heimildir í gegnum hópinn virki",[590,852],{},"\nÉg hef búið til skriptu til að auðvelda úthlutun AD-heimilda eftir notkunartilviki.",[855,856,857],"blockquote",{},[525,858,859,865,866,869],{},[745,860,861],{},[862,863,864],"em",{},"INFO:"," Án þessara heimilda fær Exchange server villuna ",[715,867,868],{},"„INSUFF_ACCESS_RIGHTS\""," frá AD.",[525,871,872,881,883],{},[745,873,874,875,880],{},"Sæktu ",[583,876,879],{"href":877,"rel":878},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[587],"Add-ExchangeADSplitPermissionOnOU.ps1"," frá glueckkanja GitHub",[590,882],{},"\nHún getur veitt eftirfarandi PermissionTypes:",[616,885,886,899,919,932],{},[579,887,888,891],{},[745,889,890],{},"CreateUserAndContact",[616,892,893,896],{},[579,894,895],{},"Create/delete, ResetPassword og WriteAllProperties fyrir Users og Contacts",[579,897,898],{},"Exchange cmdlets: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact og samsvarandi Remove-*",[579,900,901,904],{},[745,902,903],{},"GroupManage",[616,905,906,909,912],{},[579,907,908],{},"Create/Delete Groups, Modify Member",[579,910,911],{},"Exchange cmdlets: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[579,913,914,915],{},"Viðbótarnotkun: notandi sem hefur umsjón með DistributionGroups sem hann á í gegnum https://",[916,917,918],"on-prem-exchange",{},"/EAC",[579,920,921,924],{},[745,922,923],{},"UserSendAs",[616,925,926,929],{},[579,927,928],{},"Modfiy AD Permissions on Users",[579,930,931],{},"Exchange cmdlet: Add-ADPermission",[579,933,934,937],{},[745,935,936],{},"GroupSendAs",[616,938,939,942],{},[579,940,941],{},"Modfiy AD Permissions on Groups",[579,943,931],{},[557,945,947],{"id":946},"hvernig-á-að-nota-skriptuna","Hvernig á að nota skriptuna:",[525,949,950],{},[715,951,952,818,955,818,961,818,964,818,969],{},[715,953,954],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[956,957,958],"b",{},[715,959,960],{},"\u003COU>",[715,962,963],{},"-PermissionType",[956,965,966],{},[715,967,968],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[715,970,971],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[525,973,974,975,977],{},"t.d.",[590,976],{},[715,978,979,818,982,818,986],{},[715,980,981],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[956,983,984],{},[715,985,903],{},[715,987,988],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[525,990,991],{},[715,992,993,818,995,818,999],{},[715,994,981],{},[956,996,997],{},[715,998,936],{},[715,1000,988],{},[525,1002,1003],{},[715,1004,1005,818,1008,818,1012],{},[715,1006,1007],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[956,1009,1010],{},[715,1011,923],{},[715,1013,988],{},[525,1015,1016],{},[715,1017,1018],{},[715,1019,1020],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[557,1022,1024],{"id":1023},"veittu-exchange-rbac","Veittu Exchange RBAC",[525,1026,1027,1030,1032],{},[745,1028,1029],{},"Endurvirkjaðu -BypassSecurityGroupManagerCheck færibreytu fyrir Add-DistributionGroupMember og Remove-DistributionGroupMember cmdlets:",[590,1031],{},[715,1033,1034],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[855,1036,1037],{},[525,1038,1039,818,1043,1045],{},[745,1040,1041],{},[862,1042,864],{},[590,1044],{},"Annars færðu „-BypassSecurityGroupManagerCheck parameter is not available\" eða „You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[525,1047,1048,1050,1053,1055],{},[590,1049],{},[745,1051,1052],{},"Endurvirkjaðu New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... cmdlets með nauðsynlegum