[{"data":1,"prerenderedAt":1825},["ShallowReactive",2],{"sc:header-data-no":3,"sc:footer-data-no":489,"post-no--posts-2026-03-01-exchange-ad-split-permissions-hardening-d948cda78b15d":519,"authors_data":1237,"content-no-list-7b291c2dd91a4":1591,"authors_data:Thorsten Kunzi":1822},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"no":13},{"title":14,"url":15,"alt":16},"Hjem","/no","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"no":21},{"title":22,"description":23},"Workplace","Microsoft 365-drevet for smarte, sikre og fleksible arbeidsplasser som samler moderne teknologi og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"no":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"no":34},{"title":35,"url":36},"Managed Intune","/no/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"no":40},{"title":41,"url":42},"Managed Entra","/no/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"no":46},{"title":47,"url":48},"Managed Workplace","/no/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"no":52},{"title":53,"url":54},"Consulting Services","/no/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"no":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"no":64},{"title":65,"url":66},"Microsoft Entra Suite","/no/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"no":70},{"title":71,"url":72},"Microsoft Intune","/no/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"no":76},{"title":77,"url":78},"Microsoft Windows","/no/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"no":82},{"title":83,"url":84},"Windows 365 Cloud PC","/no/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"no":88},{"title":89,"url":90},"Cloud Workplace Foundation","/no/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"no":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"no":100},{"title":101,"url":102},"Microsoft 365 Copilot","/no/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"no":106},{"title":107,"url":108},"Teams","/no/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"no":112},{"title":113,"url":114},"SharePoint & Power Platform","/no/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"no":118},{"title":119,"url":120},"Exchange Online","/no/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"no":124},{"title":125,"url":126},"Information Protection & Compliance","/no/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"no":130},{"title":131,"description":132},"Azure","Driv vekst med Azure: kutt cloud-kostnader, øk effektiviteten og skap innovasjon gjennom IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"no":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"no":142},{"title":143,"url":144},"Azure Managed Services","/no/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"no":148},{"title":149,"url":150},"Azure Consulting","/no/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"no":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"no":160},{"title":161,"url":162},"Planlegg cloud-en din","/no/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"no":166},{"title":167,"url":168},"Migrer til cloud","/no/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"no":172},{"title":173,"url":174},"Forny virksomheten din","/no/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"no":178},{"title":179,"url":180},"Tenk nytt om VMware-strategien din","/no/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"no":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"no":190},{"title":191,"url":192},"Azure Foundation","/no/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"no":196},{"title":197,"url":198},"Azure AI Foundation","/no/azure/azure-ai-foundation",{"name":86,"languages":200},{"no":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"no":205},{"title":206,"url":207},"Azure Data Foundation","/no/azure/azure-data-foundation",{"name":188,"languages":209},{"no":210},{"title":211,"url":212},"Azure Container Foundation","/no/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"no":216},{"title":217,"url":218},"Managed Dark Tenant","/no/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"no":222},{"title":223,"url":224},"Cloud Adoption Framework","/no/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"no":228},{"title":229,"url":230},"Cloud Competence Center","/no/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"no":234},{"title":235,"description":236,"emergency":237},"Security","Årvåkenhet i cloud med en prisbelønt 24/7 managed service, incident response og moderne beskyttelse av infrastrukturen din.",{"text":238,"href":239,"skin":240,"icon":241},"Under angrep?","/no/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"no":249},{"title":250,"url":251},"Managed Red Tenant","/no/security/managed-red-tenant",{"name":214,"languages":253},{"no":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"no":259},{"title":260,"url":261},"Sentinel Data Lake","/no/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"no":265},{"title":266,"url":267},"Security Consulting","/no/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"no":274},{"title":275,"url":276},"Cloud Security Operations Center","/no/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"no":280},{"title":281,"url":282},"Global Secure Access","/no/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"no":286},{"title":287,"url":288},"MyWorkID","/no/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"no":295},{"title":296,"url":297},"Preventive Services","/no/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"no":301},{"title":302,"url":303},"Data Security Service","/no/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"no":307},{"title":308,"url":309},"Security Copilot Agents","/no/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"no":313},{"title":314,"url":315},"Innføre NIS2","/no/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"no":319},{"title":320,"description":321},"Produkter","Innovative tilleggsprodukter for et fullstendig sikkert, 100 % cloud-native Microsoft-miljø som styrker samarbeid, nettverksautentisering og programvarehåndtering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"no":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloud-basert programvaredistribusjon",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"no":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Sertifikatdistribusjon fra cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"no":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Jobb med dine lokale