[{"data":1,"prerenderedAt":1823},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"post-nl--posts-2026-03-01-exchange-ad-split-permissions-hardening-d948cda78b15d":519,"authors_data":1237,"content-nl-list-7b291c2dd91a4":1590,"authors_data:Thorsten Kunzi":1820},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":1194,"eventid":494,"extension":1209,"hideInRecent":484,"layout":1210,"meta":1211,"moment":1215,"navigation":325,"path":1233,"seo":1234,"stem":1235,"tags":494,"webcast":484,"__hash__":1236},"content_nl/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions zonder spijt",[523],"Thorsten Kunzi",{"type":525,"value":526,"toc":1193},"minimal",[527,532,536,543,549,568,571,578,583,587,596,611,617,620,625,661,685,689,697,706,711,727,731,737,742,747,808,813,850,853,857,872,879,895,906,910,913,959,962,971,980,983,998,1015,1028,1040,1045,1104,1108,1113,1133,1140,1164,1168,1171,1174,1189],[528,529,531],"h2",{"id":530},"tldr-wat-als-we-de-nadelen-wegnemen","TLDR: wat als we de nadelen wegnemen?",[533,534,535],"p",{},"Ik heb een manier gevonden om AD- en RBAC-permissies precies daar opnieuw toe te kennen waar de Exchange-gebruikers, -groepen en -contacten staan, zonder dat admins of identity management-systemen hun werkwijze hoeven aan te passen. Die frictie is in mijn ervaring voor de meeste bedrijven de belangrijkste blokkade geweest. En we houden de security-voordelen tegen lateral movement en domeincompromittering onverminderd overeind.",[533,537,538],{},[539,540],"img",{"alt":541,"src":542},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[533,544,545],{},[546,547,548],"strong",{},"Het gaat in drie stappen:",[550,551,553,562,565],"ol",{"style":552},"margin: 0.25rem 0",[554,555,556,557],"li",{},"Implementeer het ",[558,559,561],"a",{"href":560},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions","AD split permission model",[554,563,564],{},"Ken de Exchange-servers de verloren AD-permissies weer toe, maar alleen op de relevante OU's",[554,566,567],{},"Ken Exchange RBAC toe om de ontbrekende PowerShell-cmdlets weer beschikbaar te maken",[533,569,570],{},"Allemaal via de documentatie van Microsoft, AD-ACL's of Exchange RBAC-assignments.",[572,573],"video-frame",{"thumb":574,"alt":575,"id":576,":full-width":577},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","Een spreker zit voor een laptop en legt een slide uit met de titel Step 1: Active Directory Permissions van glueckkanja. De slide laat zien hoe je Microsoft Exchange AD Split Permissions implementeert, met PowerShell-commando's voor het aanmaken van een delegatiegroep (New-ADGroup, Add-ADGroupMember) en het toekennen van permissies via het script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[579,580,582],"div",{"style":581},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions without regrets. Een stap-voor-stap implementatiegids",[528,584,586],{"id":585},"waarom-is-dit-nu-belangrijk","Waarom is dit (nu) belangrijk?",[533,588,589,590,593,595],{},"Sinds de introductie met Exchange 2010 SP1 is het grotendeels over het hoofd gezien of genegeerd. Het standaard shared permissions-model vormt echter een groot security-risico, omdat het een overname van Active Directory mogelijk maakt. Gecombineerd met de reputatie die Exchange de afgelopen jaren heeft opgebouwd op het gebied van remote exploits, is het tijd om te handelen.",[591,592],"br",{},[591,594],{},"\nHet probleem komt voort uit privileges die op de root van een domein worden toegekend en die vervolgens door het hele domein worden geërfd.",[597,598,599,602,605,608],"ul",{"style":552},[554,600,601],{},"permissies op gebruikers en groepen wijzigen (in de praktijk volledige toegang)",[554,603,604],{},"groepslidmaatschappen wijzigen",[554,606,607],{},"wachtwoorden van gebruikers resetten",[554,609,610],{},"gebruikers en groepen aanmaken of verwijderen",[533,612,613],{},[539,614],{"alt":615,"src":616},"Permissies","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[533,618,619],{},"Alleen bepaalde sterk geprivilegieerde Tier 0-gebruikers en -groepen worden beschermd door het AdminSDHolder-proces (attribuut admincount=1), en in veel omgevingen zijn er onbeschermde gebruikers of groepen waarmee het domein en/of de forest gecompromitteerd kan worden, of die op zijn minst grote schade kunnen aanrichten.",[533,621,622],{},[546,623,624],{},"Bekende voorbeelden:",[597,626,627,630,650],{"style":552},[554,628,629],{},"Entra Connect Sync-account bij gebruik van Password Hash Sync",[554,631,632,633],{},"Standaardgroepen",[597,634,636,639,647],{"style":635},"margin: 0",[554,637,638],{},"Allowed RODC Password Replication Group in combinatie met het Entra Connect-account (als er een echte Windows RODC bestaat)",[554,640,641,642,646],{},"Zie ook ",[558,643,645],{"href":644,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta","Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps",", waarin meer paden worden beschreven (de groep Account Operators vormt een vergelijkbare dreiging)",[554,648,649],{},"Protected Users leegmaken om beschermingen weg te nemen en zo aanvalsvectoren te creëren",[554,651,652,653],{},"Onbeschermde eigen groepen of admin- en serviceaccounts",[597,654,655,658],{"style":635},[554,656,657],{},"Schrijfrechten op GPO's (die op domeincontrollers van toepassing zijn)",[554,659,660],{},"Beheer van toegang tot AD-backups, backupserver, PKI-templates, hypervisor, ...",[533,662,663,664,666,668,669,675,677,679,680],{},"Het is heel lastig om al