drop ad object export · detect sidhistory abuse
flags unexpected sIDHistory on single-domain accounts · privileged SID in history · cross-domain SID without trust context
heuristic screener · export schema varies by tool — attribute mapping is best-effort · not definitive proof