[{"data":1,"prerenderedAt":1777},["ShallowReactive",2],{"sc:header-data-no":3,"sc:footer-data-no":489,"author-no-thorsten-kunzi-1f055f71c9741a":519,"content-no-thorsten-kunzi":549,"content-events-no-thorsten-kunzi":1765,"authors_data:Thorsten Kunzi|​Thorsten Kunzi​":1766},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"no":13},{"title":14,"url":15,"alt":16},"Hjem","/no","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"no":21},{"title":22,"description":23},"Workplace","Microsoft 365-drevet for smarte, sikre og fleksible arbeidsplasser som samler moderne teknologi og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"no":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"no":34},{"title":35,"url":36},"Managed Intune","/no/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"no":40},{"title":41,"url":42},"Managed Entra","/no/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"no":46},{"title":47,"url":48},"Managed Workplace","/no/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"no":52},{"title":53,"url":54},"Consulting Services","/no/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"no":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"no":64},{"title":65,"url":66},"Microsoft Entra Suite","/no/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"no":70},{"title":71,"url":72},"Microsoft Intune","/no/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"no":76},{"title":77,"url":78},"Microsoft Windows","/no/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"no":82},{"title":83,"url":84},"Windows 365 Cloud PC","/no/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"no":88},{"title":89,"url":90},"Cloud Workplace Foundation","/no/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"no":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"no":100},{"title":101,"url":102},"Microsoft 365 Copilot","/no/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"no":106},{"title":107,"url":108},"Teams","/no/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"no":112},{"title":113,"url":114},"SharePoint & Power Platform","/no/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"no":118},{"title":119,"url":120},"Exchange Online","/no/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"no":124},{"title":125,"url":126},"Information Protection & Compliance","/no/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"no":130},{"title":131,"description":132},"Azure","Driv vekst med Azure: kutt cloud-kostnader, øk effektiviteten og skap innovasjon gjennom IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"no":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"no":142},{"title":143,"url":144},"Azure Managed Services","/no/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"no":148},{"title":149,"url":150},"Azure Consulting","/no/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"no":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"no":160},{"title":161,"url":162},"Planlegg cloud-en din","/no/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"no":166},{"title":167,"url":168},"Migrer til cloud","/no/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"no":172},{"title":173,"url":174},"Forny virksomheten din","/no/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"no":178},{"title":179,"url":180},"Tenk nytt om VMware-strategien din","/no/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"no":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"no":190},{"title":191,"url":192},"Azure Foundation","/no/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"no":196},{"title":197,"url":198},"Azure AI Foundation","/no/azure/azure-ai-foundation",{"name":86,"languages":200},{"no":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"no":205},{"title":206,"url":207},"Azure Data Foundation","/no/azure/azure-data-foundation",{"name":188,"languages":209},{"no":210},{"title":211,"url":212},"Azure Container Foundation","/no/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"no":216},{"title":217,"url":218},"Managed Dark Tenant","/no/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"no":222},{"title":223,"url":224},"Cloud Adoption Framework","/no/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"no":228},{"title":229,"url":230},"Cloud Competence Center","/no/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"no":234},{"title":235,"description":236,"emergency":237},"Security","Årvåkenhet i cloud med en prisbelønt 24/7 managed service, incident response og moderne beskyttelse av infrastrukturen din.",{"text":238,"href":239,"skin":240,"icon":241},"Under angrep?","/no/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"no":249},{"title":250,"url":251},"Managed Red Tenant","/no/security/managed-red-tenant",{"name":214,"languages":253},{"no":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"no":259},{"title":260,"url":261},"Sentinel Data Lake","/no/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"no":265},{"title":266,"url":267},"Security Consulting","/no/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"no":274},{"title":275,"url":276},"Cloud Security Operations Center","/no/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"no":280},{"title":281,"url":282},"Global Secure Access","/no/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"no":286},{"title":287,"url":288},"MyWorkID","/no/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"no":295},{"title":296,"url":297},"Preventive Services","/no/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"no":301},{"title":302,"url":303},"Data Security Service","/no/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"no":307},{"title":308,"url":309},"Security Copilot Agents","/no/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"no":313},{"title":314,"url":315},"Innføre