Collected counts describe returned objects only. Complete means the requested queries and modeled relationships completed within the stated scope; it does not mean the domain is secure, all privileges were found, or an audit requirement is satisfied. Partial or Failed requires reviewing the issues below.
Where to start
Recommended actions
Suggested review steps based on this snapshot. Confirm the context with account owners before making changes. Accounts can appear in more than one item.
- 2 accounts
Confirm administrative memberships
Confirm each account owner and whether the account still needs membership in the selected administrative groups. Check direct, nested and primary relationships.
Review administrative memberships - 3 accounts
Review potential inactivity
Ask owners whether these accounts are still used. Check service-account use, emergency access and documented exceptions before proposing changes.
Review inactivity candidates - 1 account
Review password-expiry exceptions
These enabled accounts have passwords set to never expire. Confirm the owner and documented need for this setting, especially for service accounts.
Review password-expiry exceptions - 1 account
Confirm disabled-account retention
Confirm each account owner and whether the disabled account still needs to be retained. Keep accounts required by your retention, recovery or review process; do not delete them based on this report alone.
Review disabled accounts
Collection scope and limitations
- Tool version
- 0.2.8 · Pilot build
- Server
- dc01.demo.example (synthetic)
- Domain search base
- DC=demo,DC=example
- Started / completed UTC
- /
- Inactivity settings
- 90 days + 14 days effective grace. Candidate cutoff:
One domain, AD user objects, and collected group relationships. Includes primary-group membership and nested paths through collected groups. Selected privileged paths require security groups at every hop. This is a membership review, not an effective-permissions calculation.
Does not evaluate computers, managed service accounts, foreign principals, other domains, SID history, ACL delegation, local administrators, GPO effects, Entra ID, Microsoft 365, MFA, or application access. Cross-domain links cannot be expanded. Attribute-level permission restrictions may be silent.
lastLogonTimestamp is replicated approximately and can be delayed. A missing value is not proof of never logging on. Inactivity, password settings, and adminCount are review indicators, not automatic findings. Collection is not transactionally consistent; the directory can change between queries.
Data collected
These are collected records, not a count of problems.
- Domain informationCollected
- User accounts8 collected
- Groups13 collected
Technical details
Collection commands and login-date settings for troubleshooting.
- Login-date update interval
- 14 days
- Timestamp signal usable
- True
Query outcomes
| Query | Status | Count |
|---|---|---|
| Get-ADDomain (synthetic) | Collected | 1 |
| Get-ADForest (synthetic) | Collected | 1 |
| Domain timestamp interval (synthetic) | Collected | 1 |
| Get-ADUser (synthetic) | Collected | 8 |
| Get-ADGroup (synthetic) | Collected | 13 |
Accounts with administrative group membership
Review whether these accounts still need membership in the selected administrative groups. Membership may be direct, inherited through another group (Nested), or assigned as the account's primary group (Primary).
This shows collected group membership, not a calculation of what each account can actually do. An empty list does not prove that no administrative access exists.
| Account | Group | Membership type | Nesting depth | Membership path |
|---|---|---|---|---|
| alex.admin | Domain Admins | Nested | 1 | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| primary.admin | Domain Admins | Primary | 0 | CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
Groups checked
These are the selected groups included in this review. Collected means the group information was retrieved; it does not mean its membership is safe or approved. Forest-wide administrative groups are included only when reviewing the forest's root domain.
| Group | Status |
|---|---|
| Domain Admins | Collected |
| Group Policy Creator Owners | Collected |
| Administrators | Collected |
| Account Operators | Collected |
| Server Operators | Collected |
| Print Operators | Collected |
| Backup Operators | Collected |
| Schema Admins | Collected |
| Enterprise Admins | Collected |
Account review
Flags prioritize human review. Service accounts, emergency accounts, and legitimate exceptions require their owner's context. No account is automatically changed or recommended for removal.