færibreytum:",[590,1054],{},[715,1056,1057],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[699,1059,1061],{"id":1060},"samantekt","Samantekt",[525,1063,1064],{},"Ég vona að með þessum leiðbeiningum muni miklu fleiri stíga þetta mikilvæga skref til að verja Active Directory gegn compromise í gegnum Exchange. Ég hef ekki enn lent í neinum vandræðum þegar ég hef innleitt Exchange AD split permissions líkanið og aðlögunina úr þessari grein hjá viðskiptavinum okkar.",[525,1066,1067],{},"Ég vona að Microsoft muni innleiða innfædda leið til að ná þessari fínstillanlegu OU-byggðu nálgun, í stað núverandi allt-eða-ekkert, svo hún verði almennt tekin upp.",[525,1069,1070,1071,1076,1077,1082],{},"Þar sem AD Tiering er mér kært mál: að auki, ekki skrá þig inn á Exchange servera með Domain Admin (eða neinum Tier0) reikningum, heldur meðhöndlaðu þá sem Tier1 héðan í frá og innleiddu AD Tiering sem fyrst.\nSem fyrsta skref mæli ég með verkfærum eins og ",[583,1072,1075],{"href":1073,"rel":1074},"https://www.pingcastle.com/",[587],"PingCastle"," eða ",[583,1078,1081],{"href":1079,"rel":1080},"https://www.semperis.com/purple-knight/",[587],"Purple Knight"," til að meta öryggi og control paths í AD-inu þínu.",[1084,1085,1086],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":529,"searchDepth":530,"depth":530,"links":1088},[1089,1091,1092,1093,1094,1097,1104],{"id":559,"depth":1090,"text":560},3,{"id":573,"depth":1090,"text":574},{"id":607,"depth":1090,"text":608},{"id":641,"depth":1090,"text":642},{"id":701,"depth":530,"text":702,"children":1095},[1096],{"id":720,"depth":1090,"text":721},{"id":740,"depth":530,"text":741,"children":1098},[1099,1100,1101,1102,1103],{"id":751,"depth":1090,"text":752},{"id":794,"depth":1090,"text":795},{"id":824,"depth":1090,"text":825},{"id":946,"depth":1090,"text":947},{"id":1023,"depth":1090,"text":1024},{"id":1060,"depth":530,"text":1061},"post",{"lang":1107,"seoTitle":1108,"titleClass":1109,"date":1110,"blogtitlepic":1111,"socialimg":1112,"customExcerpt":1113,"keywords":1114,"scripts":1115,"asideNav":1116,"maxContent":325,"published":484},"is","Exchange AD Split Permissions: Tryggðu Active Directory með least privilege","h2-font-size","2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-Premises Exchange Server uppsetningar eru enn algengar, jafnvel hjá fyrirtækjum sem hafa flutt öll pósthólf í skýið. Þær hafa líka enn mikil völd innan Active Directory og því er oftast sterk árásarleið til að taka yfir allt AD, og með því yfirleitt stóran hluta af IT-umhverfi fyrirtækisins. Að skipta yfir í svokallaðar „AD Split permissions\" fjarlægir þessar mikilvægu heimildir, og ég hef þróað lausn sem tekur burt gallana sem hafa hingað til komið í veg fyrir að fyrirtæki tækju þetta upp.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1117},[1118,1120,1122,1124,1126],{"href":1119,"text":560},"#tldr-hvað-ef-við-fjarlægjum-gallana",{"href":1121,"text":608},"#af-hverju-skiptir-þetta-máli-núna",{"href":1123,"text":702},"#en-af-hverju-gerir-þá-enginn-þetta",{"href":1125,"text":741},"#sýndu-mér-þennan-valkost-án-eftirsjár",{"href":1127,"text":1061},"#samantekt","/posts/2026-01-27-exchange-active-directory",{"title":551,"description":529},"posts/2026-01-27-exchange-active-directory","ByDQl0nXQUFkHxScMSVKkH1Y4qgQ1osRpUpw7kwfcFw",{"id":1133,"title":551,"author":1134,"body":1135,"cta":494,"description":529,"eventid":494,"extension":532,"hideInRecent":484,"layout":1105,"meta":1754,"moment":1756,"navigation":325,"path":1770,"seo":1771,"stem":1772,"tags":494,"webcast":484,"__hash__":1773},"content_is/posts/2026-03-01-exchange-ad-split-permissions-hardening.md",[520],{"type":522,"value":1136,"toc":1741},[1137,1141,1144,1148,1152,1166,1169,1176,1181,1183,1191,1204,1208,1211,1215,1249,1268,1272,1280,1288,1292,1306,1308,1313,1317,1322,1382,1387,1424,1427,1430,1444,1451,1467,1476,1480,1483,1529,1532,1539,1545,1548,1561,1577,1589,1600,1605,1663,1665,1670,1690,1697,1721,1723,1726,1729,1739],[699,1138,1140],{"id":1139},"tldr-hvað-ef-við-fjarlægjum-ókostina","TLDR: hvað ef við fjarlægjum ókostina?",[525,1142,1143],{},"Ég fann leið til að endurveita AD- og RBAC-réttindi beint þar sem Exchange notendur, hópar og tengiliðir liggja, án þess að neinar breytingar séu nauðsynlegar fyrir kerfisstjóra eða identity management kerfin. Að minni reynslu hefur einmitt sú núningur verið helsta hindrunin hjá flestum fyrirtækjum. Og við höldum áfram öryggisávinningnum gegn lateral movement og yfirtöku á léni.",[525,1145,1146],{},[567,1147],{"alt":569,"src":570},[525,1149,1150],{},[745,1151,574],{},[576,1153,1155,1160,1163],{"style":1154},"margin: 0.25rem 0",[579,1156,1157,1158],{},"Innleiddu ",[583,1159,588],{"href":585},[579,1161,1162],{},"Veittu Exchange þjónum þau AD-réttindi sem töpuðust, en einungis á viðkomandi OU-um",[579,1164,1165],{},"Veittu Exchange RBAC til að endurvirkja þær PowerShell cmdlets sem vantar",[525,1167,1168],{},"Allt í samræmi við leiðbeiningar Microsoft, AD ACLs eða Exchange RBAC úthlutanir.",[1170,1171],"video-frame",{"thumb":1172,"alt":1173,"id":1174,":full-width":1175},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[1177,1178,1180],"div",{"style":1179},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions án eftirsjár. Skref fyrir skref innleiðingarleiðbeiningar",[699,1182,608],{"id":607},[525,1184,1185,1186,1188,1190],{},"Þetta hefur að mestu verið litið fram hjá eða hunsað síðan það kom fram með Exchange 2010 SP1. En sjálfgefna shared permissions líkanið er veruleg öryggisáhætta um yfirtöku á Active Directory. Í ljósi þess að Exchange er alræmt fyrir remote exploits síðustu ár er kominn tími til að bregðast við.",[590,1187],{},[590,1189],{},"\nVandinn á rætur að rekja til réttinda sem eru veitt á rót léns og erfast síðan um allt lénið.",[616,1192,1193,1196,1199,1202],{"style":1154},[579,1194,1195],{},"breyta réttindum á notendum og hópum (í raun fullur aðgangur)",[579,1197,1198],{},"breyta meðlimum hópa",[579,1200,1201],{},"endursetja lykilorð á notendum",[579,1203,629],{},[525,1205,1206],{},[567,1207],{"alt":634,"src":635},[525,1209,1210],{},"Aðeins tilteknir mjög forréttindaháir Tier 0 notendur og hópar eru varðir af AdminSDHolder ferlinu (eiginleikinn admincount=1) og í mörgum umhverfum verða óvarðir notendur eða hópar sem gætu leyft yfirtöku á léni eða skógi, eða að minnsta kosti valdið verulegum skaða.",[525,1212,1213],{},[745,1214,642],{},[616,1216,1217,1220,1238],{"style":1154},[579,1218,1219],{},"Entra Connect Sync notandinn þegar notast er við Password Hash Sync",[579,1221,1222,1223],{},"Sjálfgefnir hópar",[616,1224,1226,1229,1235],{"style":1225},"margin: 0",[579,1227,1228],{},"Allowed RODC Password Replication Group ásamt Entra Connect notanda (ef raunverulegur Windows RODC er til staðar)",[579,1230,658,1231,1234],{},[583,1232,663],{"href":1233,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta"," sem sýnir fleiri leiðir (Account Operators hópurinn er svipuð ógn)",[579,1236,1237],{},"Að tæma Protected Users til að búa til árásarleiðir með því að fjarlægja verndir",[579,1239,1240,1241],{},"Óvarðir sérsniðnir hópar eða