Review privileged access exports

Read the export's schema

This fixture contains lowercase strings true and false. CSV has no native boolean type: Import-Csv returns those strings unchanged. Casting a non-empty string directly to [bool] produces true, even when the text says false. Compare the text explicitly or use a deliberate boolean parser.

[bool]'false'       # True: the string is not empty
[bool]::Parse('false')  # False: the word is parsed

Separate the rules

The fictional organisation wants two review queues: disabled accounts that retain privileged membership, and privileged accounts without recorded approval. These are distinct reasons. One account can trigger both, so independent if statements are appropriate; an elseif would suppress the second reason.

Do not include ordinary non-privileged accounts just because they lack privileged-access approval. The privilege condition scopes both rules.

Emit one finding per account and reason, preserving the export's record ID. The account name helps the reviewer, while the source ID keeps the result traceable.

This lesson reads a snapshot. It does not connect to Active Directory, disable users, remove group memberships, or make changes to a real environment. A review finding needs owner confirmation and current context before any administrative action. Browser checks assess the exported data logic only.