[{"data":1,"prerenderedAt":1780},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"author-nl-thorsten-kunzi-1f055f71c9741a":519,"content-nl-thorsten-kunzi":549,"content-events-nl-thorsten-kunzi":1768,"authors_data:Thorsten Kunzi|​Thorsten Kunzi​":1769},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"body":522,"description":528,"extension":533,"meta":534,"name":521,"navigation":325,"otherLanguages":535,"path":545,"seo":546,"stem":547,"__hash__":548},"authors/thorsten-kunzi.md","Thorsten Kunzi",{"type":523,"value":524,"toc":529},"minimal",[525],[526,527,528],"p",{},"Als Consultant in den Bereichen Exchange Online, Identity und Modern Workplace unterstützt Thorsten Kunzi seit vielen Jahren Kunden bei der Planung und Umsetzung von Cloud-Projekten. Aufgrund seiner Erfahrung im Bereich der On-Premises Active Directory Security ist er auch im Hardening aktiv und hilft als Teil der APT Response Taskforce bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":530,"searchDepth":531,"depth":531,"links":532},"",2,[],"md",{},{"en":536,"es":537,"sv":538,"fi":539,"da":540,"ko":541,"nl":542,"no":543,"ja":544},"As a consultant in the areas of Exchange Online, Identity and Modern Workplace, Thorsten Kunzi has been supporting customers in the planning and implementation of cloud projects for many years. Due to his experience in the area of on-premises Active Directory Security, he is also active in hardening and helps as part of the APT Response Taskforce with compromised or encrypted customer environments.","Como Consultant en las áreas de Exchange Online, Identity y Modern Workplace, Thorsten Kunzi lleva muchos años apoyando a los clientes en la planificación y ejecución de proyectos en la nube. Gracias a su experiencia en el ámbito de la seguridad de Active Directory on-premises, también trabaja en el hardening y ayuda, como parte de la APT Response Taskforce, en entornos de clientes comprometidos o cifrados.","Som Consultant inom områdena Exchange Online, Identity och Modern Workplace har Thorsten Kunzi i många år stöttat kunder i planeringen och genomförandet av molnprojekt. Tack vare sin erfarenhet inom on-premises Active Directory-säkerhet arbetar han även med hardening och hjälper som en del av APT Response Taskforce till i komprometterade eller krypterade kundmiljöer.","Consultantina Exchange Onlinen, Identityn ja Modern Workplacen alueilla Thorsten Kunzi on jo useiden vuosien ajan tukenut asiakkaita pilviprojektien suunnittelussa ja toteutuksessa. On-premises Active Directory -tietoturvan kokemuksensa ansiosta hän työskentelee myös hardeningin parissa ja auttaa osana APT Response Taskforce -tiimiä vaarantuneissa tai salatuissa asiakasympäristöissä.","Som Consultant inden for områderne Exchange Online, Identity og Modern Workplace har Thorsten Kunzi gennem mange år hjulpet kunder med planlægning og gennemførelse af cloud-projekter. På grund af sin erfaring inden for on-premises Active Directory-sikkerhed arbejder han også med hardening og hjælper som en del af APT Response Taskforce ved kompromitterede eller krypterede kundemiljøer.","Exchange Online, Identity, Modern Workplace 분야의 Consultant로서 Thorsten Kunzi는 오랜 기간 동안 고객의 클라우드 프로젝트 계획과 구현을 지원해 왔습니다. 온프레미스 Active Directory 보안 분야의 경험을 바탕으로 하드닝 작업에도 참여하고 있으며, APT Response Taskforce의 일원으로서 침해되거나 암호화된 고객 환경을 지원합니다.","Als Consultant voor Exchange Online, Identity en Modern Workplace ondersteunt Thorsten Kunzi klanten al vele jaren bij de planning en realisatie van cloudprojecten. Door zijn ervaring met On-Premises Active Directory Security is hij ook actief in hardening en helpt hij als onderdeel van de APT Response Taskforce bij gecompromitteerde of versleutelde klantomgevingen.","Som Consultant innen Exchange Online, Identity og Modern Workplace har Thorsten Kunzi i mange år bistått kunder med planlegging og gjennomføring av cloud-prosjekter. På grunn av erfaringen sin innen on-premises Active Directory Security er han også aktiv i hardening og hjelper som del av APT Response Taskforce ved kompromitterte eller krypterte kundemiljøer.","Exchange Online、Identity、Modern Workplaceの領域を担当するコンサルタントとして、Thorsten Kunziは長年にわたりクラウドプロジェクトの計画と実装でお客様を支援しています。