deze bestaande en toekomstige paden achteraf dicht te zetten. Voor de eigen OU _ADM kun je ACL-overerving uitschakelen, maar de meeste standaardobjecten mogen niet uit de standaard Builtin-OU of de Users-container worden verplaatst en blijven dus kwetsbaar.",[591,665],{},[591,667],{},"\nVeel beter is het om de verstrekkende permissies op de root te verwijderen, en dat doe je door het Active Directory split permissions-model te implementeren. ",[558,670,674],{"href":671,"rel":672},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[673],"nofollow","Configure Exchange Server for split permissions | Microsoft Learn",[591,676],{},[591,678],{},"\nEn Microsoft is het daarmee eens: “…encouraged to implement Active Directory split permissions” ",[558,681,684],{"href":682,"rel":683},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[673],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[528,686,688],{"id":687},"maar-waarom-doet-niemand-het","Maar waarom doet niemand het?",[533,690,691,692,694,696],{},"Omdat split permissions pas met Exchange 2010 SP1 beschikbaar kwamen, had inmiddels iedereen de situatie geaccepteerd, en het lijkt erop dat security-teams het model daarna niet succesvol hebben kunnen doorvoeren.",[591,693],{},[591,695],{},"\nDaarnaast zou het aanpassingen in admin- en IDM-processen hebben afgedwongen, zoals gebruikers of distributielijsten eerst in AD aanmaken en ze pas daarna via Exchange “mail enabled” maken.",[698,699,700],"blockquote",{},[533,701,702,705],{},[546,703,704],{},"Info:"," De volgende cmdlets zijn daarna niet meer beschikbaar of werken niet meer: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[533,707,708],{},[546,709,710],{},"Voorbeelden van procesaanpassingen:",[597,712,713,724],{"style":552},[554,714,715,716],{},"New-Mailbox (waarbij Exchange naar AD schrijft) wordt:",[597,717,718,721],{"style":635},[554,719,720],{},"New-ADUser (waarbij adm.jdoe naar AD schrijft)",[554,722,723],{},"Enable-Mailbox",[554,725,726],{},"Add-ADPermission voor SendAs-rechten zou via Active Directory Users and Computers op het tabblad Security moeten gebeuren, wat voor standaardadmins vaak extra AD-permissies vereist.",[528,728,730],{"id":729},"laat-die-no-regrets-optie-zien","Laat die no-regrets-optie zien",[533,732,733,736],{},[546,734,735],{},"Disclaimer",": Lees de volgende links en artikelen volledig door en zorg dat je ze begrijpt, voer het eerst uit in een testomgeving en controleer of je AD-backups actueel zijn en je recovery-procedures op orde zijn.",[738,739,741],"h3",{"id":740},"huidig-gebruik-auditen","Huidig gebruik auditen",[533,743,744],{},[546,745,746],{},"Controleer eerst welke van de betrokken cmdlets op welke OU's worden gebruikt:",[748,749,750,758,760,766,768],"code-block",{},[751,752,753,757],"span",{},[751,754,756],{"style":755},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,759],{},[751,761,762,765],{},[751,763,764],{"style":755},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,767],{},[751,769,770,773,774,778,779,773,782,784,785,788,789,773,792,773,795,773,797,800,801,804,805],{},[751,771,772],{"style":755},"Search-AdminAuditLog"," ",[751,775,777],{"style":776},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[751,780,781],{"style":776},"-Cmdlets",[751,783,764],{"style":755}," | ",[751,786,787],{"style":755},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[751,790,791],{"style":755},"Export-Csv",[751,793,794],{"style":776},"-Path",[751,796,756],{"style":755},[751,798,799],{"style":776},"-Delimiter"," \";\" ",[751,802,803],{"style":776},"-Encoding"," Unicode ",[751,806,807],{"style":776},"-NoTypeInformation",[533,809,810],{},[546,811,812],{},"Snelle analyse van caller en cmdlets:",[748,814,815,831,833,841,843],{},[751,816,817,820,821,773,824,773,826,773,828,830],{},[751,818,819],{"style":755},"$CSVs"," = ",[751,822,823],{"style":755},"Import-Csv",[751,825,794],{"style":776},[751,827,756],{"style":755},[751,829,799],{"style":776}," \";\"",[591,832],{},[751,834,835,784,837,840],{},[751,836,819],{"style":755},[751,838,839],{"style":755},"Group-Object"," Caller",[591,842],{},[751,844,845,784,847,849],{},[751,846,819],{"style":755},[751,848,839],{"style":755}," CmdletName",[533,851,852],{},"Analyseer de CSV om te bepalen waar AD-permissies nodig zijn. Eventueel kun je optimaliseren door alle Exchange-relevante groepen naar aparte OU's te verplaatsen.",[528,854,856],{"id":855},"split-permissions-model-activeren","Split permissions-model activeren",[533,858,859,860,863,864,868],{},"Volg de instructie van Microsoft ",[546,861,862],{},"\"Switch to Active Directory split permissions\""," in\n",[558,865,674],{"href":866,"rel":867},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[673],[869,870,871],"em",{},"(NIET RBAC split permissions)",[533,873,874,875,878],{},"In feite verwijdert dit de gevaarlijke permissies van de groep ",[546,876,877],{},"\"Exchange Windows Permissions\""," en haalt het Exchange ook als groepslid weg.",[748,880,881],{},[751,882,883,773,886,773,889,773,892],{},[751,884,885],{"style":755},"Setup.exe",[751,887,888],{"style":776},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[751,890,891],{"style":776},"/PrepareAD",[751,893,894],{"style":776},"/ActiveDirectorySplitPermissions:true",[579,896,898,899,901,902],{"style":897},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[546,900,704],{}," Om het terug te draaien gebruik je simpelweg ",[903,904,905],"code",{},"/ActiveDirectorySplitPermissions:false",[738,907,909],{"id":908},"ad-permissies-toekennen","AD-permissies