NIS2","/no/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"no":319},{"title":320,"description":321},"Produkter","Innovative tilleggsprodukter for et fullstendig sikkert, 100 % cloud-native Microsoft-miljø som styrker samarbeid, nettverksautentisering og programvarehåndtering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"no":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloud-basert programvaredistribusjon",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"no":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Sertifikatdistribusjon fra cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"no":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Jobb med dine lokale office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"no":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrer dataene dine fra én server til en annen",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"no":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"no":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering for nettverket ditt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"no":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finn kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"no":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvåking i sanntid",{"name":396,"languages":397},"casestudies",{"no":398},{"title":399,"url":400,"description":401},"Case Studies","/no/casestudies","Pioner i cloud: din fremste Microsoft-partner for omfattende cloud-løsninger med en Blueprint-basert tilnærming og Infrastructure-as-Code-kompetanse.",{"name":403,"languages":404,"children":407},"company",{"no":405},{"title":406,"description":401},"Selskap",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"no":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"no":417},{"title":418,"url":419},"Fakta og tall","/no/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"no":423},{"title":424,"url":425},"Kontakt og lokasjoner","/no/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"no":429},{"title":430,"url":431},"glueckkanja Sveits","/no/company/switzerland",{"name":433,"languages":434},"austria",{"no":435},{"title":436,"url":437},"glueckkanja Østerrike","/no/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"no":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"no":447},{"title":448,"url":449},"Karriereoversikt","/no/career",{"name":451,"languages":452},"company-young-professionals",{"no":453},{"title":454,"url":455},"Young Professionals","/no/young-professionals",{"name":457,"languages":458},"company-jobs",{"no":459},{"title":460,"url":461},"Ledige stillinger","/no/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"no":465},{"title":466},"Siste nytt",[468,474],{"name":469,"languages":470},"company-blog",{"no":471},{"title":472,"url":473},"Blogg","/no/blog",{"name":469,"languages":475},{"no":476},{"title":477,"url":478},"Arrangementer","/no/events",[480],{"name":481,"languages":482},"career-meta",{"no":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"no":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNo":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Personvern","/no/privacy",{"title":514,"url":515},"Juridisk informasjon","/no/imprint",{"title":517,"url":518},"Ingen cookies","/no/cookies",{"id":520,"title":521,"body":522,"description":528,"extension":533,"meta":534,"name":521,"navigation":325,"otherLanguages":535,"path":545,"seo":546,"stem":547,"__hash__":548},"authors/thorsten-kunzi.md","Thorsten Kunzi",{"type":523,"value":524,"toc":529},"minimal",[525],[526,527,528],"p",{},"Als Consultant in den Bereichen Exchange Online, Identity und Modern Workplace unterstützt Thorsten Kunzi seit vielen Jahren Kunden bei der Planung und Umsetzung von Cloud-Projekten. Aufgrund seiner Erfahrung im Bereich der On-Premises Active Directory Security ist er auch im Hardening aktiv und hilft als Teil der APT Response Taskforce bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":530,"searchDepth":531,"depth":531,"links":532},"",2,[],"md",{},{"en":536,"es":537,"sv":538,"fi":539,"da":540,"ko":541,"nl":542,"no":543,"ja":544},"As a consultant in the areas of Exchange Online, Identity and Modern Workplace, Thorsten Kunzi has been supporting customers in the planning and implementation of cloud projects for many years. Due to his experience in the area of on-premises Active Directory Security, he is also active in hardening and helps as part of the APT Response Taskforce with compromised or encrypted customer environments.","Como Consultant en las áreas de Exchange Online, Identity y Modern Workplace, Thorsten Kunzi lleva muchos años apoyando a los clientes en la planificación y ejecución de proyectos en la nube. Gracias a su experiencia en el ámbito de la seguridad de Active Directory on-premises, también trabaja en el hardening y ayuda, como parte de la APT Response Taskforce, en entornos de clientes comprometidos o cifrados.","Som Consultant inom områdena Exchange Online, Identity och Modern Workplace har Thorsten Kunzi i många år stöttat kunder i planeringen och genomförandet av molnprojekt. Tack vare sin erfarenhet inom on-premises Active Directory-säkerhet arbetar han även med hardening och hjälper som en del av APT Response Taskforce till i komprometterade eller krypterade kundmiljöer.","Consultantina Exchange Onlinen, Identityn ja Modern Workplacen alueilla Thorsten Kunzi on jo useiden vuosien ajan tukenut asiakkaita pilviprojektien suunnittelussa ja toteutuksessa. On-premises Active Directory -tietoturvan kokemuksensa ansiosta hän työskentelee myös hardeningin parissa ja auttaa osana APT Response Taskforce -tiimiä vaarantuneissa tai salatuissa asiakasympäristöissä.","Som Consultant inden for områderne Exchange Online, Identity og Modern Workplace har Thorsten Kunzi gennem mange år hjulpet kunder med planlægning og gennemførelse af cloud-projekter. På grund af sin erfaring inden for on-premises Active Directory-sikkerhed arbejder han også med hardening og hjælper som en del af APT Response Taskforce ved kompromitterede eller krypterede kundemiljøer.","Exchange Online, Identity, Modern Workplace 분야의 Consultant로서 Thorsten Kunzi는 오랜 기간 동안 고객의 클라우드 프로젝트 계획과 구현을 지원해 왔습니다. 