[{"data":1,"prerenderedAt":1770},["ShallowReactive",2],{"sc:header-data-sv":3,"sc:footer-data-sv":489,"author-sv-thorsten-kunzi-1f055f71c9741a":519,"content-sv-thorsten-kunzi":549,"content-events-sv-thorsten-kunzi":1758,"authors_data:Thorsten Kunzi":1759},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"sv":13},{"title":14,"url":15,"alt":16},"Hem","/sv","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"sv":21},{"title":22,"description":23},"Workplace","Microsoft 365-driven för smarta, säkra och flexibla arbetsmiljöer som förenar den senaste tekniken och identitetslösningar.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"sv":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"sv":34},{"title":35,"url":36},"Managed Intune","/sv/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"sv":40},{"title":41,"url":42},"Managed Entra","/sv/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"sv":46},{"title":47,"url":48},"Managed Workplace","/sv/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"sv":52},{"title":53,"url":54},"Consulting Services","/sv/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"sv":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"sv":64},{"title":65,"url":66},"Microsoft Entra Suite","/sv/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"sv":70},{"title":71,"url":72},"Microsoft Intune","/sv/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"sv":76},{"title":77,"url":78},"Microsoft Windows","/sv/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"sv":82},{"title":83,"url":84},"Windows 365 Cloud PC","/sv/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"sv":88},{"title":89,"url":90},"Cloud Workplace Foundation","/sv/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"sv":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"sv":100},{"title":101,"url":102},"Microsoft 365 Copilot","/sv/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"sv":106},{"title":107,"url":108},"Teams","/sv/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"sv":112},{"title":113,"url":114},"SharePoint & Power Platform","/sv/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"sv":118},{"title":119,"url":120},"Exchange Online","/sv/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"sv":124},{"title":125,"url":126},"Information Protection & Compliance","/sv/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"sv":130},{"title":131,"description":132},"Azure","Driv tillväxt med Azure: Sänk molnkostnaderna, öka effektiviteten och driv innovation genom IaaS och PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"sv":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"sv":142},{"title":143,"url":144},"Azure Managed Services","/sv/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"sv":148},{"title":149,"url":150},"Azure Consulting","/sv/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"sv":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"sv":160},{"title":161,"url":162},"Planera ditt moln","/sv/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"sv":166},{"title":167,"url":168},"Migrera till molnet","/sv/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"sv":172},{"title":173,"url":174},"Förnya din verksamhet","/sv/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"sv":178},{"title":179,"url":180},"Ompröva din VMware-strategi","/sv/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"sv":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"sv":190},{"title":191,"url":192},"Azure Foundation","/sv/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"sv":196},{"title":197,"url":198},"Azure AI Foundation","/sv/azure/azure-ai-foundation",{"name":86,"languages":200},{"sv":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"sv":205},{"title":206,"url":207},"Azure Data Foundation","/sv/azure/azure-data-foundation",{"name":188,"languages":209},{"sv":210},{"title":211,"url":212},"Azure Container Foundation","/sv/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"sv":216},{"title":217,"url":218},"Managed Dark Tenant","/sv/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"sv":222},{"title":223,"url":224},"Cloud Adoption Framework","/sv/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"sv":228},{"title":229,"url":230},"Cloud Competence Center","/sv/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"sv":234},{"title":235,"description":236,"emergency":237},"Säkerhet","Vaksamhet i molnet med en prisbelönt managed service dygnet runt, incident response och toppmodernt skydd för din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Attackerad?","/sv/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"sv":249},{"title":250,"url":251},"Managed Red Tenant","/sv/security/managed-red-tenant",{"name":214,"languages":253},{"sv":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"sv":259},{"title":260,"url":261},"Sentinel Data Lake","/sv/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"sv":265},{"title":266,"url":267},"Security Consulting","/sv/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"sv":274},{"title":275,"url":276},"Cloud Security Operations Center","/sv/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"sv":280},{"title":281,"url":282},"Global Secure Access","/sv/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"sv":286},{"title":287,"url":288},"MyWorkID","/sv/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"sv":295},{"title":296,"url":297},"Preventive Services","/sv/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"sv":301},{"title":302,"url":303},"Data Security Service","/sv/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"sv":307},{"title":308,"url":309},"Security Copilot Agents","/sv/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"sv":313},{"title":314,"url":315},"Implementera NIS2","/sv/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"sv":319},{"title":320,"description":321},"Produkter","Innovativa kompletterande produkter för en helt säker, 100% cloud-native Microsoft-miljö som förbättrar samarbete, nätverksautentisering och programvaruhantering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"sv":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Molnbaserad programvarudistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"sv":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution från molnet",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"sv":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbeta lokalt med dina Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"sv":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrera dina data från en server till en annan",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"sv":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider för Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"sv":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering för ditt nätverk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"sv":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Hitta kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"sv":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-övervakning i realtid",{"name":396,"languages":397},"casestudies",{"sv":398},{"title":399,"url":400,"description":401},"Kundcase","/sv/casestudies","Pionjär i molnet: Din främsta Microsoft-partner för heltäckande molnlösningar med ett Blueprint-baserat tillvägagångssätt och expertis inom Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"sv":405},{"title":406,"description":401},"Företag",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"sv":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"sv":417},{"title":418,"url":419},"Fakta och siffror","/sv/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"sv":423},{"title":424,"url":425},"Kontakt och platser","/sv/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"sv":429},{"title":430,"url":431},"glueckkanja Schweiz","/sv/company/switzerland",{"name":433,"languages":434},"austria",{"sv":435},{"title":436,"url":437},"glueckkanja Österrike","/sv/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"sv":441},{"title":442},"Karriär",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"sv":447},{"title":448,"url":449},"Karriäröversikt","/sv/career",{"name":451,"languages":452},"company-young-professionals",{"sv":453},{"title":454,"url":455},"Young Professionals","/sv/young-professionals",{"name":457,"languages":458},"company-jobs",{"sv":459},{"title":460,"url":461},"Lediga jobb","/sv/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"sv":465},{"title":466},"Aktuellt",[468,474],{"name":469,"languages":470},"company-blog",{"sv":471},{"title":472,"url":473},"Blogg","/sv/blog",{"name":469,"languages":475},{"sv":476},{"title":477,"url":478},"Event","/sv/events",[480],{"name":481,"languages":482},"career-meta",{"sv":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"sv":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksSv":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Integritetspolicy","/sv/privacy",{"title":514,"url":515},"Juridisk information","/sv/imprint",{"title":517,"url":518},"Inga cookies","/sv/cookies",{"id":520,"title":521,"body":522,"description":528,"extension":533,"meta":534,"name":521,"navigation":325,"otherLanguages":535,"path":545,"seo":546,"stem":547,"__hash__":548},"authors/thorsten-kunzi.md","Thorsten Kunzi",{"type":523,"value":524,"toc":529},"minimal",[525],[526,527,528],"p",{},"Als Consultant in den Bereichen Exchange Online, Identity und Modern Workplace unterstützt Thorsten Kunzi seit vielen Jahren Kunden bei der Planung und Umsetzung von Cloud-Projekten. Aufgrund seiner Erfahrung im Bereich der On-Premises Active Directory Security ist er auch im Hardening aktiv und hilft als Teil der APT Response Taskforce bei kompromittierten oder verschlüsselten Kundenumgebungen.",{"title":530,"searchDepth":531,"depth":531,"links":532},"",2,[],"md",{},{"en":536,"es":537,"sv":538,"fi":539,"da":540,"ko":541,"nl":542,"no":543,"ja":544},"As a consultant in the areas of Exchange Online, Identity and Modern Workplace, Thorsten Kunzi has been supporting customers in the planning and implementation of cloud projects for many years. Due to his experience in the area of on-premises Active Directory Security, he is also active in hardening and helps as part of the APT Response Taskforce with compromised or encrypted customer environments.","Como Consultant en las áreas de Exchange Online, Identity y Modern Workplace, Thorsten Kunzi lleva muchos años apoyando a los clientes en la planificación y ejecución de proyectos en la nube. Gracias a su experiencia en el ámbito de la seguridad de Active Directory on-premises, también trabaja en el hardening y ayuda, como parte de la APT Response Taskforce, en entornos de clientes comprometidos o cifrados.","Som Consultant inom områdena Exchange Online, Identity och Modern Workplace har Thorsten Kunzi i många år stöttat kunder i planeringen och genomförandet av molnprojekt. Tack vare sin erfarenhet inom on-premises Active Directory-säkerhet arbetar han även med hardening och hjälper som en del av APT Response Taskforce till i komprometterade eller krypterade kundmiljöer.","Consultantina Exchange Onlinen, Identityn ja Modern Workplacen alueilla Thorsten Kunzi on jo useiden vuosien ajan tukenut asiakkaita pilviprojektien suunnittelussa ja toteutuksessa. On-premises Active Directory -tietoturvan kokemuksensa ansiosta hän työskentelee myös hardeningin parissa ja auttaa osana APT Response Taskforce -tiimiä vaarantuneissa tai salatuissa asiakasympäristöissä.","Som Consultant inden for områderne Exchange Online, Identity og Modern Workplace har Thorsten Kunzi gennem mange år hjulpet kunder med planlægning og gennemførelse af cloud-projekter. På grund af sin erfaring inden for on-premises Active Directory-sikkerhed arbejder han også med hardening og hjælper som en del af APT Response Taskforce ved kompromitterede eller krypterede kundemiljøer.","Exchange Online, Identity, Modern Workplace 분야의 Consultant로서 Thorsten Kunzi는 오랜 기간 동안 고객의 클라우드 프로젝트 계획과 구현을 지원해 왔습니다. 