toekennen",[533,911,912],{},"Maak een eigen AD-groep aan en maak de Exchange-servers daar lid van.",[748,914,915,921,923,773,926,929,930,933,934,937,938,773,940,773,943,946,947,949,929,952,955,956],{},[751,916,917],{},[751,918,920],{"style":919},"color:var(--color-black-40)","# adjust OU Path first!",[591,922],{},[751,924,925],{"style":755},"New-ADGroup",[751,927,928],{"style":776},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[751,931,932],{"style":776},"-GroupCategory"," Security ",[751,935,936],{"style":776},"-GroupScope"," DomainLocal ",[751,939,794],{"style":776},[546,941,942],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[751,944,945],{"style":776},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,948],{},[751,950,951],{"style":755},"Add-ADGroupMember",[751,953,954],{"style":776},"-Members"," \"Exchange Trusted Subsystem\"\n",[751,957,958],{"style":919},"# reboot Exchange servers for permissions via group to work",[533,960,961],{},"Ik heb een script gemaakt waarmee je de AD-permissies per use case eenvoudig kunt delegeren.",[698,963,964],{},[533,965,966,967,970],{},"Zonder deze permissies krijgt de Exchange-server de foutmelding ",[903,968,969],{},"“INSUFF_ACCESS_RIGHTS”"," van AD.",[533,972,973,974,979],{},"Download ",[558,975,978],{"href":976,"rel":977},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[673],"Add-ExchangeADSplitPermissionOnOU.ps1"," van de glueckkanja GitHub",[533,981,982],{},"Het script kan de volgende PermissionTypes toekennen:",[533,984,986,989,991,992,994],{"style":985},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[546,987,988],{},"CreateUserAndContact",[591,990],{},"Aanmaken en verwijderen, ResetPassword en WriteAllProperties voor Users en Contacts",[591,993],{},[995,996,997],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` en de bijbehorende `Remove-*`",[533,999,1001,1004,1006,1007,1009],{"style":1000},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[546,1002,1003],{},"GroupManage",[591,1005],{},"Groepen aanmaken en verwijderen, lidmaatschappen wijzigen",[591,1008],{},[995,1010,1011,1012,1014],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1013],{},"Daarnaast: gebruikers die via de EAC de DistributionGroups beheren waarvan ze eigenaar zijn",[533,1016,1017,1020,1022,1023,1025],{"style":1000},[546,1018,1019],{},"UserSendAs",[591,1021],{},"AD-permissies op Users wijzigen",[591,1024],{},[995,1026,1027],{},"Exchange-cmdlet: `Add-ADPermission`",[533,1029,1030,1033,1035,1036,1038],{"style":1000},[546,1031,1032],{},"GroupSendAs",[591,1034],{},"AD-permissies op Groups wijzigen",[591,1037],{},[995,1039,1027],{},[533,1041,1042],{},[546,1043,1044],{},"Zo gebruik je het script:",[748,1046,1047,773,1049,1052,1053,1056,1057,1060,1061,1064,1066,773,1068,1070,1071,1073,1074,1060,1076,773,1078,1070,1080,1082,1083,1060,1085,773,1087,1089,1090,1092,1093,1060,1095,773,1097,1089,1099,1101,1102,1060],{},[751,1048,978],{"style":755},[751,1050,1051],{"style":776},"-TargetOU"," \u003COU> ",[751,1054,1055],{"style":776},"-PermissionType"," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[751,1058,1059],{"style":776},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[751,1062,1063],{"style":919},"# For example",[591,1065],{},[751,1067,978],{"style":755},[751,1069,1051],{"style":776}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1072,1055],{"style":776}," GroupManage ",[751,1075,1059],{"style":776},[751,1077,978],{"style":755},[751,1079,1051],{"style":776},[751,1081,1055],{"style":776}," GroupSendAs ",[751,1084,1059],{"style":776},[751,1086,978],{"style":755},[751,1088,1051],{"style":776}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1091,1055],{"style":776}," UserSendAs ",[751,1094,1059],{"style":776},[751,1096,978],{"style":755},[751,1098,1051],{"style":776},[751,1100,1055],{"style":776}," CreateUserAndContact ",[751,1103,1059],{"style":776},[738,1105,1107],{"id":1106},"exchange-rbac-toekennen","Exchange RBAC toekennen",[533,1109,1110],{},[546,1111,1112],{},"Maak de parameter -BypassSecurityGroupManagerCheck weer beschikbaar voor de cmdlets Add-DistributionGroupMember en Remove-DistributionGroupMember:",[748,1114,1115],{},[751,1116,1117,773,1120,1122,1123,1126,1127,1129,1130,1132],{},[751,1118,1119],{"style":755},"New-RoleGroup",[751,1121,928],{"style":776}," \"SplitPermission Security Group Creation and Membership\" ",[751,1124,1125],{"style":776},"-Roles"," \"Security Group Creation and Membership\" ",[751,1128,954],{"style":776}," \"Organization Management\",\"Recipient Management\" ",[751,1131,945],{"style":776}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[698,1134,1135],{},[533,1136,1137,1139],{},[546,1138,704],{}," Anders krijg je \"-BypassSecurityGroupManagerCheck parameter is not available\" of \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[533,1141,1142,1144,1147,1149],{},[591,1143],{},[546,1145,1146],{},"Maak de cmdlets New-Mailbox, New-RemoteMailbox, New-MailContact en Remove-... met de benodigde parameters weer beschikbaar:",[591,1148],{},[748,1150,1151,773,1153,1155,1156,1158,1159,1129,1161,1163],{},[751,1152,1119],{"style":755},[751,1154,928],{"style":776}," \"SplitPermission Mail Recipient Creation\" ",[751,1157,1125],{"style":776}," \"Mail Recipient Creation\" ",[751,1160,954],{"style":776},[751,1162,945],{"style":776}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[528,1165,1167],{"id":1166},"conclusie","Conclusie",[533,1169,1170],{},"Ik