온프레미스 Active Directory 보안 분야의 경험을 바탕으로 하드닝 작업에도 참여하고 있으며, APT Response Taskforce의 일원으로서 침해되거나 암호화된 고객 환경을 지원합니다.","Als Consultant voor Exchange Online, Identity en Modern Workplace ondersteunt Thorsten Kunzi klanten al vele jaren bij de planning en realisatie van cloudprojecten. Door zijn ervaring met On-Premises Active Directory Security is hij ook actief in hardening en helpt hij als onderdeel van de APT Response Taskforce bij gecompromitteerde of versleutelde klantomgevingen.","Som Consultant innen Exchange Online, Identity og Modern Workplace har Thorsten Kunzi i mange år bistått kunder med planlegging og gjennomføring av cloud-prosjekter. På grunn av erfaringen sin innen on-premises Active Directory Security er han også aktiv i hardening og hjelper som del av APT Response Taskforce ved kompromitterte eller krypterte kundemiljøer.","Exchange Online、Identity、Modern Workplaceの領域を担当するコンサルタントとして、Thorsten Kunziは長年にわたりクラウドプロジェクトの計画と実装でお客様を支援しています。オンプレミスのActive Directory Securityでの経験を活かしてHardeningにも携わり、APT Response Taskforceの一員として、侵害されたり暗号化されたりしたお客様環境に対応しています。","/thorsten-kunzi",{"title":521,"description":528},"thorsten-kunzi","YaiG705aTbfkaYxak0GKTbfT-5vntVpIpV6yaXJnw7I",[550,1133],{"id":551,"title":552,"author":553,"body":555,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":325,"layout":1106,"meta":1107,"moment":1111,"navigation":325,"path":1129,"seo":1130,"stem":1131,"tags":494,"webcast":484,"__hash__":1132},"content_no/posts/2026-01-27-exchange-active-directory.md","Exchange AD Split Permissions uten anger",[554],"​Thorsten Kunzi​",{"type":523,"value":556,"toc":1088},[557,562,565,572,576,603,606,610,616,631,637,640,644,680,699,704,710,719,723,739,743,750,754,764,769,774,793,797,823,827,847,855,871,885,945,949,973,990,1002,1015,1022,1026,1036,1047,1059,1063,1066,1069,1084],[558,559,561],"h3",{"id":560},"tldr-hva-om-vi-fjerner-ulempene","TLDR: hva om vi fjerner ulempene?",[526,563,564],{},"Jeg fant en måte å gi tilbake AD- og RBAC-rettighetene der Exchange-brukere, grupper, kontakter og lignende objekter ligger. Slik trengs det ingen tilpasning fra administratorer eller identitetsstyringssystemer, som etter min erfaring har vært det som stoppet de fleste selskapene fra å innføre modellen. Og vi beholder likevel sikkerhetsgevinsten mot lateral bevegelse og domenekompromittering.",[526,566,567],{},[568,569],"img",{"alt":570,"src":571},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[558,573,575],{"id":574},"det-oppnås-i-tre-trinn","Det oppnås i tre trinn:",[577,578,579,593,598],"ol",{},[580,581,582,583,590],"li",{},"Innfør ",[584,585,589],"a",{"href":586,"rel":587},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions",[588],"nofollow","AD split permission-modellen",[591,592],"br",{},[580,594,595,596],{},"Gi Exchange-serverne tilbake de tapte AD-rettighetene, men bare på de relevante OU-ene",[591,597],{},[580,599,600,601],{},"Tildel Exchange RBAC for å aktivere de manglende PowerShell-cmdletene på nytt",[591,602],{},[526,604,605],{},"Alt via Microsofts anvisninger, AD ACL-er eller Exchange RBAC-tildelinger.",[558,607,609],{"id":608},"hvorfor-bryr-vi-oss-nå","Hvorfor bryr vi oss (nå)?",[526,611,612,613,615],{},"Modellen har i stor grad blitt oversett eller ignorert siden den ble introdusert med Exchange 2010 SP1. Men standardmodellen med delte rettigheter utgjør en stor sikkerhetsrisiko for overtakelse av Active Directory. Kombinert med at Exchange de siste årene har vært beryktet for eksterne exploits, er det på tide å handle.",[591,614],{},"\nProblemet stammer fra rettigheter som er gitt på domenets rot og som arves gjennom hele domenet.",[617,618,619,622,625,628],"ul",{},[580,620,621],{},"endre rettigheter på brukere og grupper (i praksis full tilgang)",[580,623,624],{},"endre gruppemedlemmer",[580,626,627],{},"tilbakestille passord på brukere",[580,629,630],{},"opprette/slette brukere og grupper",[526,632,633],{},[568,634],{"alt":635,"src":636},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[526,638,639],{},"Bare enkelte høyprivilegerte Tier0-brukere og -grupper beskyttes av AdminSDHolder-prosessen (attributtet admincount=1), og i mange miljøer finnes det ubeskyttede brukere eller grupper som kan gjøre det mulig å kompromittere domenet og/eller skogen, eller i det minste forårsake alvorlig skade.",[558,641,643],{"id":642},"fremtredende-eksempler","Fremtredende eksempler:",[617,645,646,649,669],{},[580,647,648],{},"Entra Connect Sync-kontoen når PWHashSync brukes",[580,650,651,652],{},"Standardgrupper\n",[617,653,654,657,666],{},[580,655,656],{},"Allowed RODC Password Replication Group sammen med EntraConnect-kontoen (hvis det finnes en reell Windows RODC)",[580,658,659,660,665],{},"Se også ",[584,661,664],{"href":662,"rel":663},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[588],"Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," som viser flere veier (Account Operators-gruppen er en tilsvarende trussel)",[580,667,668],{},"Å tømme Protected Users for å skape angrepsvektorer ved å fjerne beskyttelsen",[580,670,671,672],{},"Ubeskyttede egendefinerte grupper eller admin-/tjenestekontoer\n",[617,673,674,677],{},[580,675,676],{},"Skriverettigheter på GPO-er (som gjelder for domenekontroller)",[580,678,679],{},"Håndtering av tilgang til AD-backuper, backup-server, PKI-maler, hypervisor, ...",[526,681,682,683,685,686,691,693,694],{},"Det