オンプレミスのActive Directory Securityでの経験を活かしてHardeningにも携わり、APT Response Taskforceの一員として、侵害されたり暗号化されたりしたお客様環境に対応しています。","/thorsten-kunzi",{"title":521,"description":528},"thorsten-kunzi","YaiG705aTbfkaYxak0GKTbfT-5vntVpIpV6yaXJnw7I",[550,1133],{"id":551,"title":552,"author":553,"body":555,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":325,"layout":1106,"meta":1107,"moment":1111,"navigation":325,"path":1129,"seo":1130,"stem":1131,"tags":494,"webcast":484,"__hash__":1132},"content_nl/posts/2026-01-27-exchange-active-directory.md","​​​Exchange AD Split Permissions zonder spijt​",[554],"​Thorsten Kunzi​",{"type":523,"value":556,"toc":1088},[557,562,565,572,576,603,606,610,616,631,637,640,644,680,699,704,710,719,723,739,743,750,754,764,769,774,793,797,823,827,847,855,871,885,945,949,973,990,1002,1015,1022,1026,1036,1047,1059,1063,1066,1069,1084],[558,559,561],"h3",{"id":560},"tldr-wat-als-we-de-nadelen-wegnemen","TLDR: wat als we de nadelen wegnemen?",[526,563,564],{},"Ik heb een manier gevonden om de AD- en RBAC-rechten opnieuw toe te kennen op de plek waar de Exchange-gebruikers, -groepen, -contacten enzovoort staan. Daarmee hoeven admins en identity management-systemen hun processen niet aan te passen, en juist dat was in mijn ervaring de reden dat de meeste bedrijven het nooit hebben ingevoerd. Tegelijk houden we de veiligheidswinst tegen lateral movement en compromittering van het domein.",[526,566,567],{},[568,569],"img",{"alt":570,"src":571},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[558,573,575],{"id":574},"dat-gebeurt-in-drie-stappen","Dat gebeurt in drie stappen:",[577,578,579,593,598],"ol",{},[580,581,582,583,590],"li",{},"Implementeer het ",[584,585,589],"a",{"href":586,"rel":587},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions",[588],"nofollow","AD split permission-model",[591,592],"br",{},[580,594,595,596],{},"Geef de Exchange-servers de verloren AD-rechten terug, maar alleen op de relevante OU’s",[591,597],{},[580,599,600,601],{},"Ken Exchange RBAC toe om de ontbrekende PowerShell-cmdlets weer te activeren",[591,602],{},[526,604,605],{},"Alles via de handleiding van Microsoft, AD ACL’s of Exchange RBAC-toewijzingen.",[558,607,609],{"id":608},"waarom-is-dit-nu-belangrijk","Waarom is dit (nu) belangrijk?",[526,611,612,613,615],{},"Het onderwerp is sinds de introductie met Exchange 2010 SP1 grotendeels over het hoofd gezien of genegeerd. Het standaardmodel met gedeelde rechten vormt echter een groot veiligheidsrisico, omdat het een overname van Active Directory mogelijk maakt. In combinatie met de reputatie die Exchange de afgelopen jaren rond remote exploits heeft opgebouwd, is het tijd om te handelen.",[591,614],{},"\nHet probleem komt voort uit privileges die op de root van een domein worden toegekend en vervolgens door het hele domein worden overgeërfd.",[617,618,619,622,625,628],"ul",{},[580,620,621],{},"rechten op gebruikers en groepen wijzigen (in de praktijk volledige toegang)",[580,623,624],{},"groepslidmaatschappen wijzigen",[580,626,627],{},"wachtwoorden van gebruikers resetten",[580,629,630],{},"gebruikers en groepen aanmaken/verwijderen",[526,632,633],{},[568,634],{"alt":635,"src":636},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[526,638,639],{},"Alleen bepaalde hoog geprivilegieerde Tier0-gebruikers en -groepen worden beschermd door het AdminSDHolder-proces (attribuut admincount=1), en in veel omgevingen bestaan er onbeschermde gebruikers of groepen waarmee het domein en/of het forest gecompromitteerd kan worden of die op zijn minst grote schade kunnen aanrichten.",[558,641,643],{"id":642},"bekende-voorbeelden","Bekende voorbeelden:",[617,645,646,649,669],{},[580,647,648],{},"Entra Connect Sync-account bij gebruik van PWHashSync",[580,650,651,652],{},"Standaardgroepen\n",[617,653,654,657,666],{},[580,655,656],{},"Allowed RODC Password Replication Group samen met het EntraConnect-account (als er een echte Windows RODC bestaat)",[580,658,659,660,665],{},"Zie ook ",[584,661,664],{"href":662,"rel":663},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[588],"Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps",", waarin meer paden worden beschreven (de groep Account Operators vormt een vergelijkbare dreiging)",[580,667,668],{},"Protected Users leegmaken om aanvalsvectoren te creëren door beschermingen weg te halen",[580,670,671,672],{},"Onbeschermde eigen groepen of admin-/serviceaccounts\n",[617,673,674,677],{},[580,675,676],{},"Schrijfrechten op GPO’s (die op domeincontrollers worden toegepast)",[580,678,679],{},"Beheer van toegang tot AD-backups, backupserver, PKI-templates, hypervisor, ...",[526,681,682,683,685,686,691,693,694],{},"Het is heel moeilijk om al deze bestaande en toekomstige mogelijke paden achteraf in te dammen. Voor de eigen OU _ADM kun je ACL-overerving uitschakelen, maar de meeste standaardobjecten mogen niet uit de standaard-OU Builtin of de container Users worden verplaatst en blijven dus kwetsbaar.",[591,684],{},"\nHet is veel beter om de vergaande rechten op de root weg te halen, en dat doe je door het Active Directory split permissions-model te implementeren. ",[584,687,690],{"href":688,"rel":689},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[588],"Configure Exchange Server for split permissions | Microsoft Learn",[591,692],{},"\nEn Microsoft is het daarmee eens: “…encouraged to implement Active Directory split