온프레미스 Active Directory 보안 분야의 경험을 바탕으로 하드닝 작업에도 참여하고 있으며, APT Response Taskforce의 일원으로서 침해되거나 암호화된 고객 환경을 지원합니다.","Als Consultant voor Exchange Online, Identity en Modern Workplace ondersteunt Thorsten Kunzi klanten al vele jaren bij de planning en realisatie van cloudprojecten. Door zijn ervaring met On-Premises Active Directory Security is hij ook actief in hardening en helpt hij als onderdeel van de APT Response Taskforce bij gecompromitteerde of versleutelde klantomgevingen.","Som Consultant innen Exchange Online, Identity og Modern Workplace har Thorsten Kunzi i mange år bistått kunder med planlegging og gjennomføring av cloud-prosjekter. På grunn av erfaringen sin innen on-premises Active Directory Security er han også aktiv i hardening og hjelper som del av APT Response Taskforce ved kompromitterte eller krypterte kundemiljøer.","Exchange Online、Identity、Modern Workplaceの領域を担当するコンサルタントとして、Thorsten Kunziは長年にわたりクラウドプロジェクトの計画と実装でお客様を支援しています。オンプレミスのActive Directory Securityでの経験を活かしてHardeningにも携わり、APT Response Taskforceの一員として、侵害されたり暗号化されたりしたお客様環境に対応しています。","/thorsten-kunzi",{"title":521,"description":528},"thorsten-kunzi","YaiG705aTbfkaYxak0GKTbfT-5vntVpIpV6yaXJnw7I",[550,1132],{"id":551,"title":552,"author":553,"body":554,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":325,"layout":1105,"meta":1106,"moment":1110,"navigation":325,"path":1128,"seo":1129,"stem":1130,"tags":494,"webcast":484,"__hash__":1131},"content_sv/posts/2026-01-27-exchange-active-directory.md","Exchange AD Split Permissions utan ånger",[521],{"type":523,"value":555,"toc":1087},[556,561,564,571,575,602,605,609,615,630,636,639,643,679,698,703,709,718,722,738,742,749,753,763,768,773,792,796,822,826,846,854,870,884,944,948,972,989,1001,1014,1021,1025,1035,1046,1058,1062,1065,1068,1083],[557,558,560],"h3",{"id":559},"tldr-tänk-om-vi-tar-bort-nackdelarna","TLDR: tänk om vi tar bort nackdelarna?",[526,562,563],{},"Jag hittade ett sätt att återge de AD- och RBAC-behörigheter där Exchange-användare, grupper, kontakter och så vidare finns. På så sätt behövs ingen anpassning för administratörer eller identitetshanteringssystem, vilket enligt min erfarenhet var det som hindrade de flesta företag från att införa det. Och vi får ändå säkerhetsvinsten mot lateral förflyttning och domänövertagande.",[526,565,566],{},[567,568],"img",{"alt":569,"src":570},"Active Directory","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_1.png",[557,572,574],{"id":573},"det-uppnås-i-tre-steg","Det uppnås i tre steg:",[576,577,578,592,597],"ol",{},[579,580,581,582,589],"li",{},"Inför ",[583,584,588],"a",{"href":585,"rel":586},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions#switch-to-active-directory-split-permissions",[587],"nofollow","modellen för AD split permissions",[590,591],"br",{},[579,593,594,595],{},"Ge Exchange-servrarna tillbaka de förlorade AD-behörigheterna, men bara på de relevanta OU:erna",[590,596],{},[579,598,599,600],{},"Tilldela Exchange RBAC för att återaktivera de saknade PowerShell-cmdletarna",[590,601],{},[526,603,604],{},"Allt via Microsofts vägledning, AD-ACL:er eller Exchange RBAC-tilldelningar.",[557,606,608],{"id":607},"varför-bryr-vi-oss-nu","Varför bryr vi oss (nu)?",[526,610,611,612,614],{},"Det har till stor del förbisetts eller ignorerats sedan det introducerades med Exchange 2010 SP1. Men standardmodellen med delade behörigheter utgör en stor säkerhetsrisk för övertagande av Active Directory. I kombination med att Exchange under de senaste åren varit ökänt för fjärrexploatering är det dags att agera.",[590,613],{},"\nProblemet härrör från behörigheter som tilldelas på domänens rot och som ärvs genom hela domänen.",[616,617,618,621,624,627],"ul",{},[579,619,620],{},"ändra behörigheter på användare och grupper (i praktiken full åtkomst)",[579,622,623],{},"ändra gruppmedlemmar",[579,625,626],{},"återställa lösenord på användare",[579,628,629],{},"skapa/ta bort användare och grupper",[526,631,632],{},[567,633],{"alt":634,"src":635},"Permissions","https://res.cloudinary.com/c4a8/image/upload/v1770991330/blog/pics/Blog_-_Exchange_AD_Split_Permissions_-_2.png",[526,637,638],{},"Bara vissa högprivilegierade Tier0-användare och -grupper skyddas av AdminSDHolder-processen (attributet admincount=1), och i många miljöer finns det oskyddade användare eller grupper som kan möjliggöra kompromettering av domänen och/eller skogen, eller åtminstone orsaka allvarlig påverkan.",[557,640,642],{"id":641},"framträdande-exempel","Framträdande exempel:",[616,644,645,648,668],{},[579,646,647],{},"Entra Connect Sync-kontot vid användning av PWHashSync",[579,649,650,651],{},"Standardgrupper\n",[616,652,653,656,665],{},[579,654,655],{},"Allowed RODC Password Replication Group tillsammans med EntraConnect-kontot (om en riktig Windows-RODC finns)",[579,657,658,659,664],{},"Se även ",[583,660,663],{"href":661,"rel":662},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta/",[587],"Untrustworthy Trust Builders: Account Operators Replicating Trust Attack (AORTA) - SpecterOps"," som visar fler vägar (gruppen Account Operators är ett liknande hot)",[579,666,667],{},"Att tömma Protected Users för att skapa attackvektorer genom att ta bort skydd",[579,669,670,671],{},"Oskyddade anpassade grupper eller admin-/tjänstekonton\n",[616,672,673,676],{},[579,674,675],{},"Skrivbehörighet på GPO:er (som tillämpas på domänkontrollant)",[579,677,678],{},"Hantering av åtkomst till AD-säkerhetskopior, säkerhetskopieringsserver, PKI-mallar, hypervisor, ...",[526,680,681,682,684,685,690,692,693],{},"Det är mycket svårt att i efterhand begränsa alla dessa nuvarande och framtida potentiella vägar. För den anpassade _ADM-OU:n kan du inaktivera ACL-arv, men de flesta standardobjekt får inte flyttas från standard-OU:n Builtin eller containern Users och förblir sårbara.",[590,683],{},"\nDet är mycket bättre att ta bort de kraftfulla behörigheterna från roten, vilket görs genom att införa modellen Active Directory split permissions. ",[583,686,689],{"href":687,"rel":688},"https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/configure-exchange-for-split-permissions",[587],"Configure Exchange Server for split permissions | Microsoft Learn",[590,691],{},"\nOch Microsoft håller med: “…encouraged to implement Active Directory split permissions” ",[583,694,697],{"href":695,"rel":696},"https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-7-%E2%80%93-implementing-least-privilege/4366626",[587],"Active Directory Hardening Series - Part 7 – Implementing Least Privilege | Microsoft Community Hub",[699,700,702],"h2",{"id":701},"men-varför-gör-ingen-det","Men