er svært vanskelig å demme opp for alle disse eksisterende og framtidige potensielle angrepsveiene i etterkant. For den egendefinerte OU-en _ADM kan du deaktivere ACL-arv, men de fleste standardobjekter kan ikke flyttes ut av den innebygde Builtin-OU-en eller Users-kontaineren, og forblir sårbare.",[591,684],{},"\nDet er mye bedre å fjerne de kraftfulle rettighetene fra roten, og det gjøres ved å innføre Active Directory split permissions-modellen. ",[584,687,690],{"href":688,"rel":689},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[588],"Configure Exchange Server for split permissions | Microsoft Learn",[591,692],{},"\nOg Microsoft er enig: «...encouraged to implement Active Directory split permissions» ",[584,695,698],{"href":696,"rel":697},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[588],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[700,701,703],"h2",{"id":702},"men-hvorfor-er-det-ingen-som-gjør-det","Men hvorfor er det ingen som gjør det?",[526,705,706,707,709],{},"Siden split permissions ikke var tilgjengelig før Exchange 2010 SP1, hadde alle da allerede akseptert standardoppsettet, og det virker som at sikkerhetsteamene ikke klarte å presse gjennom endringen etter at muligheten kom.",[591,708],{},"\nModellen ville også ha tvunget fram endringer i admin- og IDM-prosesser, som å opprette brukere eller distribusjonslister i AD først og deretter bruke Exchange for å «mail enable» dem.",[526,711,712,713,715],{},"Cmdlet-er som ikke lenger er tilgjengelige eller virker:",[591,714],{},[716,717,718],"code",{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[558,720,722],{"id":721},"eksempler-på-tilpasning","Eksempler på tilpasning:",[617,724,725,736],{},[580,726,727,728],{},"New-Mailbox (der Exchange skriver til AD) blir:\n",[617,729,730,733],{},[580,731,732],{},"New-ADUser (der adm.jdoe skriver til AD)",[580,734,735],{},"Enable-Mailbox",[580,737,738],{},"Add-ADPermission for SendAs-rettigheter må gjøres via AD Users and Computers i sikkerhetsfanen, og krever ofte ekstra AD-rettigheter for vanlige administratorer.",[700,740,742],{"id":741},"vis-meg-dette-alternativet-uten-anger","Vis meg dette alternativet uten anger",[526,744,745,749],{},[746,747,748],"strong",{},"Ansvarsfraskrivelse",": Les og forstå følgende lenker og artikler i sin helhet, kjør først i et testmiljø, sørg for at AD-backupene er oppdaterte og at gjenopprettingsrutinene er på plass.",[558,751,753],{"id":752},"kartlegg-dagens-bruk","Kartlegg dagens bruk",[526,755,756,759,761],{},[746,757,758],{},"Sjekk først hvilke av de berørte cmdlet-ene som brukes på hvilke OU-er.",[591,760],{},[716,762,763],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[526,765,766],{},[716,767,768],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[526,770,771],{},[716,772,773],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[526,775,776,779,781,784,787,790],{},[746,777,778],{},"Rask analyse av kaller og cmdlet-er:",[591,780],{},[716,782,783],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[716,785,786],{},"$CSVs|group Caller",[716,788,789],{},"$CSVs|group CmdletName",[716,791,792],{},"Analyser CSV-en for å se hvor AD-rettigheter vil være nødvendig. Vurder å optimalisere ved å flytte alle Exchange-relevante grupper til dedikerte OU-er.",[558,794,796],{"id":795},"aktiver-split-permissions-modellen","Aktiver split permissions-modellen",[526,798,799,806,808,809,811,814,816,819,820],{},[746,800,801,802,805],{},"Følg instruksjonene under «Switch to Active Directory split permissions» i ",[584,803,690],{"href":586,"rel":804},[588]," (IKKE RBAC split permissions)",[591,807],{},"\nI korte trekk fjerner det de farlige rettighetene til gruppen «Exchange Windows Permissions» og fjerner også Exchange som gruppemedlem.",[591,810],{},[716,812,813],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[591,815],{},[746,817,818],{},"For å reversere, bruk:"," ",[716,821,822],{},"/ActiveDirectorySplitPermissions:false",[558,824,826],{"id":825},"tildel-ad-rettigheter","Tildel AD-rettigheter",[526,828,829,832,834,835,837,840,842,844],{},[746,830,831],{},"Opprett en egendefinert AD-gruppe og legg Exchange-serverne som medlemmer.",[591,833],{},"\njuster OU-stien først",[591,836],{},[716,838,839],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[591,841],{},[591,843],{},[716,845,846],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[526,848,849,852,854],{},[746,850,851],{},"start Exchange-serverne på nytt for at rettighetene via gruppen skal fungere",[591,853],{},"\nJeg har laget et skript som gjør det enkelt å delegere AD-rettighetene per bruksområde.",[856,857,858],"blockquote",{},[526,859,860,866,867,870],{},[746,861,862],{},[863,864,865],"em",{},"INFO:"," Uten disse rettighetene vil Exchange-serveren få feilen ",[716,868,869],{},"«INSUFF_ACCESS_RIGHTS»"," fra AD.",[526,872,873,882,884],{},[746,874,875,876,881],{},"Last ned ",[584,877,880],{"href":878,"rel":879},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[588],"Add-ExchangeADSplitPermissionOnOU.ps1"," fra glueckkanjas GitHub",[591,883],{},"\nDet kan tildele følgende PermissionTypes:",[617,886,887,900,920,933],{},[580,888,889,892],{},[746,890,891],{},"CreateUserAndContact",[617,893,894,897],{},[580,895,896],{},"Create/delete, ResetPassword og WriteAllProperties for Users og Contacts",[580,898,899],{},"Exchange-cmdlet-er: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact og tilsvarende Remove-*",[580,901,902,905],{},[746,903,904],{},"GroupManage",[617,906,907,910,913],{},[580,908,909],{},"Create/Delete Groups, Modify Member",[580,911,912],{},"Exchange-cmdlet-er: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[580,914,915,916],{},"Flere bruksområder: brukere som administrerer DistributionGroups