permissions” ",[584,695,698],{"href":696,"rel":697},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[588],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[700,701,703],"h2",{"id":702},"maar-waarom-doet-niemand-het","Maar waarom doet niemand het?",[526,705,706,707,709],{},"Omdat split permissions tot Exchange 2010 SP1 simpelweg niet bestonden, had iedereen zich tegen die tijd bij de situatie neergelegd, en het lijkt erop dat securityteams het er niet doorheen kregen toen de mogelijkheid er eindelijk was.",[591,708],{},"\nBovendien zou het aanpassingen aan admin- en IDM-processen hebben geforceerd, zoals gebruikers of distributielijsten eerst in AD aanmaken en ze pas daarna via Exchange “mail enablen”.",[526,711,712,713,715],{},"Cmdlets die niet langer beschikbaar zijn of niet meer werken:",[591,714],{},[716,717,718],"code",{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[558,720,722],{"id":721},"voorbeelden-van-procesaanpassingen","Voorbeelden van procesaanpassingen:",[617,724,725,736],{},[580,726,727,728],{},"New-Mailbox (waarbij Exchange naar AD schrijft) zou worden:\n",[617,729,730,733],{},[580,731,732],{},"New-ADUser (waarbij adm.jdoe naar AD schrijft)",[580,734,735],{},"Enable-Mailbox",[580,737,738],{},"Add-ADPermission voor SendAs-rechten zou via Active Directory Users and Computers op het tabblad Security moeten gebeuren, waarvoor gewone admins vaak extra AD-rechten nodig hebben.",[700,740,742],{"id":741},"laat-me-die-no-regrets-optie-zien","Laat me die no-regrets-optie zien",[526,744,745,749],{},[746,747,748],"strong",{},"Disclaimer",": Lees en begrijp de onderstaande links en artikelen volledig, test eerst in een testomgeving en zorg ervoor dat AD-backups actueel zijn en dat er recovery-procedures zijn vastgelegd.",[558,751,753],{"id":752},"breng-het-huidige-gebruik-in-kaart","Breng het huidige gebruik in kaart",[526,755,756,759,761],{},[746,757,758],{},"Controleer eerst welke van de betrokken cmdlets op welke OU’s in gebruik zijn.",[591,760],{},[716,762,763],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[526,765,766],{},[716,767,768],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[526,770,771],{},[716,772,773],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[526,775,776,779,781,784,787,790],{},[746,777,778],{},"Snelle analyse van caller en cmdlets:",[591,780],{},[716,782,783],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[716,785,786],{},"$CSVs|group Caller",[716,788,789],{},"$CSVs|group CmdletName",[716,791,792],{},"Analyze the CSV for where AD permissions will be needed. Potentially optimize by moving all Exchange relevant groups into dedicated OUs.",[558,794,796],{"id":795},"split-permissions-model-activeren","Split permissions-model activeren",[526,798,799,806,808,809,811,814,816,819,820],{},[746,800,801,802,805],{},"Volg de instructies onder “Switch to Active Directory split permissions” in ",[584,803,690],{"href":586,"rel":804},[588]," (NIET RBAC split permissions)",[591,807],{},"\nKort gezegd verwijdert het de gevaarlijke rechten van de groep “Exchange Windows Permissions” en haalt het Exchange als groepslid weg.",[591,810],{},[716,812,813],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[591,815],{},[746,817,818],{},"Om terug te draaien gebruik je simpelweg:"," ",[716,821,822],{},"/ActiveDirectorySplitPermissions:false",[558,824,826],{"id":825},"ad-rechten-toekennen","AD-rechten toekennen",[526,828,829,832,834,835,837,840,842,844],{},[746,830,831],{},"Maak een eigen AD-groep aan en voeg de Exchange-servers daaraan toe.",[591,833],{},"\npas eerst het OU-pad aan.",[591,836],{},[716,838,839],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[591,841],{},[591,843],{},[716,845,846],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[526,848,849,852,854],{},[746,850,851],{},"start de Exchange-servers opnieuw op, zodat de rechten via de groep werken",[591,853],{},"\nIk heb een script gemaakt waarmee je de AD-rechten per use case eenvoudig kunt delegeren.",[856,857,858],"blockquote",{},[526,859,860,866,867,870],{},[746,861,862],{},[863,864,865],"em",{},"INFO:"," Zonder deze rechten krijgt de Exchange-server de fout ",[716,868,869],{},"“INSUFF_ACCESS_RIGHTS”"," van AD.",[526,872,873,882,884],{},[746,874,875,876,881],{},"Download ",[584,877,880],{"href":878,"rel":879},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[588],"Add-ExchangeADSplitPermissionOnOU.ps1"," van de glueckkanja GitHub",[591,883],{},"\nHet kan de volgende PermissionTypes toekennen:",[617,886,887,900,920,933],{},[580,888,889,892],{},[746,890,891],{},"CreateUserAndContact",[617,893,894,897],{},[580,895,896],{},"Create/delete, ResetPassword en WriteAllProperties voor Users en Contacts",[580,898,899],{},"Exchange-cmdlets: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact en de bijbehorende Remove-*",[580,901,902,905],{},[746,903,904],{},"GroupManage",[617,906,907,910,913],{},[580,908,909],{},"Create/Delete