Select an account name to see its details, or an admin group to see its collected users.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| blair | Blair Chen | Enabled | Within review window | ||
| casey.old | Casey Morgan | Enabled | Old replicated timestamp | Inactivity review candidate | |
| devon.new | Devon Patel | Enabled | No recorded logon; recent account | ||
| former.user | Jordan Taylor | Disabled | Old replicated timestamp | ||
| never.recorded | Robin Lee | Enabled | No recorded logon; older account | Inactivity review candidate | |
| primary.admin | Sam Ellis | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
Enabled users
7 enabled user accounts within the returned snapshot. Check collection status and coverage before relying on these results.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| blair | Blair Chen | Enabled | Within review window | ||
| casey.old | Casey Morgan | Enabled | Old replicated timestamp | Inactivity review candidate | |
| devon.new | Devon Patel | Enabled | No recorded logon; recent account | ||
| never.recorded | Robin Lee | Enabled | No recorded logon; older account | Inactivity review candidate | |
| primary.admin | Sam Ellis | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
Inactivity review candidates
3 candidates within the returned snapshot. These indicators require owner context; they are not instructions to disable an account.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| casey.old | Casey Morgan | Enabled | Old replicated timestamp | Inactivity review candidate | |
| never.recorded | Robin Lee | Enabled | No recorded logon; older account | Inactivity review candidate | |
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
Scan issues
No scan issues were detected.
Technical details
These are recorded scan diagnostics within the stated scope. No detected issues does not establish that the directory is secure or that all access was reviewed. Review collection status and scope.
No detailed issue records were returned. Check the collection status, query outcomes and scope if a warning is shown above.
Unexpanded group references: 0. See unexpanded-members.csv. Unreadable attributes cannot always be distinguished from unset attributes.
Complete the review
Start with a separate worksheet copy. Keep all generated evidence files unchanged; edit only a working copy outside the original evidence folder.
- Check the coverage, selected groups, and collection issues.
- Use the supplied Test-EvidencePackage.ps1 checker to verify the original evidence before editing any files.
- Make a separate copy of reviewer-worksheet.csv in an approved review folder outside the original evidence folder.
- Open only the copy and assign a reviewer and owner. Record a decision, reason, UTC date, and ticket reference for each account. Confirm exceptions and potential inactivity with the owner.
- Retain the completed worksheet and approvals separately. Handle any approved changes through your existing administrative process.
A current snapshot cannot prove a historical review or that access was revoked. This toolkit performs no remediation and provides no compliance certification.
View information in this report
Download original files
Optional original CSV and JSON files for verification, separate worksheet editing or use in other tools. Keep the generated evidence unchanged.
Account details: alex.admin
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- alex.admin
- Display name
- Alex Rivera
- Sign-in name
- alex.admin@demo.example
- State
- Enabled
- alex.admin@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Alex Rivera,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 10/08/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Within review window
- Review notes
- Selected privileged group membership; adminCount=1 (may be historical)
- Exception note
- Not recorded
- Inactivity review candidate
- No
- Password never expires
- No
- Historical admin flag (adminCount)
- 1
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Admins | Nested | 1 | Yes | Yes | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| Domain Users | Primary | 0 | Yes | No | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| Tier Zero Operators | Direct | 0 | Yes | No | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example |
Account details: blair
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- blair
- Display name
- Blair Chen
- Sign-in name
- blair@demo.example
- State
- Enabled
- blair@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Blair Chen,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 10/08/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Within review window
- Review notes
- Not recorded
- Exception note
- Not recorded
- Inactivity review candidate
- No
- Password never expires
- No
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| Engineering | Direct | 0 | Yes | No | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Engineering,CN=Users,DC=demo,DC=example |