admin/þjónustuaðgangar",[616,1242,1243,1246],{"style":1225},[579,1244,1245],{},"Skrifréttindi á GPOs (sem beitt er á domain controller)",[579,1247,1248],{},"Umsjón með aðgangi að AD backups, backup þjóni, PKI templates, hypervisor, ...",[525,1250,1251,1252,1254,1256,1257,1260,1262,1264,1265],{},"Það er mjög erfitt að stöðva afturvirkt allar þessar núverandi og framtíðar hugsanlegu leiðir. Fyrir sérsniðnu _ADM OU-una gætir þú slökkt á ACL inheritance, en flesta sjálfgefna hluti má ekki færa úr sjálfgefnu Builtin OU eða Users container, og þeir haldast berskjaldaðir.",[590,1253],{},[590,1255],{},"\nÞað er mun betra að fjarlægja hin öflugu réttindi frá rótinni, sem er gert með því að innleiða Active Directory split permissions líkanið. ",[583,1258,689],{"href":687,"rel":1259},[587],[590,1261],{},[590,1263],{},"\nOg Microsoft er sammála „…encouraged to implement Active Directory split permissions\" ",[583,1266,697],{"href":695,"rel":1267},[587],[699,1269,1271],{"id":1270},"en-af-hverju-gerir-enginn-þetta","En af hverju gerir enginn þetta?",[525,1273,1274,1275,1277,1279],{},"Þar sem split permissions voru ekki tiltæk fyrr en með Exchange 2010 SP1, höfðu allir sætt sig við ástandið á þeim tímapunkti og það virðist sem öryggisteymum hafi ekki tekist að ýta þessu í gegn með árangri eftir að möguleikinn var kominn.",[590,1276],{},[590,1278],{},"\nOg það hefði þvingað fram breytingar á kerfisstjórnun og IDM ferlum, til dæmis að búa til notendur eða dreifingarlista fyrst í AD og aðeins að því loknu nota Exchange til að „mail enable\" þá.",[855,1281,1282],{},[525,1283,1284,1287],{},[745,1285,1286],{},"Info:"," Eftirfarandi cmdlets verða ekki lengur tiltækar eða virkar: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[525,1289,1290],{},[745,1291,721],{},[616,1293,1294,1303],{"style":1154},[579,1295,1296,1297],{},"New-Mailbox (þar sem Exchange skrifar í AD) yrði:",[616,1298,1299,1301],{"style":1225},[579,1300,731],{},[579,1302,734],{},[579,1304,1305],{},"Add-ADPermission fyrir SendAs réttindi þyrfti að gera í gegnum AD Users and Computers á security flipanum og þyrfti oft aukin AD-réttindi fyrir venjulega kerfisstjóra.",[699,1307,741],{"id":740},[525,1309,1310,1312],{},[745,1311,747],{},": Lestu og skildu eftirfarandi tengla og greinar til fulls, keyrðu þetta fyrst í prófunarumhverfi, gakktu úr skugga um að AD backups séu uppfærð og að endurheimtaraðferðir séu til staðar.",[557,1314,1316],{"id":1315},"endurskoðaðu-núverandi-notkun","Endurskoðaðu núverandi notkun",[525,1318,1319],{},[745,1320,1321],{},"Þú ættir fyrst að athuga hverjar af viðkomandi cmdlets eru í notkun á hvaða OU-um:",[1323,1324,1325,1333,1335,1341,1343],"code-block",{},[1326,1327,1328,1332],"span",{},[1326,1329,1331],{"style":1330},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[590,1334],{},[1326,1336,1337,1340],{},[1326,1338,1339],{"style":1330},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[590,1342],{},[1326,1344,1345,818,1348,1352,1353,818,1356,1358,1359,1362,1363,818,1366,818,1369,818,1371,1374,1375,1378,1379],{},[1326,1346,1347],{"style":1330},"Search-AdminAuditLog",[1326,1349,1351],{"style":1350},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1326,1354,1355],{"style":1350},"-Cmdlets",[1326,1357,1339],{"style":1330}," | ",[1326,1360,1361],{"style":1330},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1326,1364,1365],{"style":1330},"Export-Csv",[1326,1367,1368],{"style":1350},"-Path",[1326,1370,1331],{"style":1330},[1326,1372,1373],{"style":1350},"-Delimiter"," \";\" ",[1326,1376,1377],{"style":1350},"-Encoding"," Unicode ",[1326,1380,1381],{"style":1350},"-NoTypeInformation",[525,1383,1384],{},[745,1385,1386],{},"Skjót greining á kallara og cmdlets:",[1323,1388,1389,1405,1407,1415,1417],{},[1326,1390,1391,1394,1395,818,1398,818,1400,818,1402,1404],{},[1326,1392,1393],{"style":1330},"$CSVs"," = ",[1326,1396,1397],{"style":1330},"Import-Csv",[1326,1399,1368],{"style":1350},[1326,1401,1331],{"style":1330},[1326,1403,1373],{"style":1350}," \";\"",[590,1406],{},[1326,1408,1409,1358,1411,1414],{},[1326,1410,1393],{"style":1330},[1326,1412,1413],{"style":1330},"Group-Object"," Caller",[590,1416],{},[1326,1418,1419,1358,1421,1423],{},[1326,1420,1393],{"style":1330},[1326,1422,1413],{"style":1330}," CmdletName",[525,1425,1426],{},"Greindu CSV-skjalið til að sjá hvar AD-réttinda verður þörf. Þú getur mögulega hagrætt með því að færa alla Exchange-tengda hópa í sérstakar OU-ur.",[699,1428,1429],{"id":794},"Virkjaðu Split Permissions líkanið",[525,1431,1432,1433,1436,1437,1441],{},"Fylgdu leiðbeiningum Microsoft ",[745,1434,1435],{},"„Switch to Active Directory split permissions\""," í\n",[583,1438,689],{"href":1439,"rel":1440},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[587],[862,1442,1443],{},"(EKKI RBAC split permissions)",[525,1445,1446,1447,1450],{},"Í meginatriðum fjarlægir þetta hin hættulegu réttindi hjá ",[745,1448,1449],{},"„Exchange Windows Permissions\""," hópnum og fjarlægir Exchange einnig sem meðlim hópsins.",[1323,1452,1453],{},[1326,1454,1455,818,1458,818,1461,818,1464],{},[1326,1456,1457],{"style":1330},"Setup.exe",[1326,1459,1460],{"style":1350},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1326,1462,1463],{"style":1350},"/PrepareAD",[1326,1465,1466],{"style":1350},"/ActiveDirectorySplitPermissions:true",[1177,1468,1470,1471,1473,1474],{"style":1469},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[745,1472,1286],{}," Til að snúa til baka, notaðu einfaldlega ",[715,1475,821],{},[557,1477,1479],{"id":1478},"veittu-ad-réttindi","Veittu AD-réttindi",[525,1481,1482],{},"Búðu til sérsniðinn AD-hóp og gerðu Exchange þjónana að meðlimum.",[1323,1484,1485,1491,1493,818,1496,1499,1500,1503,1504,1507,1508,818,1510,818,1513,1516,1517,1519,1499,1522,1525,1526],{},[1326,1486,1487],{},[1326,1488,1490],{"style":1489},"color:var(--color-black-40)","# stilltu OU Path fyrst",[590,1492],{},[1326,1494,1495],{"style":1330},"New-ADGroup",[1326,1497,1498],{"style":1350},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1326,1501,1502],{"style":1350},"-GroupCategory"," Security ",[1326,1505,1506],{"style":1350},"-GroupScope"," DomainLocal ",[1326,1509,1368],{"style":1350},[745,1511,1512],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1326,1514,1515],{"style":1350},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[590,1518],{},[1326,1520,1521],{"style":1330},"Add-ADGroupMember",[1326,1523,1524],{"style":1350},"-Members"," \"Exchange Trusted Subsystem\"\n",[1326,1527,1528],{"style":1489},"# endurræstu Exchange þjóna til að réttindi í gegnum hópinn virki",[525,1530,1531],{},"Ég hef búið til skriftu sem gerir það einfalt að úthluta AD-réttindum eftir notkunartilviki.",[855,1533,1534],{},[525,1535,1536,1537,869],{},"Án þessara réttinda fengi Exchange þjónninn villuna ",[715,1538,868],{},[525,1540,874,1541,1544],{},[583,1542,879],{"href":877,"rel":1543},[587]," af GitHub reikningi glueckkanja",[525,1546,1547],{},"Hún getur veitt eftirfarandi