diff --git a/.vscode/launch.json b/.vscode/launch.json
index a8c86ec..679bfd5 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -10,8 +10,7 @@
       "request": "launch",
       "script": "${workspaceFolder}/Process-ADObjects.ps1",
       "args": ["R125"],
-      "preLaunchTask": "clean-workdirs",
-      "postDebugTask": "normalize-output"
+      "preLaunchTask": "clean-workdirs"
     },
     {
       "name": "Launch Measure Main Script",
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..0ad2edd
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,139 @@
+# CLAUDE.md — SparKURS / Process-ADObjects
+
+Briefing for Claude sessions on this repository. Read fully before touching code.
+
+## Purpose
+
+PowerShell system processing Active Directory group memberships for Sparkassen
+banking institutes (currently R125, Y015). Reads AD export CSVs, transforms them
+per institute, and writes CSV files consumed by (a) the DAW GUI import baskets
+("Basket.Import.ADGroup.*") and (b) KNIME workflows. Runtime target: ~3 minutes
+per institute (down from 10 h; do not regress this).
+
+## File map
+
+| File | Role |
+|---|---|
+| `Process-ADObjects.ps1` | Main entry, loads config, dot-sources the rest |
+| `Process-ADObjects-Configuration.ps1` | `$Config` hashtable: institutes, GroupManagementMappings, flags (`TestMode`, `Verbose`, ...). Pure data, no logic |
+| `Process-ADObjects-Base.ps1` | Core lookups: membership index (`newObjectMembershipsIndex`, `getObjectMemberships`, `getUsersByMemberGroup`), `getRoleType`, prefix matcher (`buildPrefixMatcher`, `testKnownPrefixes`) |
+| `Process-ADObjects-Utility.ps1` | Logging (`openLog`/`closeLog`/`outLog`/`outLogVerbose`), input checks, exception helpers, `removeDuplicatesFromSortedList` |
+| `Process-ADObjects-Work.ps1` | Institute dispatch |
+| `Process-ADObjects-Work-R125.ps1` / `-Y015.ps1` | Per-institute processing. Structurally identical copies (deduplication planned). Sections: FileSystemAccess, AppAccess, AppConfiguration, Organisation, Security, Anwenderrollen; then post-processing (sort → dedup → Neu derivation → file writes) |
+| `Process-ADObjects-Analyze.ps1` | AD object analysis. Known incomplete; cleanup planned |
+| `Process-ADObjects-Test.ps1` | Test scaffolding |
+
+## Conventions (mandatory)
+
+- **English** for all code, comments, identifiers, log messages. German only in chat.
+- **Allman** brace style (opening brace on its own line).
+- **`utf8NoBom`** for every file output; LF is fine (runs on macOS/pwsh 7).
+- No `Write-Host` in processing code — use `outLog` / `outLogVerbose`.
+  Exceptions: the output helpers themselves (`outLog`, `outScreen`, `dumpVar`,
+  `writeExceptionInfo*`).
+- Institute code is parameterized via `$SPKID` (e.g. "R125") and `$SPKNO`
+  (e.g. "125"). No hardcoded institute literals in Work files.
+- Code is currently intentionally comment-free (old comments stripped 2026-07;
+  re-commenting planned). Bug history lives in git and in this file.
+
+## Logging system
+
+- `outLog <args...>` — always-on log line; args are joined with **newline**.