Account details: casey.old
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- casey.old
- Display name
- Casey Morgan
- Sign-in name
- casey.old@demo.example
- State
- Enabled
- casey.old@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Casey Morgan,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 05/16/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Old replicated timestamp
- Review notes
- Inactivity review candidate
- Exception note
- Not recorded
- Inactivity review candidate
- Yes
- Password never expires
- No
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Casey Morgan,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Account details: devon.new
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- devon.new
- Display name
- Devon Patel
- Sign-in name
- devon.new@demo.example
- State
- Enabled
- devon.new@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Devon Patel,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 10/05/2026 17:00 UTC
- Replicated last logon UTC
- Not recorded
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- No recorded logon; recent account
- Review notes
- Not recorded
- Exception note
- Not recorded
- Inactivity review candidate
- No
- Password never expires
- No
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Devon Patel,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Account details: former.user
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- former.user
- Display name
- Jordan Taylor
- Sign-in name
- former.user@demo.example
- State
- Disabled
- former.user@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Jordan Taylor,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 02/05/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Old replicated timestamp
- Review notes
- Not recorded
- Exception note
- Not recorded
- Inactivity review candidate
- No
- Password never expires
- No
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Jordan Taylor,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Account details: never.recorded
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- never.recorded
- Display name
- Robin Lee
- Sign-in name
- never.recorded@demo.example
- State
- Enabled
- never.recorded@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Robin Lee,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 03/07/2026 17:00 UTC
- Replicated last logon UTC
- Not recorded
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- No recorded logon; older account
- Review notes
- Inactivity review candidate
- Exception note
- Not recorded
- Inactivity review candidate
- Yes
- Password never expires
- No
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Robin Lee,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Account details: primary.admin
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- primary.admin
- Display name
- Sam Ellis
- Sign-in name
- primary.admin@demo.example
- State
- Enabled
- primary.admin@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Sam Ellis,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 10/08/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Within review window
- Review notes
- Selected privileged group membership; adminCount=1 (may be historical)
- Exception note
- Not recorded
- Inactivity review candidate
- No
- Password never expires
- No
- Historical admin flag (adminCount)
- 1
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Admins | Primary | 0 | Yes | Yes | CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
Account details: svc.backup
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
Account information
- Account
- svc.backup
- Display name
- Backup Service Account
- Sign-in name
- svc.backup@demo.example
- State
- Enabled
- svc.backup@demo.example
- Department
- Operations
- Manager
- Not recorded
- Manager location
- Not recorded
- Account location
- CN=Backup Service Account,CN=Users,DC=demo,DC=example
Activity and review notes
- Created UTC
- 09/08/2025 17:00 UTC
- Replicated last logon UTC
- 04/16/2026 17:00 UTC
- Password last set UTC
- 09/13/2026 17:00 UTC
- Activity
- Old replicated timestamp
- Review notes
- Inactivity review candidate; Password does not expire; Exception note; still requires review
- Exception note
- Synthetic demo: confirm backup service owner and recent job activity
- Inactivity review candidate
- Yes
- Password never expires
- Yes
- Historical admin flag (adminCount)
- 0
A missing logon date does not prove the account was never used. The replicated date can be delayed. The historical admin flag does not establish current administrative access. Exception notes do not approve or hide an account.
Collected group memberships
These include direct, nested and primary relationships found in the snapshot. A distribution-group path does not grant security-group privilege.
| Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|
| Domain Users | Primary | 0 | Yes | No | CN=Backup Service Account,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Group members: Tier Zero Operators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Tier Zero Operators
- Group location
- CN=Tier Zero Operators,CN=Users,DC=demo,DC=example
- Collection status
- Observed in collected relationships
Collected users in this group (1)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
| Account | Name | State | Membership | Security-only path | Nesting depth | Path |
|---|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Direct | Yes | 0 | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example |
Group members: Engineering
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Engineering
- Group location
- CN=Engineering,CN=Users,DC=demo,DC=example
- Collection status
- Observed in collected relationships
Collected users in this group (1)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
| Account | Name | State | Membership | Security-only path | Nesting depth | Path |
|---|---|---|---|---|---|---|
| blair | Blair Chen | Enabled | Direct | Yes | 0 | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Engineering,CN=Users,DC=demo,DC=example |
Group members: Domain Admins
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Domain Admins
- Group location
- CN=Domain Admins,CN=Users,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (2)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
| Account | Name | State | Membership | Security-only path | Nesting depth | Path |
|---|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Nested | Yes | 1 | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| primary.admin | Sam Ellis | Enabled | Primary | Yes | 0 | CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
Group members: Domain Users
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Domain Users
- Group location
- CN=Domain Users,CN=Users,DC=demo,DC=example
- Collection status
- Observed in collected relationships
Collected users in this group (7)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
| Account | Name | State | Membership | Security-only path | Nesting depth | Path |
|---|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Primary | Yes | 0 | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| blair | Blair Chen | Enabled | Primary | Yes | 0 | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| casey.old | Casey Morgan | Enabled | Primary | Yes | 0 | CN=Casey Morgan,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| devon.new | Devon Patel | Enabled | Primary | Yes | 0 | CN=Devon Patel,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| former.user | Jordan Taylor | Disabled | Primary | Yes | 0 | CN=Jordan Taylor,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| never.recorded | Robin Lee | Enabled | Primary | Yes | 0 | CN=Robin Lee,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| svc.backup | Backup Service Account | Enabled | Primary | Yes | 0 | CN=Backup Service Account,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
Group members: Schema Admins
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Schema Admins
- Group location
- CN=Schema Admins,CN=Users,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Enterprise Admins
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Enterprise Admins
- Group location
- CN=Enterprise Admins,CN=Users,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Group Policy Creator Owners
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Group Policy Creator Owners
- Group location
- CN=Group Policy Creator Owners,CN=Users,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Administrators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Administrators
- Group location
- CN=Administrators,CN=Builtin,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Account Operators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Account Operators
- Group location
- CN=Account Operators,CN=Builtin,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Server Operators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Server Operators
- Group location
- CN=Server Operators,CN=Builtin,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Print Operators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Print Operators
- Group location
- CN=Print Operators,CN=Builtin,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Group members: Backup Operators
Snapshot coverage: Complete. These are collected user relationships within one domain, not a complete list of everyone with access. Review scope and collection issues.
- Group
- Backup Operators
- Group location
- CN=Backup Operators,CN=Builtin,DC=demo,DC=example
- Collection status
- Collected
Collected users in this group (0)
Includes direct, nested and primary user relationships found by this scan. Computers, managed service accounts and foreign principals are outside this list. Group membership alone does not prove usable access.
No collected user relationships were returned for this group. This is not proof that the group has no members or no access.
Reviewer worksheet
Read-only preview. This view does not record or save decisions. Blank decision fields have not been completed. To assign owners or record approvals, verify the original evidence and edit a separate worksheet copy outside the evidence folder.
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
| Account | Name | State | Review notes | Admin groups | Exception note | Suggested action | Reviewer | Owner | Decision | Reason | Decision date UTC | Ticket |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Selected privileged group membership; adminCount=1 (may be historical) | Domain Admins | Review with owner | |||||||
| blair | Blair Chen | Enabled | Review with owner | |||||||||
| casey.old | Casey Morgan | Enabled | Inactivity review candidate | Review with owner | ||||||||
| devon.new | Devon Patel | Enabled | Review with owner | |||||||||
| former.user | Jordan Taylor | Disabled | Review with owner | |||||||||
| svc.backup | Backup Service Account | Enabled | Inactivity review candidate; Password does not expire; Exception note; still requires review | Synthetic demo: confirm backup service owner and recent job activity | Review with owner | |||||||
| primary.admin | Sam Ellis | Enabled | Selected privileged group membership; adminCount=1 (may be historical) | Domain Admins | Review with owner | |||||||
| never.recorded | Robin Lee | Enabled | Inactivity review candidate | Review with owner |
All collected accounts (8)
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
This view lists all collected rows for this category. Select an account or admin group for more information. Review indicators are not instructions to disable or remove an account.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| alex.admin | Alex Rivera | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| blair | Blair Chen | Enabled | Within review window | ||
| casey.old | Casey Morgan | Enabled | Old replicated timestamp | Inactivity review candidate | |
| devon.new | Devon Patel | Enabled | No recorded logon; recent account | ||
| former.user | Jordan Taylor | Disabled | Old replicated timestamp | ||
| never.recorded | Robin Lee | Enabled | No recorded logon; older account | Inactivity review candidate | |
| primary.admin | Sam Ellis | Enabled | Within review window | Domain Admins | Selected privileged group membership; adminCount=1 (may be historical) |
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
All inactivity review candidates (3)
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
This view lists all collected rows for this category. Select an account or admin group for more information. Review indicators are not instructions to disable or remove an account.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| casey.old | Casey Morgan | Enabled | Old replicated timestamp | Inactivity review candidate | |
| never.recorded | Robin Lee | Enabled | No recorded logon; older account | Inactivity review candidate | |
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
All collected memberships (11)
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
Includes the direct, nested and primary relationships found in this snapshot. A distribution-group path does not grant security-group privilege. Membership alone does not prove usable access.