office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"no":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrer dataene dine fra én server til en annen",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"no":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"no":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering for nettverket ditt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"no":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finn kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"no":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvåking i sanntid",{"name":396,"languages":397},"casestudies",{"no":398},{"title":399,"url":400,"description":401},"Case Studies","/no/casestudies","Pioner i cloud: din fremste Microsoft-partner for omfattende cloud-løsninger med en Blueprint-basert tilnærming og Infrastructure-as-Code-kompetanse.",{"name":403,"languages":404,"children":407},"company",{"no":405},{"title":406,"description":401},"Selskap",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"no":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"no":417},{"title":418,"url":419},"Fakta og tall","/no/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"no":423},{"title":424,"url":425},"Kontakt og lokasjoner","/no/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"no":429},{"title":430,"url":431},"glueckkanja Sveits","/no/company/switzerland",{"name":433,"languages":434},"austria",{"no":435},{"title":436,"url":437},"glueckkanja Østerrike","/no/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"no":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"no":447},{"title":448,"url":449},"Karriereoversikt","/no/career",{"name":451,"languages":452},"company-young-professionals",{"no":453},{"title":454,"url":455},"Young Professionals","/no/young-professionals",{"name":457,"languages":458},"company-jobs",{"no":459},{"title":460,"url":461},"Ledige stillinger","/no/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"no":465},{"title":466},"Siste nytt",[468,474],{"name":469,"languages":470},"company-blog",{"no":471},{"title":472,"url":473},"Blogg","/no/blog",{"name":469,"languages":475},{"no":476},{"title":477,"url":478},"Arrangementer","/no/events",[480],{"name":481,"languages":482},"career-meta",{"no":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"no":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNo":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Personvern","/no/privacy",{"title":514,"url":515},"Juridisk informasjon","/no/imprint",{"title":517,"url":518},"Ingen cookies","/no/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":1194,"eventid":494,"extension":1209,"hideInRecent":484,"layout":1210,"meta":1211,"moment":1215,"navigation":325,"path":1233,"seo":1234,"stem":1235,"tags":494,"webcast":484,"__hash__":1236},"content_no/posts/2026-03-01-exchange-ad-split-permissions-hardening.md","Exchange AD Split Permissions uten anger",[523],"Thorsten Kunzi",{"type":525,"value":526,"toc":1193},"minimal",[527,532,536,543,549,568,571,578,583,587,596,611,617,620,625,661,685,689,697,706,711,727,731,737,742,747,808,813,850,853,857,872,879,895,906,910,913,959,962,971,980,983,998,1015,1028,1040,1045,1104,1108,1113,1133,1140,1164,1168,1171,1174,1189],[528,529,531],"h2",{"id":530},"tldr-hva-om-vi-fjerner-ulempene","TLDR: hva om vi fjerner ulempene?",[533,534,535],"p",{},"Jeg har funnet en måte å gi AD- og RBAC-tillatelser tilbake direkte der Exchange-brukere, grupper og kontakter befinner seg, uten at det krever endringer for administratorer eller identitetsstyringssystemer. Etter min erfaring har akkurat den friksjonen vært den viktigste sperren for de fleste bedrifter. Og vi beholder likevel sikkerhetsgevinsten mot lateral movement og domenekompromittering.",[533,537,538],{},[539,540],"img",{"alt":541,"src":542},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[533,544,545],{},[546,547,548],"strong",{},"Det gjøres i tre steg:",[550,551,553,562,565],"ol",{"style":552},"margin: 0.25rem 0",[554,555,556,557],"li",{},"Implementer ",[558,559,561],"a",{"href":560},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions","AD split permission-modellen",[554,563,564],{},"Gi Exchange-serverne de tapte AD-tillatelsene tilbake, men kun på de relevante OU-ene",[554,566,567],{},"Gi Exchange RBAC for å reaktivere manglende PowerShell-cmdlets",[533,569,570],{},"Alt via Microsofts anvisninger, AD-ACL-er eller Exchange RBAC-tildelinger.",[572,573],"video-frame",{"thumb":574,"alt":575,"id":576,":full-width":577},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[579,580,582],"div",{"style":581},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions uten anger. En steg-for-steg innføringsguide",[528,584,586],{"id":585},"hvorfor-bryr-vi-oss-nå","Hvorfor bryr vi oss (nå)?",[533,588,589,590,593,595],{},"Temaet har i stor grad blitt oversett eller ignorert siden det ble introdusert med Exchange 2010 SP1. Men standardmodellen med delte tillatelser utgjør en betydelig sikkerhetsrisiko for overtakelse av Active Directory. Kombinert med at Exchange de siste årene har vært beryktet for eksterne exploits, er det på tide å handle.",[591,592],"br",{},[591,594],{},"\nProblemet stammer fra privilegier som er tildelt på roten av et domene og som arves gjennom hele domenet.",[597,598,599,602,605,608],"ul",{"style":552},[554,600,601],{},"endre tillatelser på brukere og grupper (i praksis full tilgang)",[554,603,604],{},"endre gruppemedlemmer",[554,606,607],{},"tilbakestille passord på brukere",[554,609,610],{},"opprette og slette brukere og grupper",[533,612,613],{},[539,614],{"alt":615,"src":616},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[533,618,619],{},"Kun visse høyt privilegerte Tier 0-brukere og -grupper er beskyttet av AdminSDHolder-prosessen (attributtet admincount=1), og i mange miljøer finnes det ubeskyttede brukere eller grupper som kan gjøre det mulig å kompromittere domenet eller skogen, eller i det minste forårsake alvorlig skade.",[533,621,622],{},[546,623,624],{},"Fremtredende eksempler:",[597,626,627,630,650],{"style":552},[554,628,629],{},"Entra Connect Sync-konto ved bruk av Password Hash Sync",[554,631,632,633],{},"Standardgrupper",[597,634,636,639,647],{"style":635},"margin: 0",[554,637,638],{},"Allowed RODC Password Replication Group sammen med Entra Connect-konto (dersom en reell Windows RODC finnes)",[554,640,641,642,646],{},"Se også ",[558,643,645],{"href":644,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta","Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," som viser flere angrepsveier (Account Operators-gruppen utgjør en tilsvarende trussel)",[554,648,649],{},"Tømming av Protected Users for å åpne angrepsvektorer ved å fjerne beskyttelser",[554,651,652,653],{},"Ubeskyttede egendefinerte grupper eller admin- og tjenestekontoer",[597,654,655,658],{"style":635},[554,656,657],{},"Skrivetilgang på GPO-er (som gjelder domenekontrollere)",[554,659,660],{},"Håndtering av tilgang til AD-backuper, backup-server, PKI-maler, hypervisor, ...",[533,662,663,664,666,668,669,675,677,679,680],{},"Det er svært vanskelig i ettertid å demme opp for alle disse eksisterende og fremtidige potensielle angrepsveiene. For den egendefinerte OU-en _ADM kan du deaktivere ACL-arv, men de fleste standardobjekter kan ikke flyttes fra standard Builtin-OU eller Users-container og forblir sårbare.",[591,665],{},[591,667],{},"\nDet er mye bedre å fjerne de kraftige tillatelsene fra roten, noe som gjøres ved å innføre Active Directory split permissions-modellen. ",[558,670,674],{"href":671,"rel":672},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[673],"nofollow","Configure Exchange Server for split permissions | Microsoft Learn",[591,676],{},[591,678],{},"\nOg Microsoft er enig: «…encouraged to implement Active Directory split permissions» ",[558,681,684],{"href":682,"rel":683},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[673],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[528,686,688],{"id":687},"men-hvorfor-er-det-ingen-som-gjør-det","Men hvorfor er det ingen som gjør det?",[533,690,691,692,694,696],{},"Siden split permissions ikke var tilgjengelig før Exchange 2010 SP1, hadde alle akseptert situasjonen på det tidspunktet, og det virker som om sikkerhetsteamene ikke klarte å presse gjennom modellen etter at den ble tilgjengelig.",[591,693],{},[591,695],{},"\nOg den ville ha tvunget frem endringer i admin- og IDM-prosesser, som å opprette brukere eller distribusjonslister i AD først, og først deretter bruke Exchange til å «mail enable» dem.",[698,699,700],"blockquote",{},[533,701,702,705],{},[546,703,704],{},"Info:"," Følgende cmdlets vil ikke lenger være tilgjengelige eller virke: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[533,707,708],{},[546,709,710],{},"Eksempler på tilpasninger:",[597,712,713,724],{"style":552},[554,714,715,716],{},"New-Mailbox (der Exchange skriver til AD) ville blitt:",[597,717,718,721],{"style":635},[554,719,720],{},"New-ADUser (der adm.jdoe skriver til AD)",[554,722,723],{},"Enable-Mailbox",[554,725,726],{},"Add-ADPermission for SendAs-rettigheter måtte gjøres via AD Users and Computers i sikkerhetsfanen, og krever ofte ekstra AD-tillatelser for standardadministratorer.",[528,728,730],{"id":729},"vis-meg-dette-alternativet-uten-anger","Vis meg dette alternativet uten anger",[533,732,733,736],{},[546,734,735],{},"Ansvarsfraskrivelse",": Les og forstå følgende lenker og artikler fullstendig, gjennomfør endringen i et testmiljø først, og forsikre deg om at AD-backuper er oppdatert og at gjenopprettingsrutiner er etablert.",[738,739,741],"h3",{"id":740},"kartlegg-dagens-bruk","Kartlegg dagens bruk",[533,743,744],{},[546,745,746],{},"Du bør først sjekke hvilke av de berørte cmdletene som er i bruk på hvilke OU-er:",[748,749,750,758,760,766,768],"code-block",{},[751,752,753,757],"span",{},[751,754,756],{"style":755},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[591,759],{},[751,761,762,765],{},[751,763,764],{"style":755},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[591,767],{},[751,769,770,773,774,778,779,773,782,784,785,788,789,773,792,773,795,773,797,800,801,804,805],{},[751,771,772],{"style":755},"Search-AdminAuditLog"," ",[751,775,777],{"style":776},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[751,780,781],{"style":776},"-Cmdlets",[751,783,764],{"style":755}," | ",[751,786,787],{"style":755},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[751,790,791],{"style":755},"Export-Csv",[751,793,794],{"style":776},"-Path",[751,796,756],{"style":755},[751,798,799],{"style":776},"-Delimiter"," \";\" ",[751,802,803],{"style":776},"-Encoding"," Unicode ",[751,806,807],{"style":776},"-NoTypeInformation",[533,809,810],{},[546,811,812],{},"Rask analyse av caller og cmdlets:",[748,814,815,831,833,841,843],{},[751,816,817,820,821,773,824,773,826,773,828,830],{},[751,818,819],{"style":755},"$CSVs"," = ",[751,822,823],{"style":755},"Import-Csv",[751,825,794],{"style":776},[751,827,756],{"style":755},[751,829,799],{"style":776}," \";\"",[591,832],{},[751,834,835,784,837,840],{},[751,836,819],{"style":755},[751,838,839],{"style":755},"Group-Object"," Caller",[591,842],{},[751,844,845,784,847,849],{},[751,846,819],{"style":755},[751,848,839],{"style":755}," CmdletName",[533,851,852],{},"Analyser CSV-en for å avgjøre hvor AD-tillatelser vil være nødvendig. Optimaliser eventuelt ved å flytte alle Exchange-relevante grupper til dedikerte OU-er.",[528,854,856],{"id":855},"aktiver-split-permissions-modellen","Aktiver split permissions-modellen",[533,858,859,860,863,864,868],{},"Følg Microsofts instruksjoner ",[546,861,862],{},"«Switch to Active Directory split permissions»"," i\n",[558,865,674],{"href":866,"rel":867},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[673],[869,870,871],"em",{},"(IKKE RBAC split permissions)",[533,873,874,875,878],{},"I praksis fjerner dette de farlige tillatelsene til gruppen ",[546,876,877],{},"«Exchange Windows Permissions»"," og fjerner også Exchange som gruppemedlem.",[748,880,881],{},[751,882,883,773,886,773,889,773,892],{},[751,884,885],{"style":755},"Setup.exe",[751,887,888],{"style":776},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[751,890,891],{"style":776},"/PrepareAD",[751,893,894],{"style":776},"/ActiveDirectorySplitPermissions:true",[579,896,898,899,901,902],{"style":897},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[546,900,704],{}," For å reversere, bruk ganske enkelt ",[903,904,905],"code",{},"/ActiveDirectorySplitPermissions:false",[738,907,909],{"id":908},"tildel-ad-tillatelser","Tildel AD-tillatelser",[533,911,912],{},"Opprett en egendefinert AD-gruppe og gjør Exchange-serverne til medlemmer.",[748,914,915,921,923,773,926,929,930,933,934,937,938,773,940,773,943,946,947,949,929,952,955,956],{},[751,916,917],{},[751,918,920],{"style":919},"color:var(--color-black-40)","# juster OU-sti først",[591,922],{},[751,924,925],{"style":755},"New-ADGroup",[751,927,928],{"style":776},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[751,931,932],{"style":776},"-GroupCategory"," Security ",[751,935,936],{"style":776},"-GroupScope"," DomainLocal ",[751,939,794],{"style":776},[546,941,942],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[751,944,945],{"style":776},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[591,948],{},[751,950,951],{"style":755},"Add-ADGroupMember",[751,953,954],{"style":776},"-Members"," \"Exchange Trusted Subsystem\"\n",[751,957,958],{"style":919},"# start Exchange-serverne på nytt for at tillatelser via gruppe skal virke",[533,960,961],{},"Jeg har laget et skript som gjør delegering av AD-tillatelser enkel per bruksscenario.",[698,963,964],{},[533,965,966,967,970],{},"Uten disse tillatelsene ville Exchange-serveren fått feilen ",[903,968,969],{},"«INSUFF_ACCESS_RIGHTS»"," fra AD.",[533,972,973,974,979],{},"Last ned ",[558,975,978],{"href":976,"rel":977},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[673],"Add-ExchangeADSplitPermissionOnOU.ps1"," fra glueckkanja GitHub",[533,981,982],{},"Skriptet kan tildele følgende PermissionTypes:",[533,984,986,989,991,992,994],{"style":985},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[546,987,988],{},"CreateUserAndContact",[591,990],{},"Create/delete, ResetPassword og WriteAllProperties for Users og Contacts",[591,993],{},[995,996,997],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` og tilsvarende `Remove-*`",[533,999,1001,1004,1006,1007,1009],{"style":1000},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[546,1002,1003],{},"GroupManage",[591,1005],{},"Create/Delete Groups, Modify Member",[591,1008],{},[995,1010,1011,1012,1014],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[591,1013],{},"Også: brukere som administrerer DistributionGroups de eier via EAC",[533,1016,1017,1020,1022,1023,1025],{"style":1000},[546,1018,1019],{},"UserSendAs",[591,1021],{},"Modify AD Permissions on Users",[591,1024],{},[995,1026,1027],{},"Exchange-cmdlet: `Add-ADPermission`",[533,1029,1030,1033,1035,1036,1038],{"style":1000},[546,1031,1032],{},"GroupSendAs",[591,1034],{},"Modify AD Permissions on Groups",[591,1037],{},[995,1039,1027],{},[533,1041,1042],{},[546,1043,1044],{},"Slik bruker du skriptet:",[748,1046,1047,773,1049,1052,1053,1056,1057,1060,1061,1064,1066,773,1068,1070,1071,1073,1074,1060,1076,773,1078,1070,1080,1082,1083,1060,1085,773,1087,1089,1090,1092,1093,1060,1095,773,1097,1089,1099,1101,1102,1060],{},[751,1048,978],{"style":755},[751,1050,1051],{"style":776},"-TargetOU"," \u003COU> ",[751,1054,1055],{"style":776},"-PermissionType"," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[751,1058,1059],{"style":776},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[751,1062,1063],{"style":919},"# For eksempel",[591,1065],{},[751,1067,978],{"style":755},[751,1069,1051],{"style":776}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1072,1055],{"style":776}," GroupManage ",[751,1075,1059],{"style":776},[751,1077,978],{"style":755},[751,1079,1051],{"style":776},[751,1081,1055],{"style":776}," GroupSendAs ",[751,1084,1059],{"style":776},[751,1086,978],{"style":755},[751,1088,1051],{"style":776}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[751,1091,1055],{"style":776}," UserSendAs ",[751,1094,1059],{"style":776},[751,1096,978],{"style":755},[751,1098,1051],{"style":776},[751,1100,1055],{"style":776}," CreateUserAndContact ",[751,1103,1059],{"style":776},[738,1105,1107],{"id":1106},"tildel-exchange-rbac","Tildel Exchange RBAC",[533,1109,1110],{},[546,1111,1112],{},"Reaktiver -BypassSecurityGroupManagerCheck-parameteren for Add-DistributionGroupMember- og Remove-DistributionGroupMember-cmdletene:",[748,1114,1115],{},[751,1116,1117,773,1120,1122,1123,1126,1127,1129,1130,1132],{},[751,1118,1119],{"style":755},"New-RoleGroup",[751,1121,928],{"style":776}," \"SplitPermission Security Group Creation and Membership\" ",[751,1124,1125],{"style":776},"-Roles"," \"Security Group Creation and Membership\" ",[751,1128,954],{"style":776}," \"Organization Management\",\"Recipient Management\" ",[751,1131,945],{"style":776}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[698,1134,1135],{},[533,1136,1137,1139],{},[546,1138,704],{}," Ellers får du «-BypassSecurityGroupManagerCheck parameter is not available» eller «You don't have sufficient permissions. This operation can only be performed by a manager of the group»",[533,1141,1142,1144,1147,1149],{},[591,1143],{},[546,1145,1146],{},"Reaktiver New-Mailbox, New-RemoteMailbox, New-MailContact og Remove-...-cmdlets med nødvendige parametere:",[591,1148],{},[748,1150,1151,773,1153,1155,1156,1158,1159,1129,1161,1163],{},[751,1152,1119],{"style":755},[751,1154,928],{"style":776}," \"SplitPermission Mail Recipient Creation\" ",[751,1157,1125],{"style":776}," \"Mail Recipient Creation\" ",[751,1160,954],{"style":776},[751,1162,945],{"style":776}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[528,1165,1167],{"id":1166},"oppsummering","Oppsummering",[533,1169,1170],{},"Jeg håper denne veiledningen bidrar til at flere virksomheter tar det viktige skrittet med å sikre sitt Active Directory mot kompromittering via Exchange. Etter min erfaring med å innføre Exchange AD Split Permissions-modellen hos flere kunder, har jeg ikke støtt på problemer, og innføringen har gått glatt.",[533,1172,1173],{},"Jeg håper også Microsoft innfører en OU-basert nativ tilnærming for å oppnå dette granularitetsnivået, i stedet for dagens alt-eller-ingenting-modell, noe som ville gjort utbredt adopsjon betydelig enklere.",[533,1175,1176,1177,1182,1183,1188],{},"En merknad om AD Tiering: unngå å logge på Exchange-servere med Domain Admin eller andre Tier 0-kontoer. Behandle Exchange-servere som Tier 1 og innfør AD Tiering så raskt som mulig. Som et første steg anbefaler jeg å bruke ",[558,1178,1181],{"href":1179,"rel":1180},"https://www.pingcastle.com/",[673],"PingCastle"," eller ",[558,1184,1187],{"href":1185,"rel":1186},"https://www.semperis.com/purple-knight/",[673],"Purple Knight"," for å vurdere AD-sikkerhetsstatusen din og identifisere eksponerte kontrollveier.",[1190,1191,1192],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":1194,"searchDepth":1195,"depth":1195,"links":1196},"",2,[1197,1198,1199,1200,1204,1208],{"id":530,"depth":1195,"text":531},{"id":585,"depth":1195,"text":586},{"id":687,"depth":1195,"text":688},{"id":729,"depth":1195,"text":730,"children":1201},[1202],{"id":740,"depth":1203,"text":741},3,{"id":855,"depth":1195,"text":856,"children":1205},[1206,1207],{"id":908,"depth":1203,"text":909},{"id":1106,"depth":1203,"text":1107},{"id":1166,"depth":1195,"text":1167},"md","post",{"lang":1212,"seoTitle":1213,"titleClass":1214,"date":1215,"blogtitlepic":1216,"socialimg":1217,"customExcerpt":1218,"keywords":1219,"scripts":1220,"asideNav":1221,"maxContent":325,"published":325},"no","Exchange