Groups, Modify Member",[580,911,912],{},"Exchange-cmdlets: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[580,914,915,916],{},"Aanvullende use cases: gebruikers die de DistributionGroups beheren waarvan ze eigenaar zijn, via https://",[917,918,919],"on-prem-exchange",{},"/EAC",[580,921,922,925],{},[746,923,924],{},"UserSendAs",[617,926,927,930],{},[580,928,929],{},"Modfiy AD Permissions on Users",[580,931,932],{},"Exchange-cmdlet: Add-ADPermission",[580,934,935,938],{},[746,936,937],{},"GroupSendAs",[617,939,940,943],{},[580,941,942],{},"Modfiy AD Permissions on Groups",[580,944,932],{},[558,946,948],{"id":947},"zo-gebruik-je-het-script","Zo gebruik je het script:",[526,950,951],{},[716,952,953,819,956,819,962,819,965,819,970],{},[716,954,955],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[957,958,959],"b",{},[716,960,961],{},"\u003COU>",[716,963,964],{},"-PermissionType",[957,966,967],{},[716,968,969],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[716,971,972],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[526,974,975,976,978],{},"bijv.",[591,977],{},[716,979,980,819,983,819,987],{},[716,981,982],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,984,985],{},[716,986,904],{},[716,988,989],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[526,991,992],{},[716,993,994,819,996,819,1000],{},[716,995,982],{},[957,997,998],{},[716,999,937],{},[716,1001,989],{},[526,1003,1004],{},[716,1005,1006,819,1009,819,1013],{},[716,1007,1008],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,1010,1011],{},[716,1012,924],{},[716,1014,989],{},[526,1016,1017],{},[716,1018,1019],{},[716,1020,1021],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[558,1023,1025],{"id":1024},"exchange-rbac-toekennen","Exchange RBAC toekennen",[526,1027,1028,1031,1033],{},[746,1029,1030],{},"Activeer de parameter -BypassSecurityGroupManagerCheck opnieuw voor de cmdlets Add-DistributionGroupMember en Remove-DistributionGroupMember:",[591,1032],{},[716,1034,1035],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[856,1037,1038],{},[526,1039,1040,819,1044,1046],{},[746,1041,1042],{},[863,1043,865],{},[591,1045],{},"Anders krijg je \"-BypassSecurityGroupManagerCheck parameter is not available\" of \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1048,1049,1051,1054,1056],{},[591,1050],{},[746,1052,1053],{},"Activeer de cmdlets New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... met de benodigde parameters opnieuw:",[591,1055],{},[716,1057,1058],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1060,1062],{"id":1061},"conclusie","Conclusie",[526,1064,1065],{},"Ik hoop dat met deze handleiding veel meer mensen deze belangrijke stap zetten en hun Active Directory beveiligen tegen compromittering via Exchange. Ik ben tot nu toe geen problemen tegengekomen bij het implementeren van het Exchange AD split permissions-model en van de aanpassingen uit dit artikel bij onze klanten.",[526,1067,1068],{},"Ik hoop dat Microsoft een ingebouwde manier gaat leveren voor deze granulaire, OU-gebaseerde aanpak in plaats van het huidige alles of niets, zodat die breed wordt overgenomen.",[526,1070,1071,1072,1077,1078,1083],{},"Omdat AD Tiering me erg aan het hart gaat: log daarnaast niet in op Exchange-servers met Domain Admin-accounts (of andere Tier0-accounts), maar behandel ze vanaf nu als Tier1 en implementeer AD Tiering zo snel mogelijk.\nAls eerste stap raad ik tools als ",[584,1073,1076],{"href":1074,"rel":1075},"https://www.pingcastle.com/",[588],"PingCastle"," of ",[584,1079,1082],{"href":1080,"rel":1081},"https://www.semperis.com/purple-knight/",[588],"Purple Knight"," aan om je AD-security en control paths te beoordelen.",[1085,1086,1087],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":530,"searchDepth":531,"depth":531,"links":1089},[1090,1092,1093,1094,1095,1098,1105],{"id":560,"depth":1091,"text":561},3,{"id":574,"depth":1091,"text":575},{"id":608,"depth":1091,"text":609},{"id":642,"depth":1091,"text":643},{"id":702,"depth":531,"text":703,"children":1096},[1097],{"id":721,"depth":1091,"text":722},{"id":741,"depth":531,"text":742,"children":1099},[1100,1101,1102,1103,1104],{"id":752,"depth":1091,"text":753},{"id":795,"depth":1091,"text":796},{"id":825,"depth":1091,"text":826},{"id":947,"depth":1091,"text":948},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},"post",{"lang":1108,"seoTitle":1109,"titleClass":1110,"date":1111,"blogtitlepic":1112,"socialimg":1113,"customExcerpt":1114,"keywords":1115,"scripts":1116,"asideNav":1117,"maxContent":325,"published":484},"nl","Exchange AD Split Permissions: Active Directory beveiligen met least privilege","h2-font-size","2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-premises Exchange Server-installaties zijn nog steeds wijdverbreid, ook bij organisaties die alle mailboxen naar de cloud hebben verplaatst. Ze hebben binnen Active Directory nog altijd vergaande rechten, waardoor er meestal een duidelijk aanvalspad bestaat om het hele AD te compromitteren en daarmee doorgaans een groot deel van de bedrijfs-IT. De overstap naar het zogenoemde model met “AD Split permissions” haalt die kritieke rechten weg, en ik heb een oplossing ontwikkeld die de nadelen wegneemt die de invoering tot nu toe verhinderden.