Phase4-TrusteeResolution¶

Synopsis¶

Phase 4 helpers for AD Permissions Analyzer: trustee SID resolution, transitive group expansion, and the well-known-SID skip set.

Description¶

Implements §5 Phase 4, §10 (orphan + skip-set rules), and the sMSA/gMSA classification from docs/AD-Permissions-Analyzer-Plan.md.

IO boundaries kept narrow for testability: - Resolve-NTAccount wraps [SecurityIdentifier].Translate([NTAccount]) (the local LSA hit) so unit tests can mock it without a domain. - All LDAP traffic goes through Invoke-PagedLdapSearch (Phase 1) so tests mock at that single boundary.

Phase 4 runs single-threaded over $aceRecords and never mutates them; Phase 6 is the consumer that joins each ACE to its effective trustees while streaming the detail CSV.

Inputs¶

None.

Outputs¶

None.