AD Split Permissions: sikre Active Directory med minste privilegium","h2-font-size","2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Selv virksomheter som har migrert postboksene fullt ut til skyen, kjører fortsatt ofte lokale Exchange-servere, og med dem en undervurdert sikkerhetsrisiko for Active Directory. Modellen «AD Split Permissions» fratar Exchange de brede AD-privilegiene som angripere kan utnytte til å ta over hele domenet. Frem til nå har innføringen i stor grad strandet på de prosessendringene den påfører administratorene. Denne artikkelen viser hvordan du elegant kan komme forbi nettopp den hindringen: et skript som selektivt gir de tapte AD-tillatelsene tilbake, kun på de relevante OU-ene, slik at den kjente admin-arbeidsflyten bevares samtidig som du oppnår hele sikkerhetsgevinsten.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange permissions, AdminSDHolder, least privilege, AD ACL, PowerShell | NO",{"slick":325,"form":325},{"menuItems":1222},[1223,1225,1227,1229,1231],{"href":1224,"text":531},"#tldr-hva-om-vi-fjerner-ulempene",{"href":1226,"text":586},"#hvorfor-bryr-vi-oss-nå",{"href":1228,"text":688},"#men-hvorfor-er-det-ingen-som-gjør-det",{"href":1230,"text":730},"#vis-meg-dette-alternativet-uten-anger",{"href":1232,"text":1167},"#oppsummering","/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":521,"description":1194},"posts/2026-03-01-exchange-ad-split-permissions-hardening","AM0_ia6nUgqLNtL9ino0IsL_rznqHUMqvieu2Hq_vSo",{"id":1238,"extension":1239,"meta":1240,"stem":8,"__hash__":1590},"authors_data/authors.json","json",{"path":1241,"Fritz Zurhorst":1242,"Alexander Schlindwein":1248,"Sophie Luna":1254,"Nadine Klein":1262,"Karsten Kleinschmidt":1268,"Julian Wendt":1276,"Holger Bunkradt":1281,"Ralf Mania":1287,"Oliver Kieselbach":1293,"Steffen Schwerdtfeger":1299,"Gunnar Winter":1307,"Jan Petersen":1312,"Thorsten Kunzi":1317,"Moritz Pohl":1320,"Thorben Pöschus":1325,"Christoph Hannebauer":1331,"Marco Scheel":1335,"Christopher Brumm":1340,"Florian Klante":1347,"Niklas Bachmann":1352,"Nils Krautkrämer":1357,"Patrick Treptau":1363,"Peter Beckendorf":1368,"Patrick Sobau":1373,"Jörg Wunderlich":1378,"Michael Breither":1382,"Christian Kanja":1387,"Zeba Hoffmann":1393,"Jochen Fröhlich":1398,"Jan Geisbauer":1402,"Gerrit Reinke":1414,"Christian Kordel":1420,"Stephan Wälde":1424,"Carolin Kanja":1429,"Adrian Ritter":1435,"Marvin Bangert":1440,"Thorsten Pickhan":1446,"Christian Lorenz":1452,"Denis Böhm":1457,"Fabian Bader":1462,"Juan Jose Fernandez Perez":1468,"Mahschid Sayyar":1473,"Benjamin Dassow":1478,"Markus Walschburger":1483,"Jonathan Haist":1488,"Daniel Rohregger":1493,"Thomas Naunheim":1498,"Florian Stöckl":1503,"Pascal Asch":1508,"Markus Kättner":1513,"Anna Ulbricht":1520,"Annette Brauns":1527,"body":1533,"title":1589},"/authors",{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1407},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1408,1411],{"text":1409,"href":1410},"Blog","https://emptydc.com",{"text":1412,"href":1413},"Podcast","https://hairlessinthecloud.com",{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1418,"linkedin":1419},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1258,"linkedin":1311},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1425,"avatar":1426,"permalink":1427,"twitter":1428,"linkedin":1311},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1441,"avatar":1442,"permalink":1443,"twitter":1444,"linkedin":1445},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1447,"avatar":1448,"permalink":1449,"twitter":1450,"linkedin":1451},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1453,"avatar":1454,"permalink":1455,"linkedin":1456,"twitter":1258},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1458,"avatar":1459,"permalink":1460,"linkedin":1461,"twitter":1258},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1467},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1469,"avatar":1470,"permalink":1471,"linkedin":1472},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1474,"avatar":1475,"permalink":1476,"linkedin":1477},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"imageOffsetTop":1247},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"imageOffsetTop":1247},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"imageOffsetTop":1346},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"imageOffsetTop":1346},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517,"imageOffsetTop":1518,"imageOffsetLeft":1519},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1534,"Alexander Schlindwein":1535,"Sophie Luna":1536,"Nadine Klein":1537,"Karsten Kleinschmidt":1538,"Julian Wendt":1539,"Holger Bunkradt":1540,"Ralf Mania":1541,"Oliver Kieselbach":1542,"Steffen Schwerdtfeger":1543,"Gunnar Winter":1544,"Jan Petersen":1545,"Thorsten Kunzi":1546,"Moritz Pohl":1547,"Thorben Pöschus":1548,"Christoph Hannebauer":1549,"Marco Scheel":1550,"Christopher Brumm":1551,"Florian Klante":1552,"Niklas Bachmann":1553,"Nils Krautkrämer":1554,"Patrick Treptau":1555,"Peter Beckendorf":1556,"Patrick Sobau":1557,"Jörg Wunderlich":1558,"Michael Breither":1559,"Christian Kanja":1560,"Zeba Hoffmann":1561,"Jochen Fröhlich":1562,"Jan Geisbauer":1563,"Gerrit Reinke":1567,"Christian Kordel":1568,"Stephan Wälde":1569,"Carolin Kanja":1570,"Adrian Ritter":1571,"Marvin Bangert":1572,"Thorsten Pickhan":1573,"Christian Lorenz":1574,"Denis Böhm":1575,"Fabian Bader":1576,"Juan Jose Fernandez Perez":1577,"Mahschid Sayyar":1578,"Benjamin Dassow":1579,"Markus Walschburger":1580,"Jonathan Haist":1581,"Daniel Rohregger":1582,"Thomas Naunheim":1583,"Florian Stöckl":1584,"Pascal Asch":1585,"Markus Kättner":1586,"Anna Ulbricht":1587,"Annette