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange-rechten, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1118},[1119,1121,1123,1125,1127],{"href":1120,"text":561},"#tldr-wat-als-we-de-nadelen-wegnemen",{"href":1122,"text":609},"#waarom-is-dit-nu-belangrijk",{"href":1124,"text":703},"#maar-waarom-doet-niemand-het",{"href":1126,"text":742},"#laat-me-die-no-regrets-optie-zien",{"href":1128,"text":1062},"#conclusie","/posts/2026-01-27-exchange-active-directory",{"title":552,"description":530},"posts/2026-01-27-exchange-active-directory","2M1DEK-XYame-RaWZ4zOCr_gyzQIemmpPtdErfCiIYA",{"id":1134,"title":1135,"author":1136,"body":1137,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":484,"layout":1106,"meta":1749,"moment":1750,"navigation":325,"path":1764,"seo":1765,"stem":1766,"tags":494,"webcast":484,"__hash__":1767},"content_nl/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions zonder spijt",[521],{"type":523,"value":1138,"toc":1736},[1139,1141,1144,1148,1153,1167,1170,1177,1182,1184,1192,1204,1209,1212,1216,1248,1266,1268,1276,1284,1288,1302,1306,1311,1315,1320,1380,1384,1421,1424,1426,1440,1447,1463,1472,1476,1479,1525,1528,1535,1540,1543,1557,1573,1585,1596,1600,1658,1660,1665,1685,1692,1716,1718,1721,1724,1734],[700,1140,561],{"id":560},[526,1142,1143],{},"Ik heb een manier gevonden om AD- en RBAC-permissies precies daar opnieuw toe te kennen waar de Exchange-gebruikers, -groepen en -contacten staan, zonder dat admins of identity management-systemen hun werkwijze hoeven aan te passen. Die frictie is in mijn ervaring voor de meeste bedrijven de belangrijkste blokkade geweest. En we houden de security-voordelen tegen lateral movement en domeincompromittering onverminderd overeind.",[526,1145,1146],{},[568,1147],{"alt":570,"src":571},[526,1149,1150],{},[746,1151,1152],{},"Het gaat in drie stappen:",[577,1154,1156,1161,1164],{"style":1155},"margin: 0.25rem 0",[580,1157,582,1158],{},[584,1159,1160],{"href":586},"AD split permission model",[580,1162,1163],{},"Ken de Exchange-servers de verloren AD-permissies weer toe, maar alleen op de relevante OU's",[580,1165,1166],{},"Ken Exchange RBAC toe om de ontbrekende PowerShell-cmdlets weer beschikbaar te maken",[526,1168,1169],{},"Allemaal via de documentatie van Microsoft, AD-ACL's of Exchange RBAC-assignments.",[1171,1172],"video-frame",{"thumb":1173,"alt":1174,"id":1175,":full-width":1176},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","Een spreker zit voor een laptop en legt een slide uit met de titel Step 1: Active Directory Permissions van glueckkanja. De slide laat zien hoe je Microsoft Exchange AD Split Permissions implementeert, met PowerShell-commando's voor het aanmaken van een delegatiegroep (New-ADGroup, Add-ADGroupMember) en het toekennen van permissies via het script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[1178,1179,1181],"div",{"style":1180},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions without regrets. Een stap-voor-stap implementatiegids",[700,1183,609],{"id":608},[526,1185,1186,1187,1189,1191],{},"Sinds de introductie met Exchange 2010 SP1 is het grotendeels over het hoofd gezien of genegeerd. Het standaard shared permissions-model vormt echter een groot security-risico, omdat het een overname van Active Directory mogelijk maakt. Gecombineerd met de reputatie die Exchange de afgelopen jaren heeft opgebouwd op het gebied van remote exploits, is het tijd om te handelen.",[591,1188],{},[591,1190],{},"\nHet probleem komt voort uit privileges die op de root van een domein worden toegekend en die vervolgens door het hele domein worden geërfd.",[617,1193,1194,1197,1199,1201],{"style":1155},[580,1195,1196],{},"permissies op gebruikers en groepen wijzigen (in de praktijk volledige toegang)",[580,1198,624],{},[580,1200,627],{},[580,1202,1203],{},"gebruikers en groepen aanmaken of verwijderen",[526,1205,1206],{},[568,1207],{"alt":1208,"src":636},"Permissies",[526,1210,1211],{},"Alleen bepaalde sterk geprivilegieerde Tier 0-gebruikers en -groepen worden beschermd door het AdminSDHolder-proces (attribuut admincount=1), en in veel omgevingen zijn er onbeschermde gebruikers of groepen waarmee het domein en/of de forest gecompromitteerd kan worden, of die op zijn minst grote schade kunnen aanrichten.",[526,1213,1214],{},[746,1215,643],{},[617,1217,1218,1221,1238],{"style":1155},[580,1219,1220],{},"Entra