+  For a single-line message concatenate in parentheses:
+  `outLog ("found " + $n + " entries")`.
+- `outLog ... -ToScreen $false` — file only. Named parameter only; positional
+  args all go to the message (`PositionalBinding=$false` +
+  `ValueFromRemainingArguments`).
+- `outLogVerbose <args...>` — trace layer, gated by `$Config.Verbose`, never to
+  screen. ~440 call sites instrument every loop iteration and if/elseif/else
+  branch. With `Verbose = $true` a full run writes millions of lines — use
+  `TestMode` for verbose runs.
+- Writer: persistent `StreamWriter` (UTF-8 no BOM, append, `AutoFlush=$true`),
+  auto-opens on first `outLog` and auto-reopens when `$LogFileName` changes.
+  `closeLog` at end is good style, not required. `tail -f` on the log works.
+- Timestamp format is `HH:mm:ss.fff`. (`".mmm"` was a historic bug: minutes,
+  not milliseconds. Do not reintroduce.)
+
+## Output post-processing (per Work file, end of run)
+
+1. `Sort($ordinalComparer)` on all four collections
+   (`DAWGruppenAnlegenOutList`, `DAWGruppenverwaltungOutList`,
+   `KURSSollProfileOutList`, `KURSIstMitarbeiterProfileOutList`).
+2. `removeDuplicatesFromSortedList` on each (logs removed count per list).
+3. `DAWGruppenverwaltungNeuOutList` is **derived** from the sorted Out list —
+   never written inline. Rule: rows with empty `Accounts.Add` pass through;
+   first row per `GUIADGroup.LDAP` block keeps all columns; subsequent rows
+   carry only the account (`;;;;;<acct>;;;;`).
+   Open point: same account via multiple Quellgruppen still yields duplicate
+   reduced rows within a block (3-line fix pending DAW import behavior).
+
+## Verification workflow
+
+1. Syntax check before any run (parser API, no execution):
+   `[System.Management.Automation.Language.Parser]::ParseFile(...)` per file.
+   On error lists, fix the **bottom-most concrete** error (e.g. "Unexpected
+   token 'X'"); "Missing closing brace" messages above it are usually cascade.
+2. Output comparison is always a **sorted multiset compare**, never a join:
+   `diff <(tail -n +3 REF.csv | sort -u) <(tail -n +3 NEW.csv | sort)`
+   (`+3`: skip Basket preamble + header; `-u` on the reference because current
+   code dedups and old references contain exact duplicates, e.g. 362 in the
+   R125 reference).
+3. Reference files written under Windows PowerShell 5.1 have **UTF-8 BOM +
+   CRLF** and a semicolon-padded preamble (`ManageMembers;;;;;;;;;`); current
+   output has no BOM, LF, unpadded preamble. Normalize before comparing.
+
+## Trap registry (hard-won; check before "optimizing")
+
+- **PS 5.1 vs pwsh 7 divergences:**
+  - `Sort-Object -Property "Order"` on hashtables silently does NOT sort on
+    5.1. Always use scriptblock form: `Sort-Object { [int]$_.Order }`.
+  - `-Encoding utf8` writes BOM on 5.1, no BOM on 7. Always specify
+    `utf8NoBom` (or `utf8BOM` deliberately).
+  - Reference outputs originate from 5.1 → see verification §3.
+- **R125 Proxy rules have `Order = 130/140`** (were 0/1). Reason: reference
+  behavior classifies `GGX-Proxy*` as `GPO`; on pwsh 7 a working sort would let