Brauns":1588},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1249,"avatar":1250,"permalink":1251,"twitter":1252,"linkedin":1253},{"display_name":1255,"avatar":1256,"permalink":1257,"twitter":1258,"linkedin":1259,"imageOffsetLeft":1260,"imageOffsetTop":1261},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1277,"avatar":1278,"permalink":1279,"linkedin":1280},{"display_name":1282,"avatar":1283,"permalink":1284,"linkedin":1285,"twitter":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"linkedin":1291,"twitter":1292},{"display_name":1294,"avatar":1295,"permalink":1296,"linkedin":1297,"twitter":1298},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"display_name":1308,"avatar":1309,"permalink":1310,"twitter":1258,"linkedin":1311},{"display_name":1313,"avatar":1314,"permalink":1315,"twitter":1258,"linkedin":1316},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1321,"avatar":1322,"permalink":1323,"twitter":1258,"linkedin":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"twitter":1329,"linkedin":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},{"display_name":1336,"avatar":1337,"permalink":1338,"twitter":1339,"linkedin":1339},{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1344,"linkedin":1345,"imageOffsetTop":1346},{"display_name":1348,"avatar":1349,"permalink":1350,"linkedin":1351,"twitter":1258},{"display_name":1353,"avatar":1354,"permalink":1355,"linkedin":1356,"twitter":1258},{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1361,"linkedin":1362},{"display_name":1364,"avatar":1365,"permalink":1366,"linkedin":1367,"twitter":1258},{"display_name":1369,"avatar":1370,"permalink":1371,"linkedin":1372,"twitter":1258,"imageOffsetTop":1247},{"display_name":1374,"avatar":1375,"permalink":1376,"linkedin":1377,"twitter":1258},{"display_name":1379,"avatar":1380,"permalink":1381,"twitter":1258},{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1258,"linkedin":1386},{"display_name":1388,"avatar":1389,"permalink":1390,"twitter":1391,"linkedin":1392},{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1258},{"display_name":1399,"avatar":1400,"permalink":1401,"twitter":1258,"linkedin":1311},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1564},[1565,1566],{"text":1409,"href":1410},{"text":1412,"href":1413},{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1418,"linkedin":1419},{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1258,"linkedin":1311},{"display_name":1425,"avatar":1426,"permalink":1427,"twitter":1428,"linkedin":1311},{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439},{"display_name":1441,"avatar":1442,"permalink":1443,"twitter":1444,"linkedin":1445},{"display_name":1447,"avatar":1448,"permalink":1449,"twitter":1450,"linkedin":1451},{"display_name":1453,"avatar":1454,"permalink":1455,"linkedin":1456,"twitter":1258},{"display_name":1458,"avatar":1459,"permalink":1460,"linkedin":1461,"twitter":1258},{"display_name":1463,"avatar":1464,"permalink":1465,"linkedin":1466,"twitter":1467},{"display_name":1469,"avatar":1470,"permalink":1471,"linkedin":1472},{"display_name":1474,"avatar":1475,"permalink":1476,"linkedin":1477},{"display_name":1479,"avatar":1480,"permalink":1481,"linkedin":1482},{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487},{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"imageOffsetTop":1247},{"display_name":1494,"avatar":1495,"permalink":1496,"linkedin":1497,"imageOffsetTop":1247},{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502,"imageOffsetTop":1346},{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507,"imageOffsetTop":1346},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517,"imageOffsetTop":1518,"imageOffsetLeft":1519},{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1592,"authors":1809},[1593,1610,1624,1638,1654,1667,1680,1693,1705,1721,1735,1751,1769,1780,1793],{"id":1594,"title":1595,"author":1596,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1597,"moment":1602,"path":1603,"stem":1604,"tags":1605,"webcast":484},"content_no/posts/2026-09-22-end-of-mfa-sms.md","Slutten på MFA-SMS",[1269],{"lang":1212,"date":1598,"categories":1599,"blogtitlepic":1600,"customExcerpt":1601},"2026-09-21",[235],"head-conditional-access.jpg","Hvorfor bedrifter nå bør gå over til phishing-resistente og helst passordløse påloggingsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1606,1607,1608,1609],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1611,"title":1612,"author":1613,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1614,"moment":1598,"path":1618,"stem":1619,"tags":1620,"webcast":484},"content_no/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brukeren er exploiten, og hvordan dere stopper det",[1243,1263],{"lang":1212,"date":1598,"categories":1615,"blogtitlepic":1616,"customExcerpt":1617},[235],"head-clickfix.jpg","ClickFix gjør brukere til sin egen angriper: en forfalsket CAPTCHA, en kopier-lim-inn, og skadekode kjører i minnet uten at noe havner på disken. Hvordan Microsoft Defender oppdager angrepet, hvor deteksjonen kommer til kort, og hvordan dere lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1621,1622,1623],"Defender","SOC","Endpoint Security",{"id":1625,"title":1626,"author":1627,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1628,"moment":1598,"path":1632,"stem":1633,"tags":1634,"webcast":484},"content_no/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme maskin? Game Over.",[1403],{"lang":1212,"date":1598,"categories":1629,"blogtitlepic":1630,"customExcerpt":1631},[235],"head-game-over-en.jpg","Hvorfor én tenant ikke er nok for CIO-er, og hvorfor den andre sjelden blir tenkt på. Managed Red Tenant skiller administrativt arbeid arkitektonisk fra office-miljøet, Managed Dark Tenant holder bedriften handlekraftig når forsvaret likevel faller. Hva det betyr for driftsmodell, SOC-signal og dokumentasjonspliktene etter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1635,1636,1637],"Privileged Access","Zero Trust","NIS2",{"id":1639,"title":1640,"author":1641,"cta":494,"description":1642,"hideInRecent":484,"layout":1210,"meta":1643,"moment":1644,"path":1649,"stem":1650,"tags":1651,"webcast":484},"content_no/posts/2026-08-08-isg-germany-2026.md","Fire ganger Leader. glueckkanja i ISG-studien Tyskland 2026",[1430],"ISG har endret navn på studien sin i år. Microsoft Cloud Ecosystem ble til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken forskjøvet seg: det som vurderes, er ikke lenger hvem som innfører Microsoft-plattformer, men hvem som drifter Copilot, agenter og AI-workloads kontrollerbart. Den nye målestokken har ikke endret posisjonen vår. ISG Provider Lens®-studien Tyskland 2026 posisjonerer oss som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large Market og i Mid Market. Etter 2021, 2023, 2024 og 2025 er det den femte Leader-plasseringen i Tyskland, i Sveits kom spranget inn i Leader-kvadranten to uker tidligere.",{"lang":1212,"date":1644,"categories":1645,"blogtitlepic":1647,"customExcerpt":1648},"2026-08-08",[1646],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large og i Mid Market. Studien heter nå Microsoft AI and Cloud Ecosystem, og målestokken har