hoop dat deze handleiding meer organisaties helpt om de belangrijke stap te zetten en hun Active Directory te beschermen tegen compromittering via Exchange. Bij de implementatie van het Exchange AD Split Permissions-model bij meerdere klanten ben ik geen problemen tegengekomen en verliep de overgang soepel.",[533,1172,1173],{},"Ik hoop ook dat Microsoft een native, OU-gebaseerde aanpak introduceert om deze granulariteit te bereiken in plaats van het huidige alles-of-niets-model, want dat zou brede adoptie aanzienlijk eenvoudiger maken.",[533,1175,1176,1177,1182,1183,1188],{},"Nog een opmerking over AD Tiering: meld je niet aan op Exchange-servers met Domain Admin of andere Tier 0-accounts. Behandel Exchange-servers als Tier 1 en implementeer AD Tiering zo snel mogelijk. Als eerste stap raad ik aan om met ",[558,1178,1181],{"href":1179,"rel":1180},"https://www.pingcastle.com/",[673],"PingCastle"," of ",[558,1184,1187],{"href":1185,"rel":1186},"https://www.semperis.com/purple-knight/",[673],"Purple Knight"," je AD security posture te beoordelen en control path-blootstellingen in kaart te brengen.",[1190,1191,1192],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":1194,"searchDepth":1195,"depth":1195,"links":1196},"",2,[1197,1198,1199,1200,1204,1208],{"id":530,"depth":1195,"text":531},{"id":585,"depth":1195,"text":586},{"id":687,"depth":1195,"text":688},{"id":729,"depth":1195,"text":730,"children":1201},[1202],{"id":740,"depth":1203,"text":741},3,{"id":855,"depth":1195,"text":856,"children":1205},[1206,1207],{"id":908,"depth":1203,"text":909},{"id":1106,"depth":1203,"text":1107},{"id":1166,"depth":1195,"text":1167},"md","post",{"lang":1212,"seoTitle":1213,"titleClass":1214,"date":1215,"blogtitlepic":1216,"socialimg":1217,"customExcerpt":1218,"keywords":1219,"scripts":1220,"asideNav":1221,"maxContent":325,"published":325},"nl","Exchange AD Split Permissions: Active Directory beveiligen met least privilege","h2-font-size","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Zelfs organisaties die hun mailboxen volledig naar de cloud hebben verhuisd, laten vaak nog Exchange-servers on-premises draaien, en daarmee blijft een onderschat security-risico voor Active Directory bestaan. Het model “AD Split Permissions” ontneemt Exchange de brede AD-privileges die aanvallers kunnen misbruiken voor een volledige domeincompromittering. Tot nu toe strandde de invoering vooral op de procesaanpassingen die het beheerders oplegt. Dit artikel laat zien hoe je precies die hindernis elegant wegneemt: een script dat de verloren AD-permissies gericht en alleen op de relevante OU's opnieuw toekent, zodat de vertrouwde beheerworkflow blijft bestaan en je het volledige security-voordeel toch binnenhaalt.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1222},[1223,1225,1227,1229,1231],{"href":1224,"text":531},"#tldr-wat-als-we-de-nadelen-wegnemen",{"href":1226,"text":586},"#waarom-is-dit-nu-belangrijk",{"href":1228,"text":688},"#maar-waarom-doet-niemand-het",{"href":1230,"text":730},"#laat-die-no-regrets-optie-zien",{"href":1232,"text":1167},"#conclusie","/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":521,"description":1194},"posts/2026-03-01-exchange-ad-split-permissions-hardening","C9quu957UsqDxYPwlOMjj1fZGa7Mi4PZxKn-MtPt7ac",{"id":1238,"extension":1239,"meta":1240,"stem":8,"__hash__":1589},"authors_data/authors.json","json",{"path":1241,"Fritz Zurhorst":1242,"Alexander Schlindwein":1248,"Sophie Luna":1254,"Nadine Klein":1262,"Karsten Kleinschmidt":1268,"Julian Wendt":1276,"Holger Bunkradt":1281,"Ralf Mania":1287,"Oliver Kieselbach":1293,"Steffen Schwerdtfeger":1299,"Gunnar Winter":1307,"Jan Petersen":1312,"Thorsten Kunzi":1317,"Moritz Pohl":1320,"Thorben Pöschus":1325,"Christoph Hannebauer":1331,"Marco Scheel":1335,"Christopher Brumm":1340,"Florian Klante":1347,"Niklas Bachmann":1352,"Nils Krautkrämer":1357,"Patrick Treptau":1363,"Peter Beckendorf":1368,"Patrick Sobau":1373,"Jörg Wunderlich":1378,"Michael Breither":1382,"Christian Kanja":1387,"Zeba Hoffmann":1393,"Jochen Fröhlich":1398,"Jan Geisbauer":1402,"Gerrit Reinke":1413,"Christian Kordel":1419,"Stephan Wälde":1423,"Carolin Kanja":1428,"Adrian Ritter":1434,"Marvin Bangert":1439,"Thorsten Pickhan":1445,"Christian Lorenz":1451,"Denis Böhm":1456,"Fabian Bader":1461,"Juan Jose Fernandez Perez":1467,"Mahschid Sayyar":1472,"Benjamin Dassow":1477,"Markus Walschburger":1482,"Jonathan Haist":1487,"Daniel Rohregger":1492,"Thomas Naunheim":1497,"Florian Stöckl":1502,"Pascal Asch":1507,"Markus Kättner":1512,"Anna Ulbricht":1519,"Annette Brauns":1526,"body":1532,"title":1588},"/authors",{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1407},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1408,1410],{"text":472,"href":1409},"https://emptydc.com",{"text":1411,"href":1412},"Podcast","https://hairlessinthecloud.com",{"display_name":1414,"avatar":1415,"permalink":1416,"twitter":1417,"linkedin":1418},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1258,"linkedin":1311},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1424,"avatar":1425,"permalink":1426,"twitter":1427,"linkedin":1311},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1429,"avatar":1430,"permalink":1431,"twitter":1432,"linkedin":1433},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1440,"avatar":1441,"permalink":1442,"twitter":1443,"linkedin":1444},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1452,"avatar":1453,"permalink":