+  the (non-FI-Doku) Proxy rules win. Other institutes still have the 0/1
+  pattern — same trap waits there when validating against 5.1-era references.
+- **`getUsersByMemberGroup` must index `$ADObjectMembershipsIndexed`** (the
+  hashtable). Indexing the flat array with a string key fails silently
+  ($null → all indirect memberships vanish). Cost us 157k rows once.
+- **Both membership expansion branches need their `$users = ...` assignment.**
+  A deleted line in the AppAccess group branch silently dropped 83k rows
+  ($users was stale from the FS section).
+- **Out vs Neu list Add targets:** adding a line to the wrong collection
+  duplicated every FS creation row. The Neu list is derived now, but the same
+  copy-paste class applies to the four remaining lists.
+- **Prefix filter (Anwenderrollen):** `R125GUX*`/`<SPKID>GUX*` objects fall
+  THROUGH (original cascade had an empty first branch). The explicit
+  `StartsWith` check preserves this regardless of the prefix CSV content.
+- **`+` in argument mode is a literal argument**, not concatenation:
+  `outLog "a" + $b` passes three args. Parenthesize: `outLog ("a" + $b)`.
+- **Adding named parameters to `$args`-style functions** breaks positional
+  callers. Pattern: `[CmdletBinding(PositionalBinding=$false)]` +
+  `[Parameter(ValueFromRemainingArguments)]`.
+- **Institute porting:** check for bare `SPKNO`/`SPKID` (missing `$`) —
+  happened twice in Y015. `grep -P '[^$\w]SPK(NO|ID)\b'`.
+- **Editor hazards:** regex replace across guard lines and format-on-save have
+  each corrupted a file (interleaved fragments, brace salad). Prefer scripted,
+  validated transforms; always `git diff` after merging delivered files;
+  replace whole files rather than hand-merging.
+- **KNIME comparisons are fragile:** BOM breaks column autodetection; the
+  `DOMAIN\user` backslash can be eaten as escape char; join column pairing
+  drifts (Add vs Rem columns); duplicate keys break join semantics. Use the
+  shell/PowerShell multiset compare instead.
+- **`Start-ThreadJob` scriptblocks don't write parent variables** — the
+  `$startParallel` path in Analyze never worked. Needs `Receive-Job` if ever
+  activated.
+- **Empty `catch {}` blocks** exist in both Work files (Write-Host removed) —
+  exceptions are currently swallowed there; add log lines when instrumenting.
+
+## Backlog
+
+- Re-comment the codebase (fresh, English). Document at minimum: scriptblock
+  sort rationale, GUX fall-through, Proxy Order renumbering, Neu derivation.
+- Deduplicate R125/Y015 into a shared parameterized core.
+- TestMode: implement consistently across all sections.
+- Analyze: rework (incomplete; parallel path broken by design).
+- Decide: preamble semicolon padding for DAW import; Neu per-block account
+  dedup.
+- Y015: first verification run against its 5.1-era reference still pending.
diff --git a/Process-ADObjects-Analyze.ps1 b/Process-ADObjects-Analyze.ps1
old mode 100755
new mode 100644
index 6402660..bac665d
--- a/Process-ADObjects-Analyze.ps1
+++ b/Process-ADObjects-Analyze.ps1
@@ -1,5 +1,6 @@
 