forskjøvet seg: det som vurderes, er hvem som drifter AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1652,1653],"Award","ISG",{"id":1655,"title":1656,"author":1657,"cta":494,"description":1658,"hideInRecent":484,"layout":1210,"meta":1659,"moment":1660,"path":1664,"stem":1665,"tags":1666,"webcast":484},"content_no/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-studien Sveits 2026",[1430],"I 2024 grunnla vi glueckkanja Switzerland AG og flyttet inn i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 plasserte ISG oss i det sveitsiske markedet som Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten. Nå er spranget dokumentert: ISG Provider Lens®-studien 2026 posisjonerer oss i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":1212,"date":1660,"categories":1661,"blogtitlepic":1662,"customExcerpt":1663},"2026-07-31",[1646],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services. To år etter inntredenen i markedet i Bern, ett år etter Rising-Star-utmerkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1652,1653],{"id":1668,"title":1669,"author":1670,"cta":494,"description":1194,"hideInRecent":484,"layout":1210,"meta":1671,"moment":1672,"path":1676,"stem":1677,"tags":1678,"webcast":484},"content_no/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hva OpenAI/Hugging-Face-hendelsen avslører, og hva den ikke gjør",[1403],{"lang":1212,"date":1672,"categories":1673,"blogtitlepic":1674,"customExcerpt":1675},"2026-07-24",[235],"head-outbreak.jpg","En AI-agent bryter seg ut av testmiljøet sitt, finner en zero-day og hacker et annet selskap. Høres ut som et filmmanus, men skjedde faktisk i juli 2026. På tide med en nøktern vurdering: med litt psykologi, to security-veteraner og spørsmålet om hva dette betyr for forsvaret deres.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1679,1622,1636],"AI",{"id":1681,"title":1682,"author":1683,"cta":494,"description":1684,"hideInRecent":484,"layout":1210,"meta":1685,"moment":1686,"path":1690,"stem":1691,"tags":1692,"webcast":484},"content_no/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG-studien Cybersecurity 2026",[1430],"Ny i kvadranten og Leader med én gang: ISG Provider Lens®-studien «Cybersecurity – Services and Solutions 2026» posisjonerer glueckkanja som Leader innen Next-Gen SOC/MDR Services for det tyske mellommarkedet. I totalmarkedet for Next-Gen SOC/MDR Services kårer ISG oss til Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten innen de neste 12 til 24 månedene.",{"lang":1212,"date":1686,"categories":1687,"blogtitlepic":1688,"customExcerpt":1689},"2026-07-22",[1646],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 kårer glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarkedet for Next-Gen SOC/MDR Services er vi Rising Star. ISG framhever vekst over gjennomsnittet, dyp Microsoft-security-ekspertise og et 24/7 SOC driftet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1652,1653,235],{"id":1694,"title":1695,"author":1696,"cta":494,"description":1697,"hideInRecent":484,"layout":1210,"meta":1698,"moment":1699,"path":1702,"stem":1703,"tags":1704,"webcast":484},"content_no/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hva AI faktisk trenger for å jobbe",[1430],"En produksjonsbedrift vil vite hvilke av sine 14 000 SKU-er som faktisk er lønnsomme. Svaret ligger i tre systemer som aldri har utvekslet ett eneste datapunkt med hverandre. Til for kort tid siden kostet det tre avdelinger, to uker og en god del velvilje å få det. Siden begynnelsen av 2026 kan en AI besvare dette spørsmålet på minutter: søke gjennom dataene, etablere sammenhenger, produsere en anbefaling. Forutsatt at den har tilgang.",{"lang":1212,"date":1699,"categories":1700,"blogtitlepic":1701},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1679,131],{"id":1706,"title":1707,"author":1708,"cta":494,"description":1709,"hideInRecent":484,"layout":1210,"meta":1710,"moment":1711,"path":1715,"stem":1716,"tags":1717,"webcast":484},"content_no/posts/2026-07-01-onboarding-process.md","Kontrakten er signert: Slik foregår onboardingen din hos oss",[1521],"Hvordan foregår egentlig onboardingen hos dere? Et spørsmål som stadig dukker opp i samtaler med søkere, for mange har allerede opplevd at en onboarding går trått. Desto viktigere er det for oss å gi deg en god følelse helt fra starten.",{"lang":1212,"date":1711,"categories":1712,"blogtitlepic":1713,"customExcerpt":1714},"2026-07-01",[1646],"Onboarding_Blogheader","Kontrakten er signert, det første store steget er tatt. Men hva skjer nå? Vi tar deg med bak kulissene i onboardingen vår, fra PreBoarding til den første uka i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1718,1719,1720],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1722,"title":1723,"author":1724,"cta":494,"description":1725,"hideInRecent":484,"layout":1210,"meta":1726,"moment":1727,"path":1731,"stem":1732,"tags":1733,"webcast":484},"content_no/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er en av dem",[1430],"I Microsofts partnerøkosystem finnes det en hel rekke anerkjennelser, og likevel skiller Frontier Partner Badge seg fra de andre utmerkelsene i måten den er lagt opp på. Den kan ikke søkes om, men tildeles på Microsofts initiativ til en eksklusiv gruppe partnere som må overbevise i flere disipliner parallelt, i stedet for å briljere i én enkelt. Microsoft vurderer dokumentert kompetanse i Cloud & AI Platforms, i AI Business Solutions og i Security likeverdig, og henvender seg dermed til virksomheter som ikke ser AI som et påheng på eksisterende IT, men som resultatet av en gjennomgående arkitektur som bærer fra identiteten via endepunktet og helt inn i produktiv AI-drift.",{"lang":1212,"date":1727,"categories":1728,"blogtitlepic":1729,"customExcerpt":1730},"2026-06-26",[1646],"head-frontier-partner-badge.jpg","Nylig har Microsoft AI Cloud Partner Program fått en ny toppanerkjennelse, Frontier Partner Badge. Microsoft tildeler den utelukkende til en eksklusiv gruppe partnere verden over som leverer AI-prosjekter på hele Microsoft-stacken på en bærekraftig måte, fra arbeidsplassen via cloud-plattformen og security til selve AI-anvendelsen, og som har dokumentert dette i praksis. I DACH-området teller denne gruppen bare en håndfull selskaper, og vi er ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1652,1734,1679],"Microsoft Partner",{"id":1736,"title":1737,"author":1738,"cta":494,"description":1739,"hideInRecent":484,"layout":1210,"meta":1740,"moment":1741,"path":1745,"stem":1746,"tags":1747,"webcast":484},"content_no/posts/2026-06-09-vair-run.md","160 