1454,"linkedin":1455,"twitter":1258},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1457,"avatar":1458,"permalink":1459,"linkedin":1460,"twitter":1258},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1462,"avatar":1463,"permalink":1464,"linkedin":1465,"twitter":1466},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1468,"avatar":1469,"permalink":1470,"linkedin":1471},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1473,"avatar":1474,"permalink":1475,"linkedin":1476},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1488,"avatar":1489,"permalink":1490,"linkedin":1491,"imageOffsetTop":1247},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1493,"avatar":1494,"permalink":1495,"linkedin":1496,"imageOffsetTop":1247},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1498,"avatar":1499,"permalink":1500,"linkedin":1501,"imageOffsetTop":1346},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1503,"avatar":1504,"permalink":1505,"linkedin":1506,"imageOffsetTop":1346},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1508,"avatar":1509,"permalink":1510,"linkedin":1511,"imageOffsetTop":1346},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1513,"avatar":1514,"permalink":1515,"linkedin":1516,"imageOffsetTop":1517,"imageOffsetLeft":1518},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1520,"avatar":1521,"permalink":1522,"linkedin":1523,"imageOffsetTop":1524,"imageOffsetLeft":1525},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1531,"imageOffsetLeft":1274},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1533,"Alexander Schlindwein":1534,"Sophie Luna":1535,"Nadine Klein":1536,"Karsten Kleinschmidt":1537,"Julian Wendt":1538,"Holger Bunkradt":1539,"Ralf Mania":1540,"Oliver Kieselbach":1541,"Steffen Schwerdtfeger":1542,"Gunnar Winter":1543,"Jan Petersen":1544,"Thorsten Kunzi":1545,"Moritz Pohl":1546,"Thorben Pöschus":1547,"Christoph Hannebauer":1548,"Marco Scheel":1549,"Christopher Brumm":1550,"Florian Klante":1551,"Niklas Bachmann":1552,"Nils Krautkrämer":1553,"Patrick Treptau":1554,"Peter Beckendorf":1555,"Patrick Sobau":1556,"Jörg Wunderlich":1557,"Michael Breither":1558,"Christian Kanja":1559,"Zeba Hoffmann":1560,"Jochen Fröhlich":1561,"Jan Geisbauer":1562,"Gerrit Reinke":1566,"Christian Kordel":1567,"Stephan Wälde":1568,"Carolin Kanja":1569,"Adrian Ritter":1570,"Marvin Bangert":1571,"Thorsten Pickhan":1572,"Christian Lorenz":1573,"Denis Böhm":1574,"Fabian Bader":1575,"Juan Jose Fernandez Perez":1576,"Mahschid Sayyar":1577,"Benjamin Dassow":1578,"Markus Walschburger":1579,"Jonathan Haist":1580,"Daniel Rohregger":1581,"Thomas Naunheim":1582,"Florian Stöckl":1583,"Pascal Asch":1584,"Markus Kättner":1585,"Anna Ulbricht":1586,"Annette Brauns":1587},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1563},[1564,1565],{"text":472,"href":1409},{"text":1411,"href":1412},{"display_name":1414,"avatar":1415,"permalink":1416,"twitter":1417,"linkedin":1418},{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1258,"linkedin":1311},{"display_name":1424,"avatar":1425,"permalink":1426,"twitter":1427,"linkedin":1311},{"display_name":1429,"avatar":1430,"permalink":1431,"twitter":1432,"linkedin":1433},{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438},{"display_name":1440,"avatar":1441,"permalink":1442,"twitter":1443,"linkedin":1444},{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},{"display_name":1452,"avatar":1453,"permalink":1454,"linkedin":1455,"twitter":1258},{"display_name":1457,"avatar":1458,"permalink":1459,"linkedin":1460,"twitter":1258},{"display_name":1462,"avatar":1463,"permalink":1464,"linkedin":1465,"twitter":1466},{"display_name":1468,"avatar":1469,"permalink":1470,"linkedin":1471},{"display_name":1473,"avatar":1474,"permalink":1475,"linkedin":1476},{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481},{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486},{"display_name":1488,"avatar":1489,"permalink":1490,"linkedin":1491,"imageOffsetTop":1247},{"display_name":1493,"avatar":1494,"permalink":1495,"linkedin":1496,"imageOffsetTop":1247},{"display_name":1498,"avatar":1499,"permalink":1500,"linkedin":1501,"imageOffsetTop":1346},{"display_name":1503,"avatar":1504,"permalink":1505,"linkedin":1506,"imageOffsetTop":1346},{"display_name":1508,"avatar":1509,"permalink":1510,"linkedin":1511,"imageOffsetTop":1346},{"display_name":1513,"avatar":1514,"permalink":1515,"linkedin":1516,"imageOffsetTop":1517,"imageOffsetLeft":1518},{"display_name":1520,"avatar":1521,"permalink":1522,"linkedin":1523,"imageOffsetTop":1524,"imageOffsetLeft":1525},{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1531,"imageOffsetLeft":1274},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1591,"authors":1807},[1592,1609,1623,1637,1653,1666,1679,1692,1704,1720,1734,1749,1767,1778,1791],{"id":1593,"title":1594,"author":1595,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1596,"moment":1601,"path":1602,"stem":1603,"tags":1604,"webcast":484},"content_nl/posts/2026-09-22-end-of-mfa-sms.md","Het einde van de MFA-sms",[1269],{"lang":1212,"date":1597,"categories":1598,"blogtitlepic":1599,"customExcerpt":1600},"2026-09-21",[235],"head-conditional-access.jpg","Waarom organisaties nu moeten overstappen op phishingresistente en zo veel mogelijk wachtwoordloze aanmeldmethoden.