Connect Sync-account bij gebruik van Password Hash Sync",[580,1222,1223,1224],{},"Standaardgroepen",[617,1225,1227,1230,1235],{"style":1226},"margin: 0",[580,1228,1229],{},"Allowed RODC Password Replication Group in combinatie met het Entra Connect-account (als er een echte Windows RODC bestaat)",[580,1231,659,1232,665],{},[584,1233,664],{"href":1234,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta",[580,1236,1237],{},"Protected Users leegmaken om beschermingen weg te nemen en zo aanvalsvectoren te creëren",[580,1239,1240,1241],{},"Onbeschermde eigen groepen of admin- en serviceaccounts",[617,1242,1243,1246],{"style":1226},[580,1244,1245],{},"Schrijfrechten op GPO's (die op domeincontrollers van toepassing zijn)",[580,1247,679],{},[526,1249,1250,1251,1253,1255,1256,1259,1261,693,1263],{},"Het is heel lastig om al deze bestaande en toekomstige paden achteraf dicht te zetten. Voor de eigen OU _ADM kun je ACL-overerving uitschakelen, maar de meeste standaardobjecten mogen niet uit de standaard Builtin-OU of de Users-container worden verplaatst en blijven dus kwetsbaar.",[591,1252],{},[591,1254],{},"\nVeel beter is het om de verstrekkende permissies op de root te verwijderen, en dat doe je door het Active Directory split permissions-model te implementeren. ",[584,1257,690],{"href":688,"rel":1258},[588],[591,1260],{},[591,1262],{},[584,1264,698],{"href":696,"rel":1265},[588],[700,1267,703],{"id":702},[526,1269,1270,1271,1273,1275],{},"Omdat split permissions pas met Exchange 2010 SP1 beschikbaar kwamen, had inmiddels iedereen de situatie geaccepteerd, en het lijkt erop dat security-teams het model daarna niet succesvol hebben kunnen doorvoeren.",[591,1272],{},[591,1274],{},"\nDaarnaast zou het aanpassingen in admin- en IDM-processen hebben afgedwongen, zoals gebruikers of distributielijsten eerst in AD aanmaken en ze pas daarna via Exchange “mail enabled” maken.",[856,1277,1278],{},[526,1279,1280,1283],{},[746,1281,1282],{},"Info:"," De volgende cmdlets zijn daarna niet meer beschikbaar of werken niet meer: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[526,1285,1286],{},[746,1287,722],{},[617,1289,1290,1299],{"style":1155},[580,1291,1292,1293],{},"New-Mailbox (waarbij Exchange naar AD schrijft) wordt:",[617,1294,1295,1297],{"style":1226},[580,1296,732],{},[580,1298,735],{},[580,1300,1301],{},"Add-ADPermission voor SendAs-rechten zou via Active Directory Users and Computers op het tabblad Security moeten gebeuren, wat voor standaardadmins vaak extra AD-permissies vereist.",[700,1303,1305],{"id":1304},"laat-die-no-regrets-optie-zien","Laat die no-regrets-optie zien",[526,1307,1308,1310],{},[746,1309,748],{},": Lees de volgende links en artikelen volledig door en zorg dat je ze begrijpt, voer het eerst uit in een testomgeving en controleer of je AD-backups actueel zijn en je recovery-procedures op orde zijn.",[558,1312,1314],{"id":1313},"huidig-gebruik-auditen","Huidig gebruik auditen",[526,1316,1317],{},[746,1318,1319],{},"Controleer eerst welke van de betrokken cmdlets op welke OU's worden gebruikt:",[1321,1322,1323,1331,1333,1339,1341],"code-block",{},[1324,1325,1326,1330],"span",{},[1324,1327,1329],{"style":1328},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,1332],{},[1324,1334,1335,1338],{},[1324,1336,1337],{"style":1328},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,1340],{},[1324,1342,1343,819,1346,1350,1351,819,1354,1356,1357,1360,1361,819,1364,819,1367,819,1369,1372,1373,1376,1377],{},[1324,1344,1345],{"style":1328},"Search-AdminAuditLog",[1324,1347,1349],{"style":1348},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1324,1352,1353],{"style":1348},"-Cmdlets",[1324,1355,1337],{"style":1328}," | ",[1324,1358,1359],{"style":1328},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1324,1362,1363],{"style":1328},"Export-Csv",[1324,1365,1366],{"style":1348},"-Path",[1324,1368,1329],{"style":1328},[1324,1370,1371],{"style":1348},"-Delimiter"," \";\" ",[1324,1374,1375],{"style":1348},"-Encoding"," Unicode ",[1324,1378,1379],{"style":1348},"-NoTypeInformation",[526,1381,1382],{},[746,1383,778],{},[1321,1385,1386,1402,1404,1412,1414],{},[1324,1387,1388,1391,1392,819,1395,819,1397,819,1399,1401],{},[1324,1389,1390],{"style":1328},"$CSVs"," = ",[1324,1393,1394],{"style":1328},"Import-Csv",[1324,1396,1366],{"style":1348},[1324,1398,1329],{"style":1328},[1324,1400,1371],{"style":1348}," \";\"",[591,1403],{},[1324,1405,1406,1356,1408,1411],{},[1324,1407,1390],{"style":1328},[1324,1409,1410],{"style":1328},"Group-Object"," Caller",[591,1413],{},[1324,1415,1416,1356,1418,1420],{},[1324,1417,1390],{"style":1328},[1324,1419,1410],{"style":1328}," CmdletName",[526,1422,1423],{},"Analyseer de CSV om te bepalen waar AD-permissies nodig zijn. Eventueel kun je optimaliseren door alle Exchange-relevante groepen