PermissionTypes:",[525,1549,1551,1553,895,1555,1557],{"style":1550},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[745,1552,890],{},[590,1554],{},[590,1556],{},[1558,1559,1560],"small",{},"Exchange cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` og samsvarandi `Remove-*`",[525,1562,1564,1566,1568,1569,1571],{"style":1563},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[745,1565,903],{},[590,1567],{},"Búa til/eyða hópum, breyta meðlimum",[590,1570],{},[1558,1572,1573,1574,1576],{},"Exchange cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[590,1575],{},"Einnig: notandi sem stýrir DistributionGroups sem hann á sjálfur í gegnum EAC",[525,1578,1579,1581,1583,1584,1586],{"style":1563},[745,1580,923],{},[590,1582],{},"Breyta AD-réttindum á notendum",[590,1585],{},[1558,1587,1588],{},"Exchange cmdlet: `Add-ADPermission`",[525,1590,1591,1593,1595,1596,1598],{"style":1563},[745,1592,936],{},[590,1594],{},"Breyta AD-réttindum á hópum",[590,1597],{},[1558,1599,1588],{},[525,1601,1602],{},[745,1603,1604],{},"Hvernig þú notar skriftuna:",[1323,1606,1607,818,1609,1612,1613,1615,1616,1619,1620,1623,1625,818,1627,1629,1630,1632,1633,1619,1635,818,1637,1629,1639,1641,1642,1619,1644,818,1646,1648,1649,1651,1652,1619,1654,818,1656,1648,1658,1660,1661,1619],{},[1326,1608,879],{"style":1330},[1326,1610,1611],{"style":1350},"-TargetOU"," \u003COU> ",[1326,1614,963],{"style":1350}," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1326,1617,1618],{"style":1350},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1326,1621,1622],{"style":1489},"# Til dæmis",[590,1624],{},[1326,1626,879],{"style":1330},[1326,1628,1611],{"style":1350}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1326,1631,963],{"style":1350}," GroupManage ",[1326,1634,1618],{"style":1350},[1326,1636,879],{"style":1330},[1326,1638,1611],{"style":1350},[1326,1640,963],{"style":1350}," GroupSendAs ",[1326,1643,1618],{"style":1350},[1326,1645,879],{"style":1330},[1326,1647,1611],{"style":1350}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1326,1650,963],{"style":1350}," UserSendAs ",[1326,1653,1618],{"style":1350},[1326,1655,879],{"style":1330},[1326,1657,1611],{"style":1350},[1326,1659,963],{"style":1350}," CreateUserAndContact ",[1326,1662,1618],{"style":1350},[557,1664,1024],{"id":1023},[525,1666,1667],{},[745,1668,1669],{},"Endurvirkjaðu -BypassSecurityGroupManagerCheck færibreytuna fyrir Add-DistributionGroupMember og Remove-DistributionGroupMember cmdletana:",[1323,1671,1672],{},[1326,1673,1674,818,1677,1679,1680,1683,1684,1686,1687,1689],{},[1326,1675,1676],{"style":1330},"New-RoleGroup",[1326,1678,1498],{"style":1350}," \"SplitPermission Security Group Creation and Membership\" ",[1326,1681,1682],{"style":1350},"-Roles"," \"Security Group Creation and Membership\" ",[1326,1685,1524],{"style":1350}," \"Organization Management\",\"Recipient Management\" ",[1326,1688,1515],{"style":1350}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[855,1691,1692],{},[525,1693,1694,1696],{},[745,1695,1286],{}," Annars færðu „-BypassSecurityGroupManagerCheck parameter is not available\" eða „You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[525,1698,1699,1701,1704,1706],{},[590,1700],{},[745,1702,1703],{},"Endurvirkjaðu New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... cmdletana með nauðsynlegum færibreytum:",[590,1705],{},[1323,1707,1708,818,1710,1712,1713,1715,1716,1686,1718,1720],{},[1326,1709,1676],{"style":1330},[1326,1711,1498],{"style":1350}," \"SplitPermission Mail Recipient Creation\" ",[1326,1714,1682],{"style":1350}," \"Mail Recipient