Decide what the review covers.
Write down the domain, account population, selected groups, collection time, purpose, reviewer and due date. A user/group-membership review does not automatically cover every permission, application or system an account can reach.
Agree on the evidence and decision process with the people responsible for the review. Keep this scope beside the eventual report so its boundaries remain visible.
Check the evidence before the flags.
Use an authorized collection method. Check collection errors, unreadable properties, unresolved references and what the method excludes before treating the output as a complete starting list.
For each important row, consider account state, account age, recorded activity and relevant group relationships. A selected administrative group is only part of the privilege picture. Group membership alone does not calculate every effective permission.
Replicated timestamps can lag, and a missing value is not proof of never logging on. Service and emergency accounts need their owner's explanation. Do not turn an indicator into an automatic removal decision.
Give each decision a person and a reason.
Use the blank worksheet for a scoped review. Fill it with authorized evidence held within your organization. The blank file contains no accounts or suggested decisions.
- Owner: who can explain why the account or relationship is needed.
- Reviewer: who actually evaluated the row.
- Decision and reason: what should happen and the context supporting it.
- Date and reference: when the decision was recorded and where approval or follow-up is tracked.
If a decision cannot be made, record the question and route it to the responsible person. A completed checkbox without the underlying review does not establish that access was appropriate.
Keep a decision separate from a completed change.
A worksheet saying "remove" is not evidence that removal happened. Make approved changes through your normal administrative process, retain the approval and change reference, and verify the result afterward.
Our blank worksheet includes separate action status, completion date and verification-reference fields for this follow-up. Those extra tracking fields are a manual template aid; the pilot's generated worksheet does not automate change tracking.
Preserve the starting evidence and the review record.
Keep the original collected package intact and edit a separate working copy. Retain the final decisions, approvals, change records and any verification evidence under your organization's rules.
Protect directory information with appropriate access controls. A file hash can help compare a file to a preserved reference; it does not authenticate an unsigned manifest or prove that the collection was accurate.
A current snapshot also cannot prove what access existed during an earlier review. Record gaps honestly rather than reconstructing missing history as if it were observed.
Make the next review easier to start.
The checklist is a blank preparation and follow-up record. The worksheet has headers only; enter one review item per row and keep supporting evidence separately. Use your own decision vocabulary and required approvals.
CSV files open in spreadsheet software. Save a working copy under your organization's access rules. Do not upload a completed sheet to this website.
Technical reference: Microsoft's lastLogonTimestamp attribute documentation explains that the value updates according to a synchronization interval. Review indicators still need account and business context.
See the reporting format we're building.
AD Access Review's v0.2.0 internal pilot brings account and group information into a local reporting package. The original full pilot package has passed an isolated AD lab test as an ordinary reader. Broader validation and independent feedback remain open, and the toolkit is not publicly released.
Explore the fictional sample →