de eier via https://",[917,918,919],"on-prem-exchange",{},"/EAC",[580,921,922,925],{},[746,923,924],{},"UserSendAs",[617,926,927,930],{},[580,928,929],{},"Endre AD-rettigheter på Users",[580,931,932],{},"Exchange-cmdlet: Add-ADPermission",[580,934,935,938],{},[746,936,937],{},"GroupSendAs",[617,939,940,943],{},[580,941,942],{},"Endre AD-rettigheter på Groups",[580,944,932],{},[558,946,948],{"id":947},"slik-bruker-du-skriptet","Slik bruker du skriptet:",[526,950,951],{},[716,952,953,819,956,819,962,819,965,819,970],{},[716,954,955],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[957,958,959],"b",{},[716,960,961],{},"\u003COU>",[716,963,964],{},"-PermissionType",[957,966,967],{},[716,968,969],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[716,971,972],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[526,974,975,976,978],{},"f.eks.",[591,977],{},[716,979,980,819,983,819,987],{},[716,981,982],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,984,985],{},[716,986,904],{},[716,988,989],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[526,991,992],{},[716,993,994,819,996,819,1000],{},[716,995,982],{},[957,997,998],{},[716,999,937],{},[716,1001,989],{},[526,1003,1004],{},[716,1005,1006,819,1009,819,1013],{},[716,1007,1008],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[957,1010,1011],{},[716,1012,924],{},[716,1014,989],{},[526,1016,1017],{},[716,1018,1019],{},[716,1020,1021],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[558,1023,1025],{"id":1024},"tildel-exchange-rbac","Tildel Exchange RBAC",[526,1027,1028,1031,1033],{},[746,1029,1030],{},"Aktiver parameteren -BypassSecurityGroupManagerCheck på nytt for cmdlet-ene Add-DistributionGroupMember og Remove-DistributionGroupMember:",[591,1032],{},[716,1034,1035],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[856,1037,1038],{},[526,1039,1040,819,1044,1046],{},[746,1041,1042],{},[863,1043,865],{},[591,1045],{},"Ellers får du «-BypassSecurityGroupManagerCheck parameter is not available» eller «You don't have sufficient permissions. This operation can only be performed by a manager of the group»",[526,1048,1049,1051,1054,1056],{},[591,1050],{},[746,1052,1053],{},"Aktiver cmdlet-ene New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... med de nødvendige parameterne på nytt:",[591,1055],{},[716,1057,1058],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1060,1062],{"id":1061},"oppsummering","Oppsummering",[526,1064,1065],{},"Jeg håper at flere med denne veiledningen tar dette viktige skrittet for å sikre sitt Active Directory mot kompromittering via Exchange. Jeg har ennå ikke støtt på problemer da jeg implementerte Exchange AD split permissions-modellen og tilpasningen fra denne artikkelen hos våre kunder.",[526,1067,1068],{},"Jeg håper Microsoft vil implementere en innebygd måte å oppnå denne granulære, OU-baserte tilnærmingen på, i stedet for dagens alt-eller-ingenting, slik at den kan bli tatt bredt i bruk.",[526,1070,1071,1072,1077,1078,1083],{},"Ettersom AD Tiering ligger meg tungt på hjertet: I tillegg bør du ikke logge på Exchange-servere med Domain Admin (eller andre Tier0-kontoer), men behandle dem som Tier1 fra nå av og innføre AD Tiering så snart som mulig.\nSom et første steg anbefaler jeg verktøy som ",[584,1073,1076],{"href":1074,"rel":1075},"https://www.pingcastle.com/",[588],"PingCastle"," eller ",[584,1079,1082],{"href":1080,"rel":1081},"https://www.semperis.com/purple-knight/",[588],"Purple Knight"," for å vurdere din AD Security og Control Paths.",[1085,1086,1087],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":530,"searchDepth":531,"depth":531,"links":1089},[1090,1092,1093,1094,1095,1098,1105],{"id":560,"depth":1091,"text":561},3,{"id":574,"depth":1091,"text":575},{"id":608,"depth":1091,"text":609},{"id":642,"depth":1091,"text":643},{"id":702,"depth":531,"text":703,"children":1096},[1097],{"id":721,"depth":1091,"text":722},{"id":741,"depth":531,"text":742,"children":1099},[1100,1101,1102,1103,1104],{"id":752,"depth":1091,"text":753},{"id":795,"depth":1091,"text":796},{"id":825,"depth":1091,"text":826},{"id":947,"depth":1091,"text":948},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},"post",{"lang":1108,"seoTitle":1109,"titleClass":1110,"date":1111,"blogtitlepic":1112,"socialimg":1113,"customExcerpt":1114,"keywords":1115,"scripts":1116,"asideNav":1117,"maxContent":325,"published":484},"no","Exchange AD Split Permissions: Sikre Active Directory med least privilege","h2-font-size","2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-premises Exchange Server-installasjoner er fortsatt utbredt selv i organisasjoner som har flyttet alle postbokser til skyen. De har fortsatt svært vide rettigheter i Active Directory, slik at det som regel finnes en tydelig angrepsvei som kan kompromittere hele AD og med det ofte store deler av bedriftens IT. Ved å bytte til den såkalte «AD Split Permissions»-modellen fjernes de kritiske rettighetene, og jeg har utviklet en løsning som fjerner ulempene som vanligvis har hindret adopsjon.