naar aparte OU's te verplaatsen.",[700,1425,796],{"id":795},[526,1427,1428,1429,1432,1433,1437],{},"Volg de instructie van Microsoft ",[746,1430,1431],{},"\"Switch to Active Directory split permissions\""," in\n",[584,1434,690],{"href":1435,"rel":1436},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[588],[863,1438,1439],{},"(NIET RBAC split permissions)",[526,1441,1442,1443,1446],{},"In feite verwijdert dit de gevaarlijke permissies van de groep ",[746,1444,1445],{},"\"Exchange Windows Permissions\""," en haalt het Exchange ook als groepslid weg.",[1321,1448,1449],{},[1324,1450,1451,819,1454,819,1457,819,1460],{},[1324,1452,1453],{"style":1328},"Setup.exe",[1324,1455,1456],{"style":1348},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1324,1458,1459],{"style":1348},"/PrepareAD",[1324,1461,1462],{"style":1348},"/ActiveDirectorySplitPermissions:true",[1178,1464,1466,1467,1469,1470],{"style":1465},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[746,1468,1282],{}," Om het terug te draaien gebruik je simpelweg ",[716,1471,822],{},[558,1473,1475],{"id":1474},"ad-permissies-toekennen","AD-permissies toekennen",[526,1477,1478],{},"Maak een eigen AD-groep aan en maak de Exchange-servers daar lid van.",[1321,1480,1481,1487,1489,819,1492,1495,1496,1499,1500,1503,1504,819,1506,819,1509,1512,1513,1515,1495,1518,1521,1522],{},[1324,1482,1483],{},[1324,1484,1486],{"style":1485},"color:var(--color-black-40)","# adjust OU Path first!",[591,1488],{},[1324,1490,1491],{"style":1328},"New-ADGroup",[1324,1493,1494],{"style":1348},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1324,1497,1498],{"style":1348},"-GroupCategory"," Security ",[1324,1501,1502],{"style":1348},"-GroupScope"," DomainLocal ",[1324,1505,1366],{"style":1348},[746,1507,1508],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1324,1510,1511],{"style":1348},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,1514],{},[1324,1516,1517],{"style":1328},"Add-ADGroupMember",[1324,1519,1520],{"style":1348},"-Members"," \"Exchange Trusted Subsystem\"\n",[1324,1523,1524],{"style":1485},"# reboot Exchange servers for permissions via group to work",[526,1526,1527],{},"Ik heb een script gemaakt waarmee je de AD-permissies per use case eenvoudig kunt delegeren.",[856,1529,1530],{},[526,1531,1532,1533,870],{},"Zonder deze permissies krijgt de Exchange-server de foutmelding ",[716,1534,869],{},[526,1536,875,1537,881],{},[584,1538,880],{"href":878,"rel":1539},[588],[526,1541,1542],{},"Het script kan de volgende PermissionTypes toekennen:",[526,1544,1546,1548,1550,1551,1553],{"style":1545},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[746,1547,891],{},[591,1549],{},"Aanmaken en verwijderen, ResetPassword en WriteAllProperties voor Users en Contacts",[591,1552],{},[1554,1555,1556],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` en de bijbehorende `Remove-*`",[526,1558,1560,1562,1564,1565,1567],{"style":1559},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[746,1561,904],{},[591,1563],{},"Groepen aanmaken en verwijderen, lidmaatschappen wijzigen",[591,1566],{},[1554,1568,1569,1570,1572],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1571],{},"Daarnaast: gebruikers die via de EAC de DistributionGroups beheren waarvan ze eigenaar zijn",[526,1574,1575,1577,1579,1580,1582],{"style":1559},[746,1576,924],{},[591,1578],{},"AD-permissies op Users wijzigen",[591,1581],{},[1554,1583,1584],{},"Exchange-cmdlet: `Add-ADPermission`",[526,1586,1587,1589,1591,1592,1594],{"style":1559},[746,1588,937],{},[591,1590],{},"AD-permissies op Groups wijzigen",[591,1593],{},[1554,1595,1584],{},[526,1597,1598],{},[746,1599,948],{},[1321,1601,1602,819,1604,1607,1608,1610,1611,1614,1615,1618,1620,819,1622,1624,1625,1627,1628,1614,1630,819,1632,1624,1634,1636,1637,1614,1639,819,1641,1643,1644,1646,1647,1614,1649,819,1651,1643,1653,1655,1656,1614],{},[1324,1603,880],{"style":1328},[1324,1605,1606],{"style":1348},"-TargetOU"," \u003COU> ",[1324,1609,964],{"style":1348}," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1324,1612,1613],{"style":1348},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1324,1616,1617],{"style":1485},"# For example",[591,1619],{},[1324,1621,880],{"style":1328},[1324,1623,1606],{"style":1348}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1324,1626,964],{"style":1348}," GroupManage ",[1324,1629,1613],{"style":1348},[1324,1631,880],{"style":1328},[1324,1633,1606],{"style":1348},[1324,1635,964],{"style":1348}," GroupSendAs ",[1324,1638,1613],{"style":1348},[1324,1640,880],{"style":1328},[1324,1642,1606],{"style":1348}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1324,1645,964],{"style":1348}," UserSendAs ",[1324,1648,1613],{"style":1348},[1324,1650,880],{"style":1328},[1324,1652,1606],{"style":1348},[1324,1654,964],{"style":1348}," CreateUserAndContact ",[1324,1657,1613],{"style":1348},[558,1659,1025],{"id":1024},[526,1661,1662],{},[746,1663,1664],{},"Maak de parameter -BypassSecurityGroupManagerCheck weer beschikbaar voor de cmdlets Add-DistributionGroupMember en Remove-DistributionGroupMember:",[1321,1666,1667],{},[1324,1668,1669,819,1672,1674,1675,1678,1679,1681,1682,1684],{},[1324,1670,1671],{"style":1328},"New-RoleGroup",[1324,1673,1494],{"style":1348}," \"SplitPermission Security Group Creation and Membership\" ",[1324,1676,1677],{"style":1348},"-Roles"," \"Security Group Creation and Membership\" ",[1324,1680,1520],{"style":1348}," \"Organization Management\",\"Recipient Management\" ",[1324,1683,1511],{"style":1348}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[856,1686,1687],{},[526,1688,1689,1691],{},[746,1690,1282],{}," Anders krijg je \"-BypassSecurityGroupManagerCheck parameter is not available\" of \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1693,1694,1696,1699,1701],{},[591,1695],{},[746,1697,1698],{},"Maak de cmdlets New-Mailbox, New-RemoteMailbox, New-MailContact en Remove-... met de benodigde parameters weer beschikbaar:",[591,1700],{},[1321,1702,1703,819,1705,1707,1708,1710,1711,1681,1713,1715],{},[1324,1704,1671],{"style":1328},[1324,1706,1494],{"style":1348}," \"SplitPermission Mail Recipient Creation\" ",[1324,1709,1677],{"style":1348}," \"Mail Recipient Creation\" ",[1324,1712,1520],{"style":1348},[1324,1714,1511],{"style":1348}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1717,1062],{"id":1061},[526,1719,1720],{},"Ik hoop dat deze handleiding meer organisaties helpt om de belangrijke stap te zetten en hun Active Directory te beschermen tegen compromittering via Exchange. Bij de implementatie van het Exchange AD Split Permissions-model bij meerdere klanten ben ik geen problemen tegengekomen en verliep de overgang soepel.",[526,1722,1723],{},"Ik hoop ook dat Microsoft een native, OU-gebaseerde aanpak introduceert om deze granulariteit te bereiken in plaats van het huidige alles-of-niets-model, want dat zou brede adoptie aanzienlijk eenvoudiger maken.",[526,1725,1726,1727,1077,1730,1733],{},"Nog een opmerking over AD Tiering: meld je niet aan op Exchange-servers met Domain Admin of andere Tier 0-accounts. Behandel Exchange-servers als Tier 1 en implementeer AD Tiering zo snel mogelijk. Als eerste stap raad ik aan om met ",[584,1728,1076],{"href":1074,"rel":1729},[588],[584,1731,1082],{"href":1080,"rel":1732},[588]," je AD security posture te beoordelen en control path-blootstellingen in kaart te brengen.",[1085,1735,1087],{},{"title":530,"searchDepth":531,"depth":531,"links":1737},[1738,1739,1740,1741,1744,1748],{"id":560,"depth":531,"text":561},{"id":608,"depth":531,"text":609},{"id":702,"depth":531,"text":703},{"id":1304,"depth":531,"text":1305,"children":1742},[1743],{"id":1313,"depth":1091,"text":1314},{"id":795,"depth":531,"text":796,"children":1745},[1746,1747],{"id":1474,"depth":1091,"text":1475},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},{"lang":1108,"seoTitle":1109,"titleClass":1110,"date":1750,"blogtitlepic":1751,"socialimg":1752,"customExcerpt":1753,"keywords":1754,"scripts":1755,"asideNav":1756,"maxContent":325,"published":325},"2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Zelfs organisaties die hun mailboxen volledig naar de cloud hebben verhuisd, laten vaak nog Exchange-servers on-premises draaien, en daarmee blijft een onderschat security-risico voor Active Directory bestaan. Het model “AD Split Permissions” ontneemt Exchange de brede AD-privileges die aanvallers kunnen misbruiken voor een volledige domeincompromittering. Tot nu toe strandde de invoering vooral op de procesaanpassingen die het beheerders oplegt. Dit artikel laat zien hoe je precies die hindernis elegant wegneemt: een script dat de verloren AD-permissies gericht en alleen op de relevante OU's opnieuw toekent, zodat de vertrouwde beheerworkflow blijft bestaan en je het volledige security-voordeel toch binnenhaalt.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1757},[1758,1759,1760,1761,1763],{"href":1120,"text":561},{"href":1122,"text":609},{"href":1124,"text":703},{"href":1762,"text":1305},"#laat-die-no-regrets-optie-zien",{"href":1128,"text":1062},"/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":1135,"description":530},"posts/2026-03-01-exchange-ad-split-permissions-hardening","C9quu957UsqDxYPwlOMjj1fZGa7Mi4PZxKn-MtPt7ac",[],{"id":1770,"extension":1771,"meta":1772,"stem":8,"__hash__":1779},"authors_data/authors.json","json",{"Thorsten Kunzi":1773},{"display_name":521,"avatar":1774,"permalink":1775,"twitter":1776,"linkedin":1777,"imageOffsetTop":1778},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi","glueckkanjagab","company/glueckkanja-gab","72%","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383993923]