varför gör ingen det?",[526,704,705,706,708],{},"Eftersom split permissions inte fanns förrän Exchange 2010 SP1 hade alla vid det laget accepterat det, och det verkar som att säkerhetsteamen inte lyckades driva igenom det när det väl fanns.",[590,707],{},"\nOch det hade tvingat fram ändringar i admin- och IDM-processer, som att först skapa användare eller distributionslistor i AD och först därefter använda Exchange för att ”mail-aktivera” dem.",[526,710,711,712,714],{},"Cmdletar som inte längre är tillgängliga eller fungerar:",[590,713],{},[715,716,717],"code",{},"Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission ",[557,719,721],{"id":720},"anpassningsexempel","Anpassningsexempel:",[616,723,724,735],{},[579,725,726,727],{},"New-Mailbox (där Exchange skriver till AD) skulle bli:\n",[616,728,729,732],{},[579,730,731],{},"New-ADUser (där adm.jdoe skriver till AD)",[579,733,734],{},"Enable-Mailbox",[579,736,737],{},"Add-ADPermission för SendAs-rättigheter skulle behöva göras via AD-användare och -datorer på säkerhetsfliken, och kräver ofta ytterligare AD-behörigheter för standardadministratörer.",[699,739,741],{"id":740},"visa-mig-alternativet-utan-ånger","Visa mig alternativet utan ånger",[526,743,744,748],{},[745,746,747],"strong",{},"Ansvarsfriskrivning",": Läs och förstå följande länkar och artiklar fullständigt, testa först i en testmiljö och säkerställ att AD-säkerhetskopiorna är aktuella och att återställningsrutiner är etablerade.",[557,750,752],{"id":751},"granska-nuvarande-användning","Granska nuvarande användning",[526,754,755,758,760],{},[745,756,757],{},"Du bör först kontrollera vilka av de berörda cmdletarna som används på vilka OU:er.",[590,759],{},[715,761,762],{},"$CsvPath =\"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[526,764,765],{},[715,766,767],{},"$Cmdlets = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[526,769,770],{},[715,771,772],{},"Search-AdminAuditLog -ResultSize 99000 -Cmdlets $Cmdlets| select RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($_.CmdletParameters))}},succeeded,error | Export-Csv -Path $CsvPath -Delimiter \";\" -Encoding Unicode -NoTypeInformation",[526,774,775,778,780,783,786,789],{},[745,776,777],{},"Snabb analys av anropare och cmdletar:",[590,779],{},[715,781,782],{},"$CSVs=Import-Csv -Path $CsvPath -Delimiter \";\"",[715,784,785],{},"$CSVs|group Caller",[715,787,788],{},"$CSVs|group CmdletName",[715,790,791],{},"Analysera CSV-filen för att se var AD-behörigheter kommer att behövas. Optimera eventuellt genom att flytta alla Exchange-relevanta grupper till dedikerade OU:er.",[557,793,795],{"id":794},"aktivera-modellen-för-split-permissions","Aktivera modellen för split permissions",[526,797,798,805,807,808,810,813,815,818,819],{},[745,799,800,801,804],{},"Följ instruktionerna för ”Switch to Active Directory split permissions” i ",[583,802,689],{"href":585,"rel":803},[587]," (INTE RBAC split permissions)",[590,806],{},"\nI grunden tar det bort de farliga behörigheterna för gruppen ”Exchange Windows Permissions” och tar även bort Exchange som gruppmedlem.",[590,809],{},[715,811,812],{},"Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD /ActiveDirectorySplitPermissions:true",[590,814],{},[745,816,817],{},"För att återgå använder du bara:"," ",[715,820,821],{},"/ActiveDirectorySplitPermissions:false",[557,823,825],{"id":824},"tilldela-ad-behörigheter","Tilldela AD-behörigheter",[526,827,828,831,833,834,836,839,841,843],{},[745,829,830],{},"Skapa en anpassad AD-grupp och gör Exchange-servrarna till medlemmar.",[590,832],{},"\njustera OU-sökvägen först",[590,835],{},[715,837,838],{},"New-ADGroup -Name \"AD_Custom Exchange Split permissions replacement\" -GroupCategory Security -GroupScope DomainLocal -Path \"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\" -Description \"replaces the permissions lost by split permissions on relevant OUs\"",[590,840],{},[590,842],{},[715,844,845],{},"Add-ADGroupMember \"AD_Custom Exchange Split permissions replacement\" -Members \"Exchange Trusted Subsystem\"",[526,847,848,851,853],{},[745,849,850],{},"starta om Exchange-servrarna för att behörigheterna via gruppen ska fungera",[590,852],{},"\nJag har skapat ett skript som gör det enkelt att delegera AD-behörigheterna per användningsfall.",[855,856,857],"blockquote",{},[526,858,859,865,866,869],{},[745,860,861],{},[862,863,864],"em",{},"INFO:"," Utan dessa behörigheter skulle Exchange-servern få felet ",[715,867,868],{},"“INSUFF_ACCESS_RIGHTS”"," från AD.",[526,871,872,881,883],{},[745,873,874,875,880],{},"Ladda ner ",[583,876,879],{"href":877,"rel":878},"https://github.com/glueckkanja/code-snippets/blob/main/ExchangeADSplitPermission/Add-ExchangeADSplitPermissionOnOU.ps1",[587],"Add-ExchangeADSplitPermissionOnOU.ps1"," från glueckkanja GitHub",[590,882],{},"\nDet kan tilldela följande PermissionTypes:",[616,885,886,899,919,932],{},[579,887,888,891],{},[745,889,890],{},"CreateUserAndContact",[616,892,893,896],{},[579,894,895],{},"Create/delete, ResetPassword och WriteAllProperties för Users och Contacts",[579,897,898],{},"Exchange-cmdletar: New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact och motsvarande Remove-*",[579,900,901,904],{},[745,902,903],{},"GroupManage",[616,905,906,909,912],{},[579,907,908],{},"Skapa/ta bort grupper, ändra medlem",[579,910,911],{},"Exchange-cmdletar: New-DistributionGroup, Remove-DistributionGroup, Add-DistributionGroupMember, Update-DistributionGroupMember, Remove-DistributionGroupMember",[579,913,914,915],{},"Ytterligare användningsfall: användare som hanterar DistributionGroups de äger via https://",[916,917,918],"on-prem-exchange",{},"/EAC",[579,920,921,924],{},[745,922,923],{},"UserSendAs",[616,925,926,929],{},[579,927,928],{},"Ändra AD-behörigheter på Users",[579,930,931],{},"Exchange-cmdlet: Add-ADPermission",[579,933,934,937],{},[745,935,936],{},"GroupSendAs",[616,938,939,942],{},[579,940,941],{},"Ändra AD-behörigheter på Groups",[579,943,931],{},[557,945,947],{"id":946},"så-använder-du-skriptet","Så använder du