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1118},[1119,1121,1123,1125,1127],{"href":1120,"text":561},"#tldr-hva-om-vi-fjerner-ulempene",{"href":1122,"text":609},"#hvorfor-bryr-vi-oss-nå",{"href":1124,"text":703},"#men-hvorfor-er-det-ingen-som-gjør-det",{"href":1126,"text":742},"#vis-meg-dette-alternativet-uten-anger",{"href":1128,"text":1062},"#oppsummering","/posts/2026-01-27-exchange-active-directory",{"title":552,"description":530},"posts/2026-01-27-exchange-active-directory","W7FkuxWF7ds3E4mnIGy41YoDUmdvevtsue94ElRTWVQ",{"id":1134,"title":552,"author":1135,"body":1136,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":484,"layout":1106,"meta":1746,"moment":1748,"navigation":325,"path":1761,"seo":1762,"stem":1763,"tags":494,"webcast":484,"__hash__":1764},"content_no/posts/2026-03-01-exchange-ad-split-permissions-hardening.md",[521],{"type":523,"value":1137,"toc":1733},[1138,1140,1143,1147,1152,1166,1169,1176,1181,1183,1191,1203,1207,1210,1214,1247,1266,1268,1276,1284,1289,1303,1305,1310,1312,1317,1377,1382,1419,1422,1424,1438,1445,1461,1470,1474,1477,1523,1526,1533,1539,1542,1555,1570,1582,1593,1597,1655,1657,1662,1682,1689,1713,1715,1718,1721,1731],[700,1139,561],{"id":560},[526,1141,1142],{},"Jeg har funnet en måte å gi AD- og RBAC-tillatelser tilbake direkte der Exchange-brukere, grupper og kontakter befinner seg, uten at det krever endringer for administratorer eller identitetsstyringssystemer. Etter min erfaring har akkurat den friksjonen vært den viktigste sperren for de fleste bedrifter. Og vi beholder likevel sikkerhetsgevinsten mot lateral movement og domenekompromittering.",[526,1144,1145],{},[568,1146],{"alt":570,"src":571},[526,1148,1149],{},[746,1150,1151],{},"Det gjøres i tre steg:",[577,1153,1155,1160,1163],{"style":1154},"margin: 0.25rem 0",[580,1156,1157,1158],{},"Implementer ",[584,1159,589],{"href":586},[580,1161,1162],{},"Gi Exchange-serverne de tapte AD-tillatelsene tilbake, men kun på de relevante OU-ene",[580,1164,1165],{},"Gi Exchange RBAC for å reaktivere manglende PowerShell-cmdlets",[526,1167,1168],{},"Alt via Microsofts anvisninger, AD-ACL-er eller Exchange RBAC-tildelinger.",[1170,1171],"video-frame",{"thumb":1172,"alt":1173,"id":1174,":full-width":1175},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[1177,1178,1180],"div",{"style":1179},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions uten anger. En steg-for-steg innføringsguide",[700,1182,609],{"id":608},[526,1184,1185,1186,1188,1190],{},"Temaet har i stor grad blitt oversett eller ignorert siden det ble introdusert med Exchange 2010 SP1. Men standardmodellen med delte tillatelser utgjør en betydelig sikkerhetsrisiko for overtakelse av Active Directory. Kombinert med at Exchange de siste årene har vært beryktet for eksterne exploits, er det på tide å handle.",[591,1187],{},[591,1189],{},"\nProblemet stammer fra privilegier som er tildelt på roten av et domene og som arves gjennom hele domenet.",[617,1192,1193,1196,1198,1200],{"style":1154},[580,1194,1195],{},"endre tillatelser på brukere og grupper (i praksis full tilgang)",[580,1197,624],{},[580,1199,627],{},[580,1201,1202],{},"opprette og slette brukere og grupper",[526,1204,1205],{},[568,1206],{"alt":635,"src":636},[526,1208,1209],{},"Kun visse høyt privilegerte Tier 0-brukere og -grupper er beskyttet av AdminSDHolder-prosessen (attributtet admincount=1), og i mange miljøer finnes det ubeskyttede brukere eller grupper som kan gjøre det mulig å kompromittere domenet eller skogen, eller i det minste forårsake alvorlig skade.",[526,1211,1212],{},[746,1213,643],{},[617,1215,1216,1219,1237],{"style":1154},[580,1217,1218],{},"Entra Connect Sync-konto ved bruk av Password Hash Sync",[580,1220,1221,1222],{},"Standardgrupper",[617,1223,1225,1228,1234],{"style":1224},"margin: 0",[580,1226,1227],{},"Allowed RODC Password Replication Group sammen med Entra Connect-konto (dersom en reell Windows RODC finnes)",[580,1229,659,1230,1233],{},[584,1231,664],{"href":1232,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta"," som viser flere angrepsveier (Account Operators-gruppen utgjør en tilsvarende trussel)",[580,1235,1236],{},"Tømming av Protected Users for å åpne angrepsvektorer ved å fjerne beskyttelser",[580,1238,1239,1240],{},"Ubeskyttede egendefinerte grupper eller admin- og tjenestekontoer",[617,1241,1242,1245],{"style":1224},[580,1243,1244],{},"Skrivetilgang på GPO-er (som gjelder domenekontrollere)",[580,1246,679],{},[526,1248,1249,1250,1252,1254,1255,1258,1260,1262,1263],{},"Det er svært vanskelig i ettertid å demme opp for alle disse eksisterende og fremtidige potensielle angrepsveiene. For den egendefinerte OU-en _ADM kan du deaktivere ACL-arv, men de fleste standardobjekter kan ikke flyttes fra standard Builtin-OU eller Users-container og forblir sårbare.",[591,1251],{},[591,1253],{},"\nDet er mye bedre å fjerne de kraftige tillatelsene fra roten, noe som gjøres ved å innføre Active Directory split permissions-modellen. ",[584,1256,690],{"href":688,"rel":1257},[588],[591,1259],{},[591,1261],{},"\nOg Microsoft er enig: «…encouraged to implement Active Directory split permissions» ",[584,1264,698],{"href":696,"rel":1265},[588],[700,1267,703],{"id":702},[526,1269,1270,1271,1273,1275],{},"Siden split permissions ikke var tilgjengelig før Exchange 2010 SP1, hadde alle akseptert situasjonen på det tidspunktet, og det virker som om sikkerhetsteamene ikke klarte å presse gjennom modellen etter at den ble tilgjengelig.",[591,1272],{},[591,1274],{},"\nOg den ville ha tvunget frem endringer i admin- og IDM-prosesser, som å opprette brukere eller distribusjonslister i AD først, og først deretter bruke Exchange til å «mail enable» dem.",[856,1277,1278],{},[526,1279,1280,1283],{},[746,1281,1282],{},"Info:"," Følgende cmdlets vil ikke lenger være tilgjengelige eller virke: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[526,1285,1286],{},[746,1287,1288],{},"Eksempler på tilpasninger:",[617,1290,1291,1300],{"style":1154},[580,1292,1293,1294],{},"New-Mailbox (der Exchange skriver til AD) ville blitt:",[617,1295,1296,1298],{"style":1224},[580,1297,732],{},[580,1299,735],{},[580,1301,1302],{},"Add-ADPermission for SendAs-rettigheter måtte gjøres via AD Users and Computers i sikkerhetsfanen, og krever ofte ekstra AD-tillatelser for standardadministratorer.",[700,1304,742],{"id":741},[526,1306,1307,1309],{},[746,1308,748],{},": Les og forstå følgende lenker og artikler fullstendig, gjennomfør endringen i et testmiljø først, og forsikre