| Account | Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|---|
| alex.admin | Domain Admins | Nested | 1 | Yes | Yes | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| alex.admin | Domain Users | Primary | 0 | Yes | No | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| alex.admin | Tier Zero Operators | Direct | 0 | Yes | No | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example |
| blair | Domain Users | Primary | 0 | Yes | No | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| blair | Engineering | Direct | 0 | Yes | No | CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Engineering,CN=Users,DC=demo,DC=example |
| casey.old | Domain Users | Primary | 0 | Yes | No | CN=Casey Morgan,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| devon.new | Domain Users | Primary | 0 | Yes | No | CN=Devon Patel,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| former.user | Domain Users | Primary | 0 | Yes | No | CN=Jordan Taylor,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| never.recorded | Domain Users | Primary | 0 | Yes | No | CN=Robin Lee,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
| primary.admin | Domain Admins | Primary | 0 | Yes | Yes | CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| svc.backup | Domain Users | Primary | 0 | Yes | No | CN=Backup Service Account,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example |
All selected administrative memberships (2)
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
Includes the direct, nested and primary relationships found in this snapshot. A distribution-group path does not grant security-group privilege. Membership alone does not prove usable access.
| Account | Group | Membership | Nesting depth | Security-only path | Selected admin group | Path |
|---|---|---|---|---|---|---|
| alex.admin | Domain Admins | Nested | 1 | Yes | Yes | CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
| primary.admin | Domain Admins | Primary | 0 | Yes | Yes | CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example |
Evidence files and hashes
These recorded checksums cover the original data files. They are not a verification result or a digital signature. Use the supplied evidence checker with the original manifest for complete verification.
- Domain
- demo.example
- Tool version
- 0.2.8
- Collection status
- Complete
| File | Bytes | SHA-256 checksum |
|---|---|---|
| accounts.csv | 4206 | 8A24EAD79746205C9627C1D2216F9AE0DAC6FAF4BBE05CB852768BCAAE3AC13B |
| collection-issues.csv | 39 | 7C33D723245FBEA8C4284DB5E979E0C522D8EC080469744F32C00D78767AE761 |
| inactivity-candidates.csv | 1893 | 1906CB3E1C0F82C7AFD0AA8E0C32160BBD51F5FBDE66F4FD7AFA41E6BF28806B |
| memberships.csv | 3385 | 1FF00E997583334356DC1BDDCAA8EA1A540D31D84D490F587624764AAD31345B |
| privileged-memberships.csv | 781 | 45BF55E119BE6EE3CF321D2A7309F57304068D242E868E73F70CA411E046B055 |
| reviewer-worksheet.csv | 1640 | 01A632BADC20ED4B92D86BE40310FAB469E8159FEC70FAAFD8F9521AE43968A9 |
| selected-groups.csv | 1063 | 517DCEDEC94596BCA503FA10079D8CD72191FA4F86748801028D8DA43B4BACE4 |
| snapshot.json | 23177 | 7D2853CDE214C094A4F164E9FE43E3882C408D76196C3960B045E8E626E4F64D |
| unexpanded-members.csv | 43 | B1B91C5C3A976DA2EABD716EC5B355155D306A64A047152944C645F6FC0C94B2 |
The report file is also covered by the original manifest. Its checksum is recorded after the report is generated and is not embedded here. The original manifest is available under Download original files in the review workflow.