kilometer for en god sak",[1528],"Søndag morgen, klokka 8:30, Holbeinsteg ved Main. Elleve kolleger i like NinjaCat-skjorter, klare for Frankfurter Runden. Regn, lyn og torden inkludert. Å løpe for en god sak var motivasjon nok til å snøre løpeskoene tross det dårlige været.",{"lang":1212,"date":1741,"categories":1742,"blogtitlepic":1743,"customExcerpt":1744},"2026-06-08",[1646],"frankfurter-runden.png","Elleve kolleger, 16 runder, 160 kilometer, et tordenvær og en pallplassering: glueckkanja var med på Frankfurter Runden 2026 og donerte for hver løpte runde til VAIR e.V., som bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1748,1718,1749,1750],"Top Arbeitgeber","Soziales Engagement","| NO",{"id":1752,"title":1753,"author":1754,"cta":494,"description":1755,"hideInRecent":484,"layout":1210,"meta":1756,"moment":1757,"path":1761,"stem":1762,"tags":1763,"webcast":484},"content_no/posts/2026-04-10-incident-to-intelligence.md","Anatomien til en ukjent AMOS Stealer: Fra alert til immunitet på timer",[1509],"Når en alert utløses i vårt SOC, begynner klokken å gå: ikke bare for den berørte kunden, men for alle organisasjoner under vår beskyttelse. Det farligste øyeblikket i dagens trusselbilde er Intelligence Gap, altså tidsvinduet mellom første gang en ny malware-variant tas i bruk og den dagen bransjen får vite om den.",{"lang":1212,"date":1757,"categories":1758,"blogtitlepic":1759,"customExcerpt":1760},"2026-04-10",[235],"head-amos-stealer.png","En hittil udokumentert AMOS-Stealer-variant kompromitterte et macOS-endpoint. Ingen kjente hasher, ingen C2-data i offentlige databaser. Vårt SOC demonterte seks obfuskeringslag, hentet ut alle indikatorene og distribuerte beskyttelsen til samtlige SOC-kunder i løpet av timer, før bransjen i det hele tatt hadde sett samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1764,1765,1766,1767,1768],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1770,"title":1771,"author":1772,"cta":494,"description":1773,"hideInRecent":484,"layout":1210,"meta":1774,"moment":1775,"path":1778,"stem":1779,"tags":494,"webcast":484},"content_no/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være deres eneste corporate browser",[1300],"Valget av nettleser er en strategisk beslutning i bedriftsmiljøer: det påvirker direkte hvor mye sikkerhet og administrasjonsarbeid du faktisk får. Google Chrome var lenge det åpenbare valget, men Microsoft Edge har utviklet seg til en nettleser som griper direkte inn i den eksisterende stacken, særlig når Microsoft 365 er i bruk og administrasjonen går via Intune.",{"lang":1212,"date":1775,"blogtitlepic":1776,"customExcerpt":1777},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhet har egentlig valgt Chrome; den var bare der, med sin egen sync-logikk, sin egen kontoadministrasjon, sitt eget grensesnitt for policyer. Microsoft Edge griper derimot rett inn i infrastrukturen som allerede kjører: Entra ID, Intune, Defender. Dette innlegget viser hvordan overgangen ser ut, hvordan Chrome omdirigeres til en landingsside via Intune-policy, og hva som faller bort når du slutter å drifte to nettlesere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1781,"title":1782,"author":1783,"cta":494,"description":1784,"hideInRecent":484,"layout":1210,"meta":1785,"moment":1786,"path":1790,"stem":1791,"tags":1792,"webcast":484},"content_no/posts/2026-03-20-stryker-attack-intune-privilege.md","En admin-konto var alt som skulle til.",[1403],"Onsdag 11. mars 2026. Ansatte i Stryker-kontorer i 79 land slo på datamaskinene sine og fant dem tomme. Innloggingsskjermer erstattet av en logo. Firmalaptoper, tjenestemobiler, private enheter registrert i selskapets BYOD-program, alle slettet samtidig, over natten. Ingen ransomware, ingen malware-signaturer, ingenting som et endpoint-detection-verktøy kunne ha fanget opp.",{"lang":1212,"date":1786,"categories":1787,"blogtitlepic":1788,"customExcerpt":1789},"2026-03-20",[235],"head-stryker.jpg","Den 11. mars 2026 slettet Handala enheter i 79 land, og alt som skulle til, var en kompromittert Intune-admin-konto. Ingen malware, ingen exploit, bare legitime management-verktøy vendt mot sine egne eiere. Hva som skjedde, hvorfor det virket, og hvilke to arkitektoniske hull som må tettes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1635,1636],{"id":1794,"title":1795,"author":1796,"cta":494,"description":1797,"hideInRecent":484,"layout":1210,"meta":1798,"moment":1799,"path":1803,"stem":1804,"tags":1805,"webcast":484},"content_no/posts/2026-03-16-ai-agent-hackathon.md","Seks Agents. Fire uker. Ekte drift.",[1430],"Hvor mange timer bruker IT-avdelingen din per uke på oppgaver som en Agent kunne løst på minutter?",{"lang":1212,"date":1799,"categories":1800,"blogtitlepic":1801,"customExcerpt":1802},"2026-03-16",[1646],"head-ai-agent-hackathon.jpg","Seks selskaper, fire ukers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik bygde Agents i Copilot Studio som i dag kjører i produksjon. Hva som kom ut av det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1679,1806,1807,1808],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1810,"Fritz Zurhorst":1811,"Nadine Klein":1812,"Jan Geisbauer":1813,"Carolin Kanja":1817,"Anna Ulbricht":1818,"Annette Brauns":1819,"Pascal Asch":1820,"Steffen Schwerdtfeger":1821},{"display_name":1269,"avatar":1270,"permalink":1271,"twitter":1272,"linkedin":1273,"imageOffsetTop":1274,"imageOffsetLeft":1275},{"display_name":1243,"avatar":1244,"permalink":1245,"linkedin":1246,"imageOffsetTop":1247},{"display_name":1263,"avatar":1264,"permalink":1265,"twitter":1266,"linkedin":1267,"imageOffsetTop":1247},{"display_name":1403,"avatar":1404,"permalink":1405,"twitter":1406,"linkedin":1406,"imageOffsetTop":1247,"socials":1814},[1815,1816],{"text":1409,"href":1410},{"text":1412,"href":1413},{"display_name":1430,"avatar":1431,"permalink":1432,"twitter":1433,"linkedin":1434},{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1525,"imageOffsetLeft":1526},{"display_name":1528,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1532,"imageOffsetLeft":1274},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512,"imageOffsetTop":1346},{"display_name":1300,"avatar":1301,"permalink":1302,"linkedin":1303,"twitter":1304,"imageOffsetTop":1305,"imageOffsetLeft":1306},{"id":1238,"extension":1239,"meta":1823,"stem":8,"__hash__":1590},{"Thorsten Kunzi":1824},{"display_name":523,"avatar":1318,"permalink":1319,"twitter":1258,"linkedin":1311,"imageOffsetTop":1247},1791383946297]