skriptet:",[526,949,950],{},[715,951,952,818,955,818,961,818,964,818,969],{},[715,953,954],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU",[956,957,958],"b",{},[715,959,960],{},"\u003COU>",[715,962,963],{},"-PermissionType",[956,965,966],{},[715,967,968],{},"\u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact>",[715,970,971],{},"-Trustee \"AD_Custom Exchange Split permissions replacement",[526,973,974,975,977],{},"t.ex.",[590,976],{},[715,978,979,818,982,818,986],{},[715,980,981],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[956,983,984],{},[715,985,903],{},[715,987,988],{},"-Trustee \"AD_Custom Exchange Split permissions replacement\"",[526,990,991],{},[715,992,993,818,995,818,999],{},[715,994,981],{},[956,996,997],{},[715,998,936],{},[715,1000,988],{},[526,1002,1003],{},[715,1004,1005,818,1008,818,1012],{},[715,1006,1007],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType",[956,1009,1010],{},[715,1011,923],{},[715,1013,988],{},[526,1015,1016],{},[715,1017,1018],{},[715,1019,1020],{},"Add-ExchangeADSplitPermissionOnOU.ps1 -TargetOU \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" -PermissionType CreateUserAndContact -Trustee \"AD_Custom Exchange Split permissions replacement\"",[557,1022,1024],{"id":1023},"tilldela-exchange-rbac","Tilldela Exchange RBAC",[526,1026,1027,1030,1032],{},[745,1028,1029],{},"Återaktivera parametern -BypassSecurityGroupManagerCheck för cmdletarna Add-DistributionGroupMember och Remove-DistributionGroupMember:",[590,1031],{},[715,1033,1034],{},"New-RoleGroup -Name \"SplitPermission Security Group Creation and Membership\" -Roles \"Security Group Creation and Membership\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\" ",[855,1036,1037],{},[526,1038,1039,818,1043,1045],{},[745,1040,1041],{},[862,1042,864],{},[590,1044],{},"Annars får du \"-BypassSecurityGroupManagerCheck parameter is not available\" eller \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1047,1048,1050,1053,1055],{},[590,1049],{},[745,1051,1052],{},"Återaktivera cmdletarna New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... med nödvändiga parametrar:",[590,1054],{},[715,1056,1057],{},"New-RoleGroup -Name \"SplitPermission Mail Recipient Creation\" -Roles \"Mail Recipient Creation\" -Members \"Organization Management\",\"Recipient Management\" -Description \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[699,1059,1061],{"id":1060},"slutsatser","Slutsatser",[526,1063,1064],{},"Jag hoppas att den här vägledningen får många fler att ta detta viktiga steg för att skydda sin Active Directory från kompromettering via Exchange. Jag har ännu inte stött på problem när jag har infört modellen Exchange AD split permissions och anpassningen från den här artikeln hos våra kunder.",[526,1066,1067],{},"Jag hoppas att Microsoft inför ett inbyggt sätt att uppnå denna granulära OU-baserade metod, i stället för dagens allt-eller-inget, så att den kan få bred spridning.",[526,1069,1070,1071,1076,1077,1082],{},"Eftersom AD Tiering ligger mig varmt om hjärtat: logga dessutom inte in på Exchange-servrar med Domain Admin-konton (eller något Tier0-konto), utan behandla dem som Tier1 från och med nu och inför AD Tiering så snart som möjligt.\nSom ett första steg rekommenderar jag verktyg som ",[583,1072,1075],{"href":1073,"rel":1074},"https://www.pingcastle.com/",[587],"PingCastle"," eller ",[583,1078,1081],{"href":1079,"rel":1080},"https://www.semperis.com/purple-knight/",[587],"Purple Knight"," för att utvärdera din AD-säkerhet och dina Control Paths.",[1084,1085,1086],"style",{},"\ncode {\n  font-size: inherit\n}\n",{"title":530,"searchDepth":531,"depth":531,"links":1088},[1089,1091,1092,1093,1094,1097,1104],{"id":559,"depth":1090,"text":560},3,{"id":573,"depth":1090,"text":574},{"id":607,"depth":1090,"text":608},{"id":641,"depth":1090,"text":642},{"id":701,"depth":531,"text":702,"children":1095},[1096],{"id":720,"depth":1090,"text":721},{"id":740,"depth":531,"text":741,"children":1098},[1099,1100,1101,1102,1103],{"id":751,"depth":1090,"text":752},{"id":794,"depth":1090,"text":795},{"id":824,"depth":1090,"text":825},{"id":946,"depth":1090,"text":947},{"id":1023,"depth":1090,"text":1024},{"id":1060,"depth":531,"text":1061},"post",{"lang":1107,"seoTitle":1108,"titleClass":1109,"date":1110,"blogtitlepic":1111,"socialimg":1112,"customExcerpt":1113,"keywords":1114,"scripts":1115,"asideNav":1116,"maxContent":325,"published":484},"sv","Exchange AD Split Permissions: Säkra Active Directory med Least Privilege","h2-font-size","2026-01-27","head-vulnerability-management","/blog/heads/head-vulnerability-management.jpg","On-Premises Exchange Server-installationer är fortfarande vanliga även hos organisationer som har flyttat alla postlådor till molnet. De är dessutom fortfarande mycket kraftfulla inom Active Directory, så oftast finns det en stark attackväg för att kompromettera hela AD och därmed vanligtvis stora delar av företagets IT. Att byta till de så kallade ”AD Split permissions” tar bort de kritiska behörigheterna, och jag har konstruerat en lösning som eliminerar de nackdelar som vanligtvis hindrade införandet.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange-behörigheter, AdminSDHolder, least privilege, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1117},[1118,1120,1122,1124,1126],{"href":1119,"text":560},"#tldr-tänk-om-vi-tar-bort-nackdelarna",{"href":1121,"text":608},"#varför-bryr-vi-oss-nu",{"href":1123,"text":702},"#men-varför-gör-ingen-det",{"href":1125,"text":741},"#visa-mig-alternativet-utan-ånger",{"href":1127,"text":1061},"#slutsatser","/posts/2026-01-27-exchange-active-directory",{"title":552,"description":530},"posts/2026-01-27-exchange-active-directory","o4z2Lqc4u8R8IPyVE3c0V8l4b1xqgH4Y9YxLHBb76YI",{"id":1133,"title":552,"author":1134,"body":1135,"cta":494,"description":530,"eventid":494,"extension":533,"hideInRecent":484,"layout":1105,"meta":1740,"moment":1741,"navigation":325,"path":1754,"seo":1755,"stem":1756,"tags":494,"webcast":484,"__hash__":1757},"content_sv/posts/2026-03-01-exchange-ad-split-permissions-hardening.md",[521],{"type":523,"value":1136,"toc":1727},[1137,1139,1142,1146,1151,1166,1168,1175,1180,1182,1190,1200,1204,1207,1211,1243,1261,1263,1271,1279,1284,1298,1300,1306,1308,1313,1373,1378,1415,1417,1421,1435,1442,1458,1467,1469,1471,1517,1520,1527,1532,1535,1549,1565,1576,1586,1591,1649,1651,1656,1676,1683,1707,1709,1712,1715,1725],[699,1138,560],{"id":559},[526,1140,1141],{},"Jag