Structured evidence
This is a read-only view of snapshot.json, including original field names, full timestamps and technical identifiers. Account and group views provide the easier-to-read presentation of the same collected records.
Snapshot coverage: Complete. These are collected records within the scan scope. Review scope and scan issues before relying on the results.
{
"Metadata": {
"SchemaVersion": 1,
"ToolVersion": "0.2.8",
"Mode": "Demo",
"Status": "Complete",
"StartedUtc": "2026-10-13T16:59:50.0000000Z",
"CompletedUtc": "2026-10-13T17:00:00.0000000Z",
"DomainName": "demo.example",
"DomainSid": "S-1-5-21-111111111-222222222-333333333",
"ForestRootDomain": "demo.example",
"Server": "dc01.demo.example (synthetic)",
"SearchBase": "DC=demo,DC=example",
"InactiveDays": 90,
"RequestedGraceDays": 14,
"EffectiveGraceDays": 14,
"TimestampSyncDays": 14,
"TimestampSignalAvailable": true,
"CandidateCutoffUtc": "2026-07-01T17:00:00.0000000Z",
"Queries": [
{
"Query": "Get-ADDomain (synthetic)",
"Status": "Collected",
"Count": 1
},
{
"Query": "Get-ADForest (synthetic)",
"Status": "Collected",
"Count": 1
},
{
"Query": "Domain timestamp interval (synthetic)",
"Status": "Collected",
"Count": 1
},
{
"Query": "Get-ADUser (synthetic)",
"Status": "Collected",
"Count": 8
},
{
"Query": "Get-ADGroup (synthetic)",
"Status": "Collected",
"Count": 13
}
],
"Scope": "One domain; AD user objects and group membership relationships only. Not effective authorization, a forest audit, or historical evidence."
},
"Accounts": [
{
"SID": "S-1-5-21-111111111-222222222-333333333-1200",
"ObjectGuid": "00000000-0000-0000-0000-000000001200",
"SamAccountName": "alex.admin",
"Name": "Alex Rivera",
"UserPrincipalName": "alex.admin@demo.example",
"State": "Enabled",
"Email": "alex.admin@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Alex Rivera,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
"ActivityIndicator": "Within review window",
"InactivityCandidate": false,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 1,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "Domain Admins",
"GroupCount": 3,
"ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1201",
"ObjectGuid": "00000000-0000-0000-0000-000000001201",
"SamAccountName": "blair",
"Name": "Blair Chen",
"UserPrincipalName": "blair@demo.example",
"State": "Enabled",
"Email": "blair@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Blair Chen,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
"ActivityIndicator": "Within review window",
"InactivityCandidate": false,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 2,
"ReviewFlags": "",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1202",
"ObjectGuid": "00000000-0000-0000-0000-000000001202",
"SamAccountName": "casey.old",
"Name": "Casey Morgan",
"UserPrincipalName": "casey.old@demo.example",
"State": "Enabled",
"Email": "casey.old@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Casey Morgan,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-05-16T17:00:00.0000000Z",
"ActivityIndicator": "Old replicated timestamp",
"InactivityCandidate": true,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 1,
"ReviewFlags": "Inactivity review candidate",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1203",
"ObjectGuid": "00000000-0000-0000-0000-000000001203",
"SamAccountName": "devon.new",
"Name": "Devon Patel",
"UserPrincipalName": "devon.new@demo.example",
"State": "Enabled",
"Email": "devon.new@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Devon Patel,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2026-10-05T17:00:00.0000000Z",
"LastLogonTimestampUtc": "",
"ActivityIndicator": "No recorded logon; recent account",
"InactivityCandidate": false,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 1,
"ReviewFlags": "",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1204",
"ObjectGuid": "00000000-0000-0000-0000-000000001204",
"SamAccountName": "former.user",
"Name": "Jordan Taylor",
"UserPrincipalName": "former.user@demo.example",
"State": "Disabled",
"Email": "former.user@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Jordan Taylor,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-02-05T17:00:00.0000000Z",
"ActivityIndicator": "Old replicated timestamp",
"InactivityCandidate": false,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 1,
"ReviewFlags": "",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1207",
"ObjectGuid": "00000000-0000-0000-0000-000000001207",
"SamAccountName": "never.recorded",
"Name": "Robin Lee",
"UserPrincipalName": "never.recorded@demo.example",
"State": "Enabled",
"Email": "never.recorded@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Robin Lee,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2026-03-07T17:00:00.0000000Z",