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1605,1606,1607,1608],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1610,"title":1611,"author":1612,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1613,"moment":1597,"path":1617,"stem":1618,"tags":1619,"webcast":484},"content_nl/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Als de gebruiker de exploit is, en hoe jullie dat stoppen",[1243,1263],{"lang":1212,"date":1597,"categories":1614,"blogtitlepic":1615,"customExcerpt":1616},[235],"head-clickfix.jpg","ClickFix maakt gebruikers tot hun eigen aanvaller: een vals CAPTCHA, een copy-paste, en schadelijke code draait in het geheugen zonder dat er iets op de schijf landt. Hoe Microsoft Defender de aanval detecteert, waar de detectie tegen grenzen aanloopt en hoe jullie het gat dichten met een RunMRU-hunt en vier beschermingslagen.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1620,1621,1622],"Defender","SOC","Endpoint Security",{"id":1624,"title":1625,"author":1626,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1627,"moment":1597,"path":1631,"stem":1632,"tags":1633,"webcast":484},"content_nl/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin en dagelijks werk op één computer? Game Over.",[1403],{"lang":1212,"date":1597,"categories":1628,"blogtitlepic":1629,"customExcerpt":1630},[235],"head-game-over-en.jpg","Waarom één tenant voor CIO's niet volstaat, en de tweede zelden wordt meegedacht. De Managed Red Tenant scheidt administratief werk architectonisch van de office-omgeving, de Managed Dark Tenant houdt de organisatie handelingsbekwaam wanneer de verdediging toch valt. Wat dat betekent voor het bedrijfsmodel, het SOC-signaal en de aantoonplichten volgens NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1634,1635,1636],"Privileged Access","Zero Trust","NIS2",{"id":1638,"title":1639,"author":1640,"cta":494,"description":1641,"hideInRecent":484,"layout":1210,"meta":1642,"moment":1643,"path":1648,"stem":1649,"tags":1650,"webcast":484},"content_nl/posts/2026-08-08-isg-germany-2026.md","Vier keer Leader. glueckkanja in de ISG-studie Duitsland 2026",[1429],"ISG heeft zijn studie dit jaar een andere naam gegeven. Van het Microsoft Cloud Ecosystem werd het Microsoft AI and Cloud Ecosystem, en met de naam is de maatstaf verschoven: beoordeeld wordt niet meer wie Microsoft-platformen invoert, maar wie Copilot, agents en AI-workloads beheersbaar draait. Aan onze positie heeft de nieuwe maatstaf niets veranderd. De ISG Provider Lens®-studie Duitsland 2026 positioneert ons als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large Market en in de Mid Market. Na 2021, 2023, 2024 en 2025 is het de vijfde Leader-inschaling in Duitsland, in Zwitserland kwam de sprong naar het Leader-kwadrant twee weken eerder.",{"lang":1212,"date":1643,"categories":1644,"blogtitlepic":1646,"customExcerpt":1647},"2026-08-08",[1645],"Corporate","head-isg-de-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Duitsland als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large en in de Mid Market. De studie heet nu Microsoft AI and Cloud Ecosystem, en de maatstaf is verschoven: beoordeeld wordt wie AI- en agent-workloads beheersbaar draait.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1651,1652],"Award","ISG",{"id":1654,"title":1655,"author":1656,"cta":494,"description":1657,"hideInRecent":484,"layout":1210,"meta":1658,"moment":1659,"path":1663,"stem":1664,"tags":1665,"webcast":484},"content_nl/posts/2026-07-31-isg-switzerland-2026.md","Van Rising Star naar Leader. glueckkanja in de ISG-studie Zwitserland 2026",[1429],"In 2024 hebben we glueckkanja Switzerland AG opgericht en in het zentroom aan de Bahnhofplatz 10b in Bern een kantoor betrokken. In 2025 heeft ISG ons in de Zwitserse markt als Rising Star ingeschaald, als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant verwachten. Nu is die sprong gedocumenteerd: de ISG Provider Lens®-studie 2026 positioneert ons in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services.",{"lang":1212,"date":1659,"categories":1660,"blogtitlepic":1661,"customExcerpt":1662},"2026-07-31",[1645],"head-isg-ch-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services. Twee jaar na de markttoetreding in Bern, een jaar na de Rising-Star-onderscheiding.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1651,1652],{"id":1667,"title":1668,"author":1669,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1670,"moment":1671,"path":1675,"stem":1676,"tags":1677,"webcast":484},"content_nl/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Wat het OpenAI/Hugging-Face-incident verraadt en wat niet",[1403],{"lang":1212,"date":1671,"categories":1672,"blogtitlepic":1673,"customExcerpt":1674},"2026-07-24",[235],"head-outbreak.jpg","Een AI-agent breekt uit zijn testomgeving, vindt een zero-day en hackt een ander bedrijf. Klinkt als een scenario, maar is in juli 2026 daadwerkelijk gebeurd. Tijd voor een nuchtere plaatsbepaling: met wat psychologie, twee securityveteranen en de vraag wat dit voor jullie verdediging betekent.