Creation\" ",[1326,1717,1524],{"style":1350},[1326,1719,1515],{"style":1350}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[699,1722,1061],{"id":1060},[525,1724,1725],{},"Ég vona að þessi leiðarvísir hjálpi fleiri skipulagsheildum að stíga hið mikilvæga skref að vernda Active Directory sitt gegn yfirtöku í gegnum Exchange. Miðað við reynslu mína af því að innleiða Exchange AD Split Permissions líkanið hjá mörgum viðskiptavinum, hef ég ekki rekist á nein vandamál og upptakan hefur gengið vel.",[525,1727,1728],{},"Ég vona einnig að Microsoft innleiði innbyggða, OU-byggða nálgun til að ná þessu stigi af nákvæmni, í stað núverandi allt-eða-ekkert líkans, sem myndi gera víðtæka upptöku umtalsvert auðveldari.",[525,1730,1731,1732,1076,1735,1738],{},"Athugasemd um AD Tiering: Vinsamlegast skráðu þig ekki inn á Exchange þjóna með Domain Admin eða neinum öðrum Tier 0 reikningum. Meðhöndlaðu Exchange þjóna sem Tier 1 og innleiddu AD Tiering eins fljótt og auðið er. Sem fyrsta skref mæli ég með ",[583,1733,1075],{"href":1073,"rel":1734},[587],[583,1736,1081],{"href":1079,"rel":1737},[587]," til að meta öryggisstöðu AD-sins þíns og bera kennsl á control path exposure.",[1084,1740,1086],{},{"title":529,"searchDepth":530,"depth":530,"links":1742},[1743,1744,1745,1746,1749,1753],{"id":1139,"depth":530,"text":1140},{"id":607,"depth":530,"text":608},{"id":1270,"depth":530,"text":1271},{"id":740,"depth":530,"text":741,"children":1747},[1748],{"id":1315,"depth":1090,"text":1316},{"id":794,"depth":530,"text":1429,"children":1750},[1751,1752],{"id":1478,"depth":1090,"text":1479},{"id":1023,"depth":1090,"text":1024},{"id":1060,"depth":530,"text":1061},{"lang":1107,"seoTitle":1755,"titleClass":1109,"date":1756,"blogtitlepic":1757,"socialimg":1758,"customExcerpt":1759,"keywords":1114,"scripts":1760,"asideNav":1761,"maxContent":325,"published":325},"Exchange AD Split Permissions: verndaðu Active Directory með least privilege","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Jafnvel skipulagsheildir sem hafa fært öll pósthólf sín yfir í cloud reka enn oft on-premises Exchange þjóna og með þeim vanmetna öryggisáhættu fyrir Active Directory. „AD Split Permissions\" líkanið sviptir Exchange þeim víðtæku AD-réttindum sem árásarmenn gætu nýtt til að taka yfir allt lénið. Fram til þessa hefur upptakan að mestu strandað á þeim breytingum sem líkanið krefst af kerfisstjórum í daglegum ferlum. Þessi grein sýnir hvernig má komast fram hjá einmitt þeirri hindrun á einfaldan hátt: skrifta sem endurveitir Exchange þau AD-réttindi sem tapast, en einungis á viðkomandi OU-um, þannig að venjulegt vinnuflæði kerfisstjóra helst óbreytt á meðan fullur öryggisávinningur næst.",{"slick":325,"form":325},{"menuItems":1762},[1763,1765,1766,1768,1769],{"href":1764,"text":1140},"#tldr-hvað-ef-við-fjarlægjum-ókostina",{"href":1121,"text":608},{"href":1767,"text":1271},"#en-af-hverju-gerir-enginn-þetta",{"href":1125,"text":741},{"href":1127,"text":1061},"/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":551,"description":529},"posts/2026-03-01-exchange-ad-split-permissions-hardening","MyO0GEeIP7ynLr3pgv3yMsGC-YJDyfg0mrQLILJE1I0",[],{"id":1776,"extension":1777,"meta":1778,"stem":8,"__hash__":1785},"authors_data/authors.json","json",{"Thorsten Kunzi":1779},{"display_name":520,"avatar":1780,"permalink":1781,"twitter":1782,"linkedin":1783,"imageOffsetTop":1784},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi","glueckkanjagab","company/glueckkanja-gab","72%","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383994200]