hittade ett sätt att återtilldela AD- och RBAC-behörigheter direkt där Exchange-användare, grupper och kontakter ligger, utan att kräva några ändringar för administratörer eller identity management-system. Enligt min erfarenhet har just den friktionen varit det främsta hindret för de flesta företag. Och vi behåller ändå säkerhetsvinsterna mot lateral förflyttning och kompromettering av domänen.",[526,1143,1144],{},[567,1145],{"alt":569,"src":570},[526,1147,1148],{},[745,1149,1150],{},"Det görs i tre steg:",[576,1152,1154,1160,1163],{"style":1153},"margin: 0.25rem 0",[579,1155,1156,1157],{},"Implementera ",[583,1158,1159],{"href":585},"modellen AD split permissions",[579,1161,1162],{},"Ge Exchange-servrarna de förlorade AD-behörigheterna, men bara på de relevanta OU:erna",[579,1164,1165],{},"Tilldela Exchange RBAC för att återaktivera saknade PowerShell-cmdlets",[526,1167,604],{},[1169,1170],"video-frame",{"thumb":1171,"alt":1172,"id":1173,":full-width":1174},"/thumbs/thumb-exchange-ad-split-permissions-webcast.jpg","A presenter sits in front of a laptop explaining a slide titled Step 1: Active Directory Permissions by glueckkanja. The slide covers how to implement Microsoft Exchange AD Split Permissions, including PowerShell commands for creating a delegation group (New-ADGroup, Add-ADGroupMember) and applying permissions via the script Add-ExchangeADSplitPermissionOnOU.ps1.","soNZkNRopSQ","true",[1176,1177,1179],"div",{"style":1178},"background:var(--color-gk-light-grey); margin-top:0.5rem; padding:0.5rem 1rem; font-size:0.85rem; color:var(--color-gk-dark-blue)","Webcast: Exchange AD Split Permissions utan ånger. En steg-för-steg-guide för implementeringen",[699,1181,608],{"id":607},[526,1183,1184,1185,1187,1189],{},"Den har till stor del förbisetts eller ignorerats sedan den introducerades med Exchange 2010 SP1. Men standardmodellen med delade behörigheter (shared permissions) utgör en stor säkerhetsrisk för övertagande av Active Directory. Kombinerat med att Exchange varit ökänt för fjärrexploits de senaste åren är det dags att agera.",[590,1186],{},[590,1188],{},"\nProblemet härrör från behörigheter som tilldelas domänens rot och som ärvs genom hela domänen.",[616,1191,1192,1194,1196,1198],{"style":1153},[579,1193,620],{},[579,1195,623],{},[579,1197,626],{},[579,1199,629],{},[526,1201,1202],{},[567,1203],{"alt":634,"src":635},[526,1205,1206],{},"Endast vissa högprivilegierade Tier 0-användare och grupper skyddas av AdminSDHolder-processen (attributet admincount=1), och i många miljöer finns oskyddade användare eller grupper som kan möjliggöra kompromettering av domänen och/eller skogen, eller åtminstone orsaka allvarlig påverkan.",[526,1208,1209],{},[745,1210,642],{},[616,1212,1213,1216,1233],{"style":1153},[579,1214,1215],{},"Entra Connect Sync-konto vid användning av Password Hash Sync",[579,1217,1218,1219],{},"Standardgrupper",[616,1220,1222,1225,1230],{"style":1221},"margin: 0",[579,1223,1224],{},"Allowed RODC Password Replication Group tillsammans med Entra Connect-konto (om en riktig Windows-RODC finns)",[579,1226,658,1227,664],{},[583,1228,663],{"href":1229,"target":330},"https://specterops.io/blog/2025/06/25/untrustworthy-trust-builders-account-operators-replicating-trust-attack-aorta",[579,1231,1232],{},"Att tömma Protected Users för att skapa attackvägar genom att ta bort skydd",[579,1234,1235,1236],{},"Oskyddade anpassade grupper eller admin-/tjänstekonton",[616,1237,1238,1240],{"style":1221},[579,1239,675],{},[579,1241,1242],{},"Hantera åtkomst till AD-backuper, backupserver, PKI-mallar, hypervisor, ...",[526,1244,1245,1246,1248,1250,1251,1254,1256,692,1258],{},"Det är mycket svårt att i efterhand begränsa alla dessa nuvarande och framtida potentiella vägar. För den anpassade _ADM-OU:n kan du inaktivera ACL-arv, men de flesta standardobjekt kan inte flyttas från standard-OU:n Builtin eller containern Users och förblir sårbara.",[590,1247],{},[590,1249],{},"\nDet är mycket bättre att ta bort de kraftfulla behörigheterna från roten, vilket görs genom att implementera modellen Active Directory split permissions. ",[583,1252,689],{"href":687,"rel":1253},[587],[590,1255],{},[590,1257],{},[583,1259,697],{"href":695,"rel":1260},[587],[699,1262,702],{"id":701},[526,1264,1265,1266,1268,1270],{},"Eftersom split permissions inte fanns förrän Exchange 2010 SP1 hade alla accepterat läget vid det laget, och det verkar som att säkerhetsteamen inte lyckades driva igenom det när det väl fanns.",[590,1267],{},[590,1269],{},"\nOch det hade tvingat fram ändringar i admin- och IDM-processer, som att först skapa användare eller distributionslistor i AD och först därefter använda Exchange för att “mail-aktivera” dem.",[855,1272,1273],{},[526,1274,1275,1278],{},[745,1276,1277],{},"Info:"," Följande cmdlets kommer inte längre att vara tillgängliga eller fungera: Add-DistributionGroupMember, New-DistributionGroup, New-Mailbox, New-MailContact, New-MailUser, New-RemoteMailbox, Remove-DistributionGroup, Remove-DistributionGroupMember, Remove-Mailbox, Remove-MailContact, Remove-MailUser, Remove-RemoteMailbox, Update-DistributionGroupMember, Add-ADPermission, Remove-ADPermission",[526,1280,1281],{},[745,1282,1283],{},"Exempel på anpassning:",[616,1285,1286,1295],{"style":1153},[579,1287,1288,1289],{},"New-Mailbox (där Exchange skriver till AD) skulle bli:",[616,1290,1291,1293],{"style":1221},[579,1292,731],{},[579,1294,734],{},[579,1296,1297],{},"Add-ADPermission för SendAs-rättigheter skulle behöva göras via AD Users and Computers på säkerhetsfliken och kräver ofta ytterligare AD-behörigheter för vanliga administratörer.",[699,1299,741],{"id":740},[526,1301,1302,1305],{},[745,1303,1304],{},"Disclaimer",": Läs och förstå följande länkar och artiklar fullständigt, gör det i en testmiljö först, se till att AD-backuperna är aktuella och att rutiner för återställning finns på plats.",[557,1307,752],{"id":751},[526,1309,1310],{},[745,1311,1312],{},"Du bör först kontrollera vilka av de berörda cmdlets som används på vilka