deg om at AD-backuper er oppdatert og at gjenopprettingsrutiner er etablert.",[558,1311,753],{"id":752},[526,1313,1314],{},[746,1315,1316],{},"Du bør først sjekke hvilke av de berørte cmdletene som er i bruk på hvilke OU-er:",[1318,1319,1320,1328,1330,1336,1338],"code-block",{},[1321,1322,1323,1327],"span",{},[1321,1324,1326],{"style":1325},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,1329],{},[1321,1331,1332,1335],{},[1321,1333,1334],{"style":1325},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,1337],{},[1321,1339,1340,819,1343,1347,1348,819,1351,1353,1354,1357,1358,819,1361,819,1364,819,1366,1369,1370,1373,1374],{},[1321,1341,1342],{"style":1325},"Search-AdminAuditLog",[1321,1344,1346],{"style":1345},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1321,1349,1350],{"style":1345},"-Cmdlets",[1321,1352,1334],{"style":1325}," | ",[1321,1355,1356],{"style":1325},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1321,1359,1360],{"style":1325},"Export-Csv",[1321,1362,1363],{"style":1345},"-Path",[1321,1365,1326],{"style":1325},[1321,1367,1368],{"style":1345},"-Delimiter"," \";\" ",[1321,1371,1372],{"style":1345},"-Encoding"," Unicode ",[1321,1375,1376],{"style":1345},"-NoTypeInformation",[526,1378,1379],{},[746,1380,1381],{},"Rask analyse av caller og cmdlets:",[1318,1383,1384,1400,1402,1410,1412],{},[1321,1385,1386,1389,1390,819,1393,819,1395,819,1397,1399],{},[1321,1387,1388],{"style":1325},"$CSVs"," = ",[1321,1391,1392],{"style":1325},"Import-Csv",[1321,1394,1363],{"style":1345},[1321,1396,1326],{"style":1325},[1321,1398,1368],{"style":1345}," \";\"",[591,1401],{},[1321,1403,1404,1353,1406,1409],{},[1321,1405,1388],{"style":1325},[1321,1407,1408],{"style":1325},"Group-Object"," Caller",[591,1411],{},[1321,1413,1414,1353,1416,1418],{},[1321,1415,1388],{"style":1325},[1321,1417,1408],{"style":1325}," CmdletName",[526,1420,1421],{},"Analyser CSV-en for å avgjøre hvor AD-tillatelser vil være nødvendig. Optimaliser eventuelt ved å flytte alle Exchange-relevante grupper til dedikerte OU-er.",[700,1423,796],{"id":795},[526,1425,1426,1427,1430,1431,1435],{},"Følg Microsofts instruksjoner ",[746,1428,1429],{},"«Switch to Active Directory split permissions»"," i\n",[584,1432,690],{"href":1433,"rel":1434},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[588],[863,1436,1437],{},"(IKKE RBAC split permissions)",[526,1439,1440,1441,1444],{},"I praksis fjerner dette de farlige tillatelsene til gruppen ",[746,1442,1443],{},"«Exchange Windows Permissions»"," og fjerner også Exchange som gruppemedlem.",[1318,1446,1447],{},[1321,1448,1449,819,1452,819,1455,819,1458],{},[1321,1450,1451],{"style":1325},"Setup.exe",[1321,1453,1454],{"style":1345},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1321,1456,1457],{"style":1345},"/PrepareAD",[1321,1459,1460],{"style":1345},"/ActiveDirectorySplitPermissions:true",[1177,1462,1464,1465,1467,1468],{"style":1463},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[746,1466,1282],{}," For å reversere, bruk ganske enkelt ",[716,1469,822],{},[558,1471,1473],{"id":1472},"tildel-ad-tillatelser","Tildel AD-tillatelser",[526,1475,1476],{},"Opprett en egendefinert AD-gruppe og gjør Exchange-serverne til medlemmer.",[1318,1478,1479,1485,1487,819,1490,1493,1494,1497,1498,1501,1502,819,1504,819,1507,1510,1511,1513,1493,1516,1519,1520],{},[1321,1480,1481],{},[1321,1482,1484],{"style":1483},"color:var(--color-black-40)","# juster OU-sti først",[591,1486],{},[1321,1488,1489],{"style":1325},"New-ADGroup",[1321,1491,1492],{"style":1345},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1321,1495,1496],{"style":1345},"-GroupCategory"," Security ",[1321,1499,1500],{"style":1345},"-GroupScope"," DomainLocal ",[1321,1503,1363],{"style":1345},[746,1505,1506],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1321,1508,1509],{"style":1345},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,1512],{},[1321,1514,1515],{"style":1325},"Add-ADGroupMember",[1321,1517,1518],{"style":1345},"-Members"," \"Exchange Trusted Subsystem\"\n",[1321,1521,1522],{"style":1483},"# start Exchange-serverne på nytt for at tillatelser via gruppe skal virke",[526,1524,1525],{},"Jeg har laget et skript som gjør delegering av AD-tillatelser enkel per bruksscenario.",[856,1527,1528],{},[526,1529,1530,1531,870],{},"Uten disse tillatelsene ville Exchange-serveren fått feilen ",[716,1532,869],{},[526,1534,875,1535,1538],{},[584,1536,880],{"href":878,"rel":1537},[588]," fra glueckkanja GitHub",[526,1540,1541],{},"Skriptet kan tildele følgende PermissionTypes:",[526,1543,1545,1547,896,1549,1551],{"style":1544},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[746,1546,891],{},[591,1548],{},[591,1550],{},[1552,1553,1554],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` og tilsvarende `Remove-*`",[526,1556,1558,1560,909,1562,1564],{"style":1557},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[746,1559,904],{},[591,1561],{},[591,1563],{},[1552,1565,1566,1567,1569],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1568],{},"Også: brukere som administrerer DistributionGroups de eier via EAC",[526,1571,1572,1574,1576,1577,1579],{"style":1557},[746,1573,924],{},[591,1575],{},"Modify AD Permissions on Users",[591,1578],{},[1552,1580,1581],{},"Exchange-cmdlet: `Add-ADPermission`",[526,1583,1584,1586,1588,1589,1591],{"style":1557},[746,1585,937],{},[591,1587],{},"Modify AD Permissions on Groups",[591,1590],{},[1552,1592,1581],{},[526,1594,1595],{},[746,1596,948],{},[1318,1598,1599,819,1601,1604,1605,1607,1608,1611,1612,1615,1617,819,1619,1621,1622,1624,1625,1611,1627,819,1629,1621,1631,1633,1634,1611,1636,819,1638,1640,1641,1643,1644,1611,1646,819,1648,1640,1650,1652,1653,1611],{},[1321,1600,880],{"style":1325},[1321,1602,1603],{"style":1345},"-TargetOU"," \u003COU> ",[1321,1606,964],{"style":1345}," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1321,1609,1610],{"style":1345},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1321,1613,1614],{"style":1483},"# For