"LastLogonTimestampUtc": "",
"ActivityIndicator": "No recorded logon; older account",
"InactivityCandidate": true,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 1,
"ReviewFlags": "Inactivity review candidate",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1206",
"ObjectGuid": "00000000-0000-0000-0000-000000001206",
"SamAccountName": "primary.admin",
"Name": "Sam Ellis",
"UserPrincipalName": "primary.admin@demo.example",
"State": "Enabled",
"Email": "primary.admin@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Sam Ellis,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
"ActivityIndicator": "Within review window",
"InactivityCandidate": false,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": false,
"AdminCount": 1,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-512",
"SelectedPrivilegedGroups": "Domain Admins",
"GroupCount": 1,
"ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
"ExceptionNote": ""
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-1205",
"ObjectGuid": "00000000-0000-0000-0000-000000001205",
"SamAccountName": "svc.backup",
"Name": "Backup Service Account",
"UserPrincipalName": "svc.backup@demo.example",
"State": "Enabled",
"Email": "svc.backup@demo.example",
"Department": "Operations",
"ManagerName": "",
"ManagerDN": "",
"DistinguishedName": "CN=Backup Service Account,CN=Users,DC=demo,DC=example",
"CreatedUtc": "2025-09-08T17:00:00.0000000Z",
"LastLogonTimestampUtc": "2026-04-16T17:00:00.0000000Z",
"ActivityIndicator": "Old replicated timestamp",
"InactivityCandidate": true,
"PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
"PasswordNeverExpires": true,
"AdminCount": 0,
"PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"SelectedPrivilegedGroups": "",
"GroupCount": 1,
"ReviewFlags": "Inactivity review candidate; Password does not expire; Exception note; still requires review",
"ExceptionNote": "Synthetic demo: confirm backup service owner and recent job activity"
}
],
"Memberships": [
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
"SamAccountName": "alex.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
"GroupName": "Domain Admins",
"GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
"MembershipKind": "Nested",
"Depth": 1,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": true,
"OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
"SamAccountName": "alex.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
"SamAccountName": "alex.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-1100",
"GroupName": "Tier Zero Operators",
"GroupDN": "CN=Tier Zero Operators,CN=Users,DC=demo,DC=example",
"MembershipKind": "Direct",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
"SamAccountName": "blair",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
"SamAccountName": "blair",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-1101",
"GroupName": "Engineering",
"GroupDN": "CN=Engineering,CN=Users,DC=demo,DC=example",
"MembershipKind": "Direct",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Engineering,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1202",
"SamAccountName": "casey.old",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Casey Morgan,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1203",
"SamAccountName": "devon.new",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Devon Patel,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1204",
"SamAccountName": "former.user",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Jordan Taylor,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1207",
"SamAccountName": "never.recorded",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Robin Lee,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
"SamAccountName": "primary.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
"GroupName": "Domain Admins",
"GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": true,
"OneObservedPath": "CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1205",
"SamAccountName": "svc.backup",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
"GroupName": "Domain Users",
"GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": false,
"OneObservedPath": "CN=Backup Service Account,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
}
],
"SelectedGroups": [
{
"SID": "S-1-5-21-111111111-222222222-333333333-512",
"Name": "Domain Admins",
"DistinguishedName": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-520",
"Name": "Group Policy Creator Owners",
"DistinguishedName": "CN=Group Policy Creator Owners,CN=Users,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-32-544",
"Name": "Administrators",