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1678,1621,1635],"AI",{"id":1680,"title":1681,"author":1682,"cta":494,"description":1683,"hideInRecent":484,"layout":1210,"meta":1684,"moment":1685,"path":1689,"stem":1690,"tags":1691,"webcast":484},"content_nl/posts/2026-07-22-isg-cybersecurity-2026.md","Leader en Rising Star. glueckkanja in de ISG Cybersecurity-studie 2026",[1429],"Nieuw in het kwadrant en meteen Leader: de ISG Provider Lens®-studie \"Cybersecurity – Services and Solutions 2026\" positioneert glueckkanja als Leader op het gebied van Next-Gen SOC/MDR Services voor de Duitse midmarket. In de totale markt voor Next-Gen SOC/MDR Services onderscheidt ISG ons als Rising Star, dus als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant binnen de komende 12 tot 24 maanden verwachten.",{"lang":1212,"date":1685,"categories":1686,"blogtitlepic":1687,"customExcerpt":1688},"2026-07-22",[1645],"head-isg-cybersecurity-2026.png","De ISG Provider Lens®-studie Cybersecurity 2026 onderscheidt glueckkanja als Leader in het kwadrant Next-Gen SOC/MDR Services (Midmarket). In de totale markt voor Next-Gen SOC/MDR Services zijn we Rising Star. ISG schrijft ons bovengemiddelde groei toe, diepgaande Microsoft-securityexpertise en een 24/7 SOC vanuit Duitsland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1651,1652,235],{"id":1693,"title":1694,"author":1695,"cta":494,"description":1696,"hideInRecent":484,"layout":1210,"meta":1697,"moment":1698,"path":1701,"stem":1702,"tags":1703,"webcast":484},"content_nl/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: wat AI echt nodig heeft om te werken",[1429],"Een productiebedrijf wil weten welke van zijn 14.000 SKU's daadwerkelijk winstgevend zijn. Het antwoord ligt in drie systemen die nog nooit één enkel datapunt met elkaar hebben uitgewisseld. Tot voor kort kostte het drie afdelingen, twee weken en de nodige goede wil om dat antwoord te krijgen. Sinds begin 2026 kan een AI die vraag in minuten beantwoorden: de data doorzoeken, verbanden leggen, een aanbeveling produceren. Op voorwaarde dat ze toegang heeft.",{"lang":1212,"date":1698,"categories":1699,"blogtitlepic":1700},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1678,131],{"id":1705,"title":1706,"author":1707,"cta":494,"description":1708,"hideInRecent":484,"layout":1210,"meta":1709,"moment":1710,"path":1714,"stem":1715,"tags":1716,"webcast":484},"content_nl/posts/2026-07-01-onboarding-process.md","Contract ondertekend: zo verloopt jouw onboarding bij ons",[1520],"Hoe verloopt jullie onboarding eigenlijk? Een vraag die we in gesprekken met sollicitanten steeds opnieuw tegenkomen, want velen hebben al eens meegemaakt dat een onboarding hobbelig verloopt. Des te belangrijker is het voor ons om je vanaf het begin een goed gevoel te geven.",{"lang":1212,"date":1710,"categories":1711,"blogtitlepic":1712,"customExcerpt":1713},"2026-07-01",[1645],"Onboarding_Blogheader","Het contract is ondertekend, de eerste grote stap is gezet. Maar hoe gaat het nu verder? We nemen je mee achter de schermen van onze onboarding, van het PreBoarding tot de eerste week in het team.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1717,1718,1719],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1721,"title":1722,"author":1723,"cta":494,"description":1724,"hideInRecent":484,"layout":1210,"meta":1725,"moment":1726,"path":1730,"stem":1731,"tags":1732,"webcast":484},"content_nl/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wij horen erbij",[1429],"In het Microsoft-partnerecosysteem bestaat een hele reeks erkenningen, en toch onderscheidt de Frontier Partner Badge zich in opzet van de andere onderscheidingen. Je kunt hem niet aanvragen, want Microsoft kent hem op eigen initiatief toe aan een exclusieve groep partners die in meerdere disciplines tegelijk moeten overtuigen in plaats van in één enkele te schitteren. Microsoft toetst daarbij aangetoonde competentie in Cloud & AI Platforms, in AI Business Solutions en in Security in gelijke mate en richt zich daarmee op organisaties die AI niet zien als opzetstuk op bestaande IT, maar als resultaat van een doorlopende architectuur die van identiteit via endpoint tot in productieve AI-operations draagt.",{"lang":1212,"date":1726,"categories":1727,"blogtitlepic":1728,"customExcerpt":1729},"2026-06-26",[1645],"head-frontier-partner-badge.jpg","Sinds kort bestaat er binnen het Microsoft AI Cloud Partner Program een nieuwe toponderscheiding, de Frontier Partner Badge. Microsoft kent die uitsluitend toe aan een exclusieve groep partners wereldwijd die AI-projecten op de volledige Microsoft-stack draagkrachtig leveren, van de workplace via het cloudplatform en security tot in de AI-toepassing zelf, en die dat in de praktijk hebben aangetoond. In de DACH-regio telt die groep slechts een handvol bedrijven, en wij zijn er een van.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1651,1733,1678],"Microsoft Partner",{"id":1735,"title":1736,"author":1737,"cta":494,"description":1738,"hideInRecent":484,"layout":1210,"meta":1739,"moment":1740,"path":1744,"stem":1745,"tags":1746,"webcast":484},"content_nl/posts/2026-06-09-vair-run.md","160 kilometer voor het goede doel",[1527],"Zondagochtend, 8:30 uur, Holbeinsteg aan de Main. Elf collega's in dezelfde NinjaCat-shirts, klaar voor de Frankfurter Runden. Regen, bliksem en donder inbegrepen. Voor een goed doel lopen was motivatie genoeg om ondanks het slechte weer de hardloopschoenen aan te trekken.",{"lang":1212,"date":1740,"categories":1741,"blogtitlepic":1742,"customExcerpt":1743},"2026-06-08",[1645],"frankfurter-runden.png","Elf collega's, 16 rondes, 160 kilometer, een onweersfront en een podiumplek: glueckkanja deed mee aan de Frankfurter Runden 2026 en doneerde voor elke gelopen ronde aan VAIR e.V., die in Offenbach een inclusief sport- en cultuurpark bouwt.