eksempel",[591,1616],{},[1321,1618,880],{"style":1325},[1321,1620,1603],{"style":1345}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1321,1623,964],{"style":1345}," GroupManage ",[1321,1626,1610],{"style":1345},[1321,1628,880],{"style":1325},[1321,1630,1603],{"style":1345},[1321,1632,964],{"style":1345}," GroupSendAs ",[1321,1635,1610],{"style":1345},[1321,1637,880],{"style":1325},[1321,1639,1603],{"style":1345}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1321,1642,964],{"style":1345}," UserSendAs ",[1321,1645,1610],{"style":1345},[1321,1647,880],{"style":1325},[1321,1649,1603],{"style":1345},[1321,1651,964],{"style":1345}," CreateUserAndContact ",[1321,1654,1610],{"style":1345},[558,1656,1025],{"id":1024},[526,1658,1659],{},[746,1660,1661],{},"Reaktiver -BypassSecurityGroupManagerCheck-parameteren for Add-DistributionGroupMember- og Remove-DistributionGroupMember-cmdletene:",[1318,1663,1664],{},[1321,1665,1666,819,1669,1671,1672,1675,1676,1678,1679,1681],{},[1321,1667,1668],{"style":1325},"New-RoleGroup",[1321,1670,1492],{"style":1345}," \"SplitPermission Security Group Creation and Membership\" ",[1321,1673,1674],{"style":1345},"-Roles"," \"Security Group Creation and Membership\" ",[1321,1677,1518],{"style":1345}," \"Organization Management\",\"Recipient Management\" ",[1321,1680,1509],{"style":1345}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[856,1683,1684],{},[526,1685,1686,1688],{},[746,1687,1282],{}," Ellers får du «-BypassSecurityGroupManagerCheck parameter is not available» eller «You don't have sufficient permissions. This operation can only be performed by a manager of the group»",[526,1690,1691,1693,1696,1698],{},[591,1692],{},[746,1694,1695],{},"Reaktiver New-Mailbox, New-RemoteMailbox, New-MailContact og Remove-...-cmdlets med nødvendige parametere:",[591,1697],{},[1318,1699,1700,819,1702,1704,1705,1707,1708,1678,1710,1712],{},[1321,1701,1668],{"style":1325},[1321,1703,1492],{"style":1345}," \"SplitPermission Mail Recipient Creation\" ",[1321,1706,1674],{"style":1345}," \"Mail Recipient Creation\" ",[1321,1709,1518],{"style":1345},[1321,1711,1509],{"style":1345}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[700,1714,1062],{"id":1061},[526,1716,1717],{},"Jeg håper denne veiledningen bidrar til at flere virksomheter tar det viktige skrittet med å sikre sitt Active Directory mot kompromittering via Exchange. Etter min erfaring med å innføre Exchange AD Split Permissions-modellen hos flere kunder, har jeg ikke støtt på problemer, og innføringen har gått glatt.",[526,1719,1720],{},"Jeg håper også Microsoft innfører en OU-basert nativ tilnærming for å oppnå dette granularitetsnivået, i stedet for dagens alt-eller-ingenting-modell, noe som ville gjort utbredt adopsjon betydelig enklere.",[526,1722,1723,1724,1077,1727,1730],{},"En merknad om AD Tiering: unngå å logge på Exchange-servere med Domain Admin eller andre Tier 0-kontoer. Behandle Exchange-servere som Tier 1 og innfør AD Tiering så raskt som mulig. Som et første steg anbefaler jeg å bruke ",[584,1725,1076],{"href":1074,"rel":1726},[588],[584,1728,1082],{"href":1080,"rel":1729},[588]," for å vurdere AD-sikkerhetsstatusen din og identifisere eksponerte kontrollveier.",[1085,1732,1087],{},{"title":530,"searchDepth":531,"depth":531,"links":1734},[1735,1736,1737,1738,1741,1745],{"id":560,"depth":531,"text":561},{"id":608,"depth":531,"text":609},{"id":702,"depth":531,"text":703},{"id":741,"depth":531,"text":742,"children":1739},[1740],{"id":752,"depth":1091,"text":753},{"id":795,"depth":531,"text":796,"children":1742},[1743,1744],{"id":1472,"depth":1091,"text":1473},{"id":1024,"depth":1091,"text":1025},{"id":1061,"depth":531,"text":1062},{"lang":1108,"seoTitle":1747,"titleClass":1110,"date":1748,"blogtitlepic":1749,"socialimg":1750,"customExcerpt":1751,"keywords":1752,"scripts":1753,"asideNav":1754,"maxContent":325,"published":325},"Exchange AD Split Permissions: sikre Active Directory med minste privilegium","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Selv virksomheter som har migrert postboksene fullt ut til skyen, kjører fortsatt ofte lokale Exchange-servere, og med dem en undervurdert sikkerhetsrisiko for Active Directory. Modellen «AD Split Permissions» fratar Exchange de brede AD-privilegiene som angripere kan utnytte til å ta over hele domenet. Frem til nå har innføringen i stor grad strandet på de prosessendringene den påfører administratorene. Denne artikkelen viser hvordan du elegant kan komme forbi nettopp den hindringen: et skript som selektivt gir de tapte AD-tillatelsene tilbake, kun på de relevante OU-ene, slik at den kjente admin-arbeidsflyten bevares samtidig som du oppnår hele sikkerhetsgevinsten.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell | NO",{"slick":325,"form":325},{"menuItems":1755},[1756,1757,1758,1759,1760],{"href":1120,"text":561},{"href":1122,"text":609},{"href":1124,"text":703},{"href":1126,"text":742},{"href":1128,"text":1062},"/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":552,"description":530},"posts/2026-03-01-exchange-ad-split-permissions-hardening","AM0_ia6nUgqLNtL9ino0IsL_rznqHUMqvieu2Hq_vSo",[],{"id":1767,"extension":1768,"meta":1769,"stem":8,"__hash__":1776},"authors_data/authors.json","json",{"Thorsten Kunzi":1770},{"display_name":521,"avatar":1771,"permalink":1772,"twitter":1773,"linkedin":1774,"imageOffsetTop":1775},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi","glueckkanjagab","company/glueckkanja-gab","72%","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383994266]