Problem
HealthTest-AdminSDHolderCoverage reports users with adminCount=1 as users currently protected by AdminSDHolder.
File: health-tests/HealthTest-AdminSDHolderCoverage.ps1, lines 12-13.
The adminCount value can remain set after an account is removed from a protected group. It is not reliable proof of current protected-group membership.
Simple example
A user was once a Domain Admin and later removed. The account still has adminCount=1. The test reports that AdminSDHolder protection is currently applied to that user even though the user is no longer protected by group membership.
Expected behavior
Use current membership in the protected groups, including nested membership, for current coverage. If stale adminCount values are useful, report them separately as cleanup candidates.
Acceptance criteria
- A stale
adminCount=1 account is not described as currently protected.
- Current nested protected-group members are recognized.
- Stale markers can be reported separately.
- Unit tests cover current, nested, and formerly protected users.
Problem
HealthTest-AdminSDHolderCoveragereports users withadminCount=1as users currently protected by AdminSDHolder.File:
health-tests/HealthTest-AdminSDHolderCoverage.ps1, lines 12-13.The
adminCountvalue can remain set after an account is removed from a protected group. It is not reliable proof of current protected-group membership.Simple example
A user was once a Domain Admin and later removed. The account still has
adminCount=1. The test reports that AdminSDHolder protection is currently applied to that user even though the user is no longer protected by group membership.Expected behavior
Use current membership in the protected groups, including nested membership, for current coverage. If stale
adminCountvalues are useful, report them separately as cleanup candidates.Acceptance criteria
adminCount=1account is not described as currently protected.