OU:er:",[1314,1315,1316,1324,1326,1332,1334],"code-block",{},[1317,1318,1319,1323],"span",{},[1317,1320,1322],{"style":1321},"color:var(--color-gk-orange)","$CsvPath"," = \"C:\\temp\\SplitPermissionAdminAuditLog.csv\"",[590,1325],{},[1317,1327,1328,1331],{},[1317,1329,1330],{"style":1321},"$Cmdlets"," = \"Add-ADPermission\",\"Remove-ADPermission\",\"New-DistributionGroup\",\"Remove-DistributionGroup\",\"Add-DistributionGroupMember\",\"Update-DistributionGroupMember\",\"Remove-DistributionGroupMember\",\"New-Mailbox\",\"Remove-Mailbox\",\"New-RemoteMailbox\",\"Remove-RemoteMailbox\",\"New-MailUser\",\"Remove-MailUser\",\"New-MailContact\",\"Remove-MailContact\"",[590,1333],{},[1317,1335,1336,818,1339,1343,1344,818,1347,1349,1350,1353,1354,818,1357,818,1360,818,1362,1365,1366,1369,1370],{},[1317,1337,1338],{"style":1321},"Search-AdminAuditLog",[1317,1340,1342],{"style":1341},"color:var(--color-gk-mid-blue)","-ResultSize"," 99000 ",[1317,1345,1346],{"style":1341},"-Cmdlets",[1317,1348,1330],{"style":1321}," | ",[1317,1351,1352],{"style":1321},"Select-Object"," RunDate,Caller,ObjectModified,CmdletName,@{Name='CmdletParameters';Expression={[string]::join(\",\", ($\\_.CmdletParameters))}},succeeded,error | ",[1317,1355,1356],{"style":1321},"Export-Csv",[1317,1358,1359],{"style":1341},"-Path",[1317,1361,1322],{"style":1321},[1317,1363,1364],{"style":1341},"-Delimiter"," \";\" ",[1317,1367,1368],{"style":1341},"-Encoding"," Unicode ",[1317,1371,1372],{"style":1341},"-NoTypeInformation",[526,1374,1375],{},[745,1376,1377],{},"Snabbanalys av anropare och cmdlets:",[1314,1379,1380,1396,1398,1406,1408],{},[1317,1381,1382,1385,1386,818,1389,818,1391,818,1393,1395],{},[1317,1383,1384],{"style":1321},"$CSVs"," = ",[1317,1387,1388],{"style":1321},"Import-Csv",[1317,1390,1359],{"style":1341},[1317,1392,1322],{"style":1321},[1317,1394,1364],{"style":1341}," \";\"",[590,1397],{},[1317,1399,1400,1349,1402,1405],{},[1317,1401,1384],{"style":1321},[1317,1403,1404],{"style":1321},"Group-Object"," Caller",[590,1407],{},[1317,1409,1410,1349,1412,1414],{},[1317,1411,1384],{"style":1321},[1317,1413,1404],{"style":1321}," CmdletName",[526,1416,791],{},[699,1418,1420],{"id":1419},"aktivera-modellen-split-permissions","Aktivera modellen Split Permissions",[526,1422,1423,1424,1427,1428,1432],{},"Följ Microsofts instruktioner ",[745,1425,1426],{},"\"Switch to Active Directory split permissions\""," i\n",[583,1429,689],{"href":1430,"rel":1431},"https://learn.microsoft.com/en-us/exchange/configure-exchange-server-for-split-permissions",[587],[862,1433,1434],{},"(INTE RBAC split permissions)",[526,1436,1437,1438,1441],{},"I praktiken tar det bort de farliga behörigheterna för gruppen ",[745,1439,1440],{},"\"Exchange Windows Permissions\""," och tar även bort Exchange som gruppmedlem.",[1314,1443,1444],{},[1317,1445,1446,818,1449,818,1452,818,1455],{},[1317,1447,1448],{"style":1321},"Setup.exe",[1317,1450,1451],{"style":1341},"/IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF",[1317,1453,1454],{"style":1341},"/PrepareAD",[1317,1456,1457],{"style":1341},"/ActiveDirectorySplitPermissions:true",[1176,1459,1461,1462,1464,1465],{"style":1460},"background:#f4f4f4; border-left:4px solid var(--color-gk-petrol); border-radius:0 6px 6px 0; padding:0.75rem 1rem; margin:1rem 0; font-size:0.88rem; color:#000520;","\n  ",[745,1463,1277],{}," För att återgå, använd helt enkelt ",[715,1466,821],{},[557,1468,825],{"id":824},[526,1470,830],{},[1314,1472,1473,1479,1481,818,1484,1487,1488,1491,1492,1495,1496,818,1498,818,1501,1504,1505,1507,1487,1510,1513,1514],{},[1317,1474,1475],{},[1317,1476,1478],{"style":1477},"color:var(--color-black-40)","# adjust OU Path first!",[590,1480],{},[1317,1482,1483],{"style":1321},"New-ADGroup",[1317,1485,1486],{"style":1341},"-Name"," \"AD_Custom Exchange Split permissions replacement\" ",[1317,1489,1490],{"style":1341},"-GroupCategory"," Security ",[1317,1493,1494],{"style":1341},"-GroupScope"," DomainLocal ",[1317,1497,1359],{"style":1341},[745,1499,1500],{},"\"OU=Rights,OU=Groups,OU=T1,OU=_ADM,$((Get-ADDomain).DistinguishedName)\"",[1317,1502,1503],{"style":1341},"-Description"," \"replaces the permissions lost by split permissions on relevant OUs\"",[590,1506],{},[1317,1508,1509],{"style":1321},"Add-ADGroupMember",[1317,1511,1512],{"style":1341},"-Members"," \"Exchange Trusted Subsystem\"\n",[1317,1515,1516],{"style":1477},"# reboot Exchange servers for permissions via group to work",[526,1518,1519],{},"Jag har skapat ett skript som gör det enkelt att delegera AD-behörigheterna per användningsfall.",[855,1521,1522],{},[526,1523,1524,1525,869],{},"Utan dessa behörigheter skulle Exchange-servern få felet ",[715,1526,868],{},[526,1528,874,1529,880],{},[583,1530,879],{"href":877,"rel":1531},[587],[526,1533,1534],{},"Det kan tilldela följande PermissionTypes:",[526,1536,1538,1540,1542,1543,1545],{"style":1537},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8;",[745,1539,890],{},[590,1541],{},"Skapa/ta bort, ResetPassword och WriteAllProperties för Users och Contacts",[590,1544],{},[1546,1547,1548],"small",{},"Exchange-cmdlets: `New-Mailbox`, `New-RemoteMailbox`, `New-MailUser`, `New-MailContact` och matchande `Remove-*`",[526,1550,1552,1554,1556,1557,1559],{"style":1551},"background:#f5f5f5;padding:0.5rem 1rem;margin:0.25rem 0;border-left:3px solid #d8d8d8",[745,1553,903],{},[590,1555],{},"Skapa/ta bort Groups, ändra Member",[590,1558],{},[1546,1560,1561,1562,1564],{},"Exchange-cmdlets: `New-DistributionGroup`, `Remove-DistributionGroup`, `Add-DistributionGroupMember`, `Update-DistributionGroupMember`, `Remove-DistributionGroupMember`",[590,1563],{},"Även: användare som hanterar DistributionGroups de äger via EAC",[526,1566,1567,1569,928,1571,1573],{"style":1551},[745,1568,923],{},[590,1570],{},[590,1572],{},[1546,1574,1575],{},"Exchange-cmdlet: `Add-ADPermission`",[526,1577,1578,1580,941,1582,1584],{"style":1551},[745,1579,936],{},[590,1581],{},[590,1583],{},[1546,1585,1575],{},[526,1587,1588],{},[745,1589,1590],{},"Så här använder du skriptet:",[1314,1592,1593,818,1595,1598,1599,1601,1602,1605,1606,1609,1611,818,1613,1615,1616,1618,1619,1605,1621,818,1623,1615,1625,1627,1628,1605,1630,818,1632,1634,1635,1637,1638,1605,1640,818,1642,1634,1644,1646,1647,1605],{},[1317,1594,879],{"style":1321},[1317,1596,1597],{"style":1341},"-TargetOU"," \u003COU> ",[1317,1600,963],{"style":1341}," \u003CGroupManage|UserSendAs|GroupSendAs|CreateUserAndContact> ",[1317,1603,1604],{"style":1341},"-Trustee"," \"AD_Custom