"DistinguishedName": "CN=Administrators,CN=Builtin,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-32-548",
"Name": "Account Operators",
"DistinguishedName": "CN=Account Operators,CN=Builtin,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-32-549",
"Name": "Server Operators",
"DistinguishedName": "CN=Server Operators,CN=Builtin,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-32-550",
"Name": "Print Operators",
"DistinguishedName": "CN=Print Operators,CN=Builtin,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-32-551",
"Name": "Backup Operators",
"DistinguishedName": "CN=Backup Operators,CN=Builtin,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-518",
"Name": "Schema Admins",
"DistinguishedName": "CN=Schema Admins,CN=Users,DC=demo,DC=example",
"CollectionState": "Collected"
},
{
"SID": "S-1-5-21-111111111-222222222-333333333-519",
"Name": "Enterprise Admins",
"DistinguishedName": "CN=Enterprise Admins,CN=Users,DC=demo,DC=example",
"CollectionState": "Collected"
}
],
"PrivilegedMemberships": [
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
"SamAccountName": "alex.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
"GroupName": "Domain Admins",
"GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
"MembershipKind": "Nested",
"Depth": 1,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": true,
"OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
"SamAccountName": "primary.admin",
"GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
"GroupName": "Domain Admins",
"GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
"MembershipKind": "Primary",
"Depth": 0,
"SecurityOnlyPath": true,
"SelectedPrivilegedGroup": true,
"OneObservedPath": "CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
}
],
"Worksheet": [
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
"SamAccountName": "alex.admin",
"Name": "Alex Rivera",
"State": "Enabled",
"ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
"SelectedPrivilegedGroups": "Domain Admins",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
"SamAccountName": "blair",
"Name": "Blair Chen",
"State": "Enabled",
"ReviewFlags": "",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1202",
"SamAccountName": "casey.old",
"Name": "Casey Morgan",
"State": "Enabled",
"ReviewFlags": "Inactivity review candidate",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1203",
"SamAccountName": "devon.new",
"Name": "Devon Patel",
"State": "Enabled",
"ReviewFlags": "",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1204",
"SamAccountName": "former.user",
"Name": "Jordan Taylor",
"State": "Disabled",
"ReviewFlags": "",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1205",
"SamAccountName": "svc.backup",
"Name": "Backup Service Account",
"State": "Enabled",
"ReviewFlags": "Inactivity review candidate; Password does not expire; Exception note; still requires review",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "Synthetic demo: confirm backup service owner and recent job activity",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
"SamAccountName": "primary.admin",
"Name": "Sam Ellis",
"State": "Enabled",
"ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
"SelectedPrivilegedGroups": "Domain Admins",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
},
{
"UserSID": "S-1-5-21-111111111-222222222-333333333-1207",
"SamAccountName": "never.recorded",
"Name": "Robin Lee",
"State": "Enabled",
"ReviewFlags": "Inactivity review candidate",
"SelectedPrivilegedGroups": "",
"ExceptionNote": "",
"SuggestedAction": "Review with owner",
"Reviewer": "",
"Owner": "",
"Decision": "",
"DecisionReason": "",
"DecisionDateUtc": "",
"TicketReference": ""
}
],
"Issues": [],
"UnexpandedMembers": []
}
Password-expiry exceptions (1)
Enabled accounts with passwords set to never expire. Confirm the account owner and documented business need; this setting alone is not a finding or an instruction to change a password.
Snapshot coverage: Complete. These are returned records, not proof of complete coverage. Review scan issues and scope before relying on this list.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| svc.backup | Backup Service Account | Enabled | Old replicated timestamp | Inactivity review candidate; Password does not expire; Exception note; still requires review |
Disabled accounts to review (1)
Confirm ownership and retention needs. A disabled state is not an instruction to delete or reactivate an account.
Snapshot coverage: Complete. These are returned records, not proof of complete coverage. Review scan issues and scope before relying on this list.
| Account | Name | State | Activity | Admin groups | Review notes |
|---|---|---|---|---|---|
| former.user | Jordan Taylor | Disabled | Old replicated timestamp |