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1747,1717,1748],"Top Arbeitgeber","Soziales Engagement",{"id":1750,"title":1751,"author":1752,"cta":494,"description":1753,"hideInRecent":484,"layout":1210,"meta":1754,"moment":1755,"path":1759,"stem":1760,"tags":1761,"webcast":484},"content_nl/posts/2026-04-10-incident-to-intelligence.md","Anatomie van een onbekende AMOS Stealer: van alert naar immuniteit in enkele uren",[1508],"Wanneer in ons SOC een alert afgaat, begint de klok te lopen: niet alleen voor de getroffen klant, maar voor alle organisaties onder onze bescherming. Het gevaarlijkste moment in het huidige dreigingslandschap is de intelligence gap, het tijdvenster tussen de eerste inzet van een nieuwe malwarevariant en de dag waarop de branche daarvan hoort.",{"lang":1212,"date":1755,"categories":1756,"blogtitlepic":1757,"customExcerpt":1758},"2026-04-10",[235],"head-amos-stealer.png","Een tot dan toe ongedocumenteerde AMOS-stealervariant compromitteerde een macOS-endpoint. Geen bekende hashes, geen C2-gegevens in openbare databases. Ons SOC haalde zes obfuscatielagen uit elkaar, extraheerde alle indicatoren en verdeelde de bescherming binnen enkele uren over alle SOC-klanten, nog voordat de branche het sample had gezien.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1762,1763,1764,1765,1766],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1768,"title":1769,"author":1770,"cta":494,"description":1771,"hideInRecent":484,"layout":1210,"meta":1772,"moment":1773,"path":1776,"stem":1777,"tags":494,"webcast":484},"content_nl/posts/2026-03-21-microsoft-edge-corporate-browser.md","Waarom Edge jullie enige corporate browser zou moeten zijn",[1300],"De keuze van de browser is in bedrijfsomgevingen een strategische beslissing: die bepaalt direct hoeveel security en hoeveel beheerlast je werkelijk hebt. Google Chrome was lang de voor de hand liggende optie, maar Microsoft Edge is uitgegroeid tot een browser die direct ingrijpt op de bestaande stack, vooral wanneer Microsoft 365 in gebruik is en het beheer via Intune loopt.",{"lang":1212,"date":1773,"blogtitlepic":1774,"customExcerpt":1775},"2026-03-21","head-microsoft-edge-default-browser.jpg","Geen enkele organisatie heeft Chrome echt gekozen; hij was er simpelweg, met eigen sync-logica, eigen accountbeheer en een eigen interface voor policies. Microsoft Edge grijpt daarentegen direct in op de infrastructuur die toch al draait: Entra ID, Intune, Defender. Deze post laat zien hoe de overstap eruitziet, hoe Chrome via een Intune-policy naar een landingpage wordt omgeleid en wat er wegvalt zodra je stopt met het parallel beheren van twee browsers.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1779,"title":1780,"author":1781,"cta":494,"description":1782,"hideInRecent":484,"layout":1210,"meta":1783,"moment":1784,"path":1788,"stem":1789,"tags":1790,"webcast":484},"content_nl/posts/2026-03-20-stryker-attack-intune-privilege.md","Eén adminaccount was alles wat er nodig was.",[1403],"Woensdag 11 maart 2026. Medewerkers in Stryker-kantoren in 79 landen zetten hun computers aan en vonden ze leeg. Inlogschermen vervangen door een logo. Bedrijfslaptops, zakelijke telefoons, privéapparaten die in het BYOD-programma van het bedrijf waren geregistreerd, allemaal gelijktijdig gewist, in één nacht. Geen ransomware, geen malwaresignaturen, niets wat een endpoint-detectietool had kunnen opmerken.",{"lang":1212,"date":1784,"categories":1785,"blogtitlepic":1786,"customExcerpt":1787},"2026-03-20",[235],"head-stryker.jpg","Op 11 maart 2026 wiste Handala apparaten in 79 landen, en alles wat daarvoor nodig was, was één gecompromitteerd Intune-adminaccount. Geen malware, geen exploit, alleen legitieme managementtools die tegen hun eigenaars werden gericht. Wat er is gebeurd, waarom het werkte en welke twee architectonische gaten gedicht moeten worden.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1634,1635],{"id":1792,"title":1793,"author":1794,"cta":494,"description":1795,"hideInRecent":484,"layout":1210,"meta":1796,"moment":1797,"path":1801,"stem":1802,"tags":1803,"webcast":484},"content_nl/posts/2026-03-16-ai-agent-hackathon.md","Zes agents. Vier weken. Echt in productie.",[1429],"Hoeveel uur per week besteedt jullie IT-afdeling aan taken die een agent in minuten afhandelt?",{"lang":1212,"date":1797,"categories":1798,"blogtitlepic":1799,"customExcerpt":1800},"2026-03-16",[1645],"head-ai-agent-hackathon.jpg","Zes bedrijven, vier weken build-fase, zes werkende AI agents: dat was de eerste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa en lila logistik hebben in Copilot Studio agents gebouwd die vandaag productief lopen. Wat daarbij ontstond en hoe het format werkt.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1678,1804,1805,1806],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1808,"Fritz Zurhorst":1809,"Nadine Klein":1810,"Jan Geisbauer":1811,"Carolin Kanja":1815,"Anna Ulbricht":1816,"Annette Brauns":1817,"Pascal Asch":1818,"Steffen Schwerdtfeger":1819},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1812},[1813,1814],{"text":472,"href":1409},{"text":1411,"href":1412},{"display_name":1429,"avatar":1430,"permalink":1431,"twitter":1432,"linkedin":1433},{"display_name":1520,"avatar":1521,"permalink":1522,"linkedin":1523,"imageOffsetTop":1524,"imageOffsetLeft":1525},{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1531,"imageOffsetLeft":1274},{"display_name":1508,"avatar":1509,"permalink":1510,"linkedin":1511,"imageOffsetTop":1346},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"id":1238,"extension":1239,"meta":1821,"stem":8,"__hash__":1589},{"Thorsten Kunzi":1822},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},1791383943209]