Exchange Split permissions replacement\"\n",[1317,1607,1608],{"style":1477},"# For example",[590,1610],{},[1317,1612,879],{"style":1321},[1317,1614,1597],{"style":1341}," \"OU=ExchangeGroups,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1317,1617,963],{"style":1341}," GroupManage ",[1317,1620,1604],{"style":1341},[1317,1622,879],{"style":1321},[1317,1624,1597],{"style":1341},[1317,1626,963],{"style":1341}," GroupSendAs ",[1317,1629,1604],{"style":1341},[1317,1631,879],{"style":1321},[1317,1633,1597],{"style":1341}," \"OU=Users,OU=HQ,OU=Alderaan,$((Get-ADDomain).DistinguishedName)\" ",[1317,1636,963],{"style":1341}," UserSendAs ",[1317,1639,1604],{"style":1341},[1317,1641,879],{"style":1321},[1317,1643,1597],{"style":1341},[1317,1645,963],{"style":1341}," CreateUserAndContact ",[1317,1648,1604],{"style":1341},[557,1650,1024],{"id":1023},[526,1652,1653],{},[745,1654,1655],{},"Återaktivera parametern -BypassSecurityGroupManagerCheck för cmdlets Add-DistributionGroupMember och Remove-DistributionGroupMember:",[1314,1657,1658],{},[1317,1659,1660,818,1663,1665,1666,1669,1670,1672,1673,1675],{},[1317,1661,1662],{"style":1321},"New-RoleGroup",[1317,1664,1486],{"style":1341}," \"SplitPermission Security Group Creation and Membership\" ",[1317,1667,1668],{"style":1341},"-Roles"," \"Security Group Creation and Membership\" ",[1317,1671,1512],{"style":1341}," \"Organization Management\",\"Recipient Management\" ",[1317,1674,1503],{"style":1341}," \"Brings back -BypassSecurityGroupManagerCheck to Add-DistributionGroupMember, but also needs AD ACL for Exchange Server on target DLs\"",[855,1677,1678],{},[526,1679,1680,1682],{},[745,1681,1277],{}," Annars får du \"-BypassSecurityGroupManagerCheck parameter is not available\" eller \"You don't have sufficient permissions. This operation can only be performed by a manager of the group\"",[526,1684,1685,1687,1690,1692],{},[590,1686],{},[745,1688,1689],{},"Återaktivera cmdlets New-Mailbox, New-RemoteMailbox, New-MailContact, Remove-... med nödvändiga parametrar:",[590,1691],{},[1314,1693,1694,818,1696,1698,1699,1701,1702,1672,1704,1706],{},[1317,1695,1662],{"style":1321},[1317,1697,1486],{"style":1341}," \"SplitPermission Mail Recipient Creation\" ",[1317,1700,1668],{"style":1341}," \"Mail Recipient Creation\" ",[1317,1703,1512],{"style":1341},[1317,1705,1503],{"style":1341}," \"Brings back New-Mailbox, New-RemoteMailbox, New-MailUser, New-MailContact and matching Remove-... cmdlets, but additionally Exchange needs AD ACL for Exchange Server on target OUs\"",[699,1708,1061],{"id":1060},[526,1710,1711],{},"Jag hoppas att den här guiden hjälper fler organisationer att ta det viktiga steget att säkra sin Active Directory mot kompromettering via Exchange. Utifrån min erfarenhet av att implementera modellen Exchange AD Split Permissions hos flera kunder har jag inte stött på några problem, och införandet har gått smidigt.",[526,1713,1714],{},"Jag hoppas också att Microsoft inför ett inbyggt, OU-baserat sätt att uppnå den här granulariteten, i stället för dagens allt-eller-inget-modell, vilket skulle göra en bred adoption betydligt enklare.",[526,1716,1717,1718,1076,1721,1724],{},"En kommentar om AD Tiering: Logga inte in på Exchange-servrar med Domain Admin eller något annat Tier 0-konto. Behandla Exchange-servrar som Tier 1 och implementera AD Tiering så snart som möjligt. Som ett första steg rekommenderar jag att du använder ",[583,1719,1075],{"href":1073,"rel":1720},[587],[583,1722,1081],{"href":1079,"rel":1723},[587]," för att bedöma din AD-säkerhet och identifiera exponerade kontrollvägar.",[1084,1726,1086],{},{"title":530,"searchDepth":531,"depth":531,"links":1728},[1729,1730,1731,1732,1735,1739],{"id":559,"depth":531,"text":560},{"id":607,"depth":531,"text":608},{"id":701,"depth":531,"text":702},{"id":740,"depth":531,"text":741,"children":1733},[1734],{"id":751,"depth":1090,"text":752},{"id":1419,"depth":531,"text":1420,"children":1736},[1737,1738],{"id":824,"depth":1090,"text":825},{"id":1023,"depth":1090,"text":1024},{"id":1060,"depth":531,"text":1061},{"lang":1107,"seoTitle":1108,"titleClass":1109,"date":1741,"blogtitlepic":1742,"socialimg":1743,"customExcerpt":1744,"keywords":1745,"scripts":1746,"asideNav":1747,"maxContent":325,"published":325},"2026-03-01","head-exchange-ad-split-permissions","/blog/heads/head-exchange-ad-split-permissions.jpg","Även organisationer som helt har migrerat sina postlådor till molnet kör ofta fortfarande Exchange-servrar on-premises, och med dem en underskattad säkerhetsrisk för Active Directory. Modellen \"AD Split Permissions\" fråntar Exchange de breda AD-behörigheter som angripare kan utnyttja för att kompromettera hela domänen. Hittills har införandet till stor del misslyckats på grund av de processförändringar det tvingar på administratörer. Den här artikeln visar hur du elegant tar dig förbi just det hindret: ett skript som selektivt återtilldelar de förlorade AD-behörigheterna enbart på de relevanta OU:erna, bevarar det välkända admin-arbetsflödet och ändå uppnår hela säkerhetsvinsten.","Exchange Server, Active Directory, AD split permissions, RBAC, Exchange-behörigheter, AdminSDHolder, minsta behörighet, AD ACL, PowerShell",{"slick":325,"form":325},{"menuItems":1748},[1749,1750,1751,1752,1753],{"href":1119,"text":560},{"href":1121,"text":608},{"href":1123,"text":702},{"href":1125,"text":741},{"href":1127,"text":1061},"/posts/2026-03-01-exchange-ad-split-permissions-hardening",{"title":552,"description":530},"posts/2026-03-01-exchange-ad-split-permissions-hardening","tJPnJjrIY4KJOkuHkoBms10oqMjJ2QrhC-Po6AT1Cpw",[],{"id":1760,"extension":1761,"meta":1762,"stem":8,"__hash__":1769},"authors_data/authors.json","json",{"Thorsten Kunzi":1763},{"display_name":521,"avatar":1764,"permalink":1765,"twitter":1766,"linkedin":1767,"imageOffsetTop":1768},"people/author-thorsten-kunzi.png","/authors/thorsten-kunzi","glueckkanjagab","company/glueckkanja-gab","72%","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",1791383993625]