-function analyzeADObjects {
+function analyzeADObjects
+{
     Param
     (
         [Parameter(Mandatory = $false, Position = 0)]
@@ -7,7 +8,7 @@ function analyzeADObjects {
     )
  
     $start = Get-Date
-    outLog "started:  analyzeADObjects at" $start.ToString("HH:mm:ss.mmm")
+    outLog "started:  analyzeADObjects at" $start.ToString("HH:mm:ss.fff")
 
     $adObjectsOrganisation = @()
     $adObjectsAppAccess = @()
@@ -15,8 +16,9 @@ function analyzeADObjects {
     $adObjectsAppConfiguration = @()
     $adObjectsSecurity = @()
 
-    if ($startParallel) {
-        #this stuff won´t work this way - missing globals !!!
+    if ($startParallel)
+    {
+        outLogVerbose 'if ($startParallel) -> true'
         Start-ThreadJob -ScriptBlock { $adObjectsOrganisation += analyzeADObjectsByType $FI.TypeTagOrganisation}
         Start-ThreadJob -ScriptBlock { $adObjectsAppAccess += analyzeADObjectsByType $FI.TypeTagAppAccess}
         Start-ThreadJob -ScriptBlock { $adObjectsFilesystemAccess += analyzeADObjectsByType $FI.TypeTagFilesystemAccess}
@@ -24,107 +26,143 @@ function analyzeADObjects {
         Start-ThreadJob -ScriptBlock { $adObjectsSecurity += analyzeADObjectsByType $FI.TypeTagSecurity}    
         Get-Job | Wait-Job
     }
-    else {
+    else
+    {
+        outLogVerbose 'else -> true (if/elseif ($startParallel) -> false)'
         $adObjectsOrganisation += analyzeADObjectsByType $FI.TypeTagOrganisation
         $adObjectsAppAccess += analyzeADObjectsByType $FI.TypeTagAppAccess
         $adObjectsFilesystemAccess += analyzeADObjectsByType $FI.TypeTagFilesystemAccess
         $adObjectsAppConfiguration += analyzeADObjectsByType $FI.TypeTagAppConfiguration
         $adObjectsSecurity += analyzeADObjectsByType $FI.TypeTagSecurity    
     }
-    outlog "found " $adObjectsOrganisation.Count " entries of type " $FI.TypeTagOrganisation
-    outlog "found " $adObjectsAppAccess.Count " entries of type " $FI.TypeTagAppAccess
-    outlog "found " $adObjectsFilesystemAccess.Count " entries of type " $FI.TypeTagFilesystemAccess
-    outlog "found " $adObjectsAppConfiguration.Count " entries of type " $FI.TypeTagAppConfiguration
-    outlog "found " $adObjectsSecurity.Count " entries of type " $FI.TypeTagSecurity
+    outLog ("found " + $adObjectsOrganisation.Count + " entries of type " + $FI.TypeTagOrganisation)
+    outLog ("found " + $adObjectsAppAccess.Count + " entries of type " + $FI.TypeTagAppAccess)
+    outLog ("found " + $adObjectsFilesystemAccess.Count + " entries of type " + $FI.TypeTagFilesystemAccess)
+    outLog ("found " + $adObjectsAppConfiguration.Count + " entries of type " + $FI.TypeTagAppConfiguration)
+    outLog ("found " + $adObjectsSecurity.Count + " entries of type " + $FI.TypeTagSecurity)
     $end = Get-Date
-    outLog "finished: analyzeADObjects at " $end.ToString("HH:mm:ss.mmm") ", used " ($end - $start) 
+    outLog ("finished: analyzeADObjects at " + $end.ToString("HH:mm:ss.fff") + ", used " + ($end - $start)) 
 }
 
-function analyzeDirectoryPaths {
+function analyzeDirectoryPaths
+{
     $header = "Verzeichnisname", "Normierter Pfad" , "Kontrolle" , "Endpunktname", "Verzeichnisart", "Verantwortlicher (Stelle oder Personalnummer)" , "Gruppe Lesen", "Gruppe Aendern", "Benutzer mit Leserecht", "Benutzer mit Aenderungsrecht", "Rollen mit Leserecht", "Rollen mit Aenderungsrecht"
     $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesInFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";" -Header $header
-    # \\V998DPVP.V998.INTERN\DFSRootP014$\P014\Daten\Ablage\GS\01010
     
-    # use slashes '/' as directory seperator to avoid backslash '\'-handling with 
-    # $rootPath = [regex]::escape('\' + $SPK.RootDomainName + '.V998.INTERN\DFSRoot' + $Institut + '$\' + $Institut + '\Daten')
     $rootPath = [regex]::escape('\' + $SPK.RootDomainName + '.V998.INTERN\DFSRoot' + $Institut + '$\' + $Institut + '\Daten')
     
     outLog $rootPath
-    foreach ($directoryEntry in $DirectoriesFilePathEntries) {
+    foreach ($directoryEntry in $DirectoriesFilePathEntries)
+    {
+        outLogVerbose 'foreach $directoryEntry in $DirectoriesFilePathEntries:' $directoryEntry.Verzeichnisname
         $path = [regex]::escape($directoryEntry.Verzeichnisname)
         $restPath = $path.Replace($rootPath, "")
-        # $restPath = $path.Substring($rootPath.length)
         outLog $restPath
     }
 }
 
-function analyzeADObjectsByType {
+function analyzeADObjectsByType
+{
     Param
     (
         [Parameter(Mandatory = $true, Position = 0)]
         [String] $typeTag
     )
     $start = Get-Date
-    outLog "started:  analyzeADObjects type " $typeTag "at" $start.ToString("HH:mm:ss.mmm")
+    outLog "started:  analyzeADObjects type " $typeTag "at" $start.ToString("HH:mm:ss.fff")
 
     $adGroupObjects = @()
     $counter = 1
     
-    foreach ($adObject in $ADObjects) {
-        if (-Not ($adObject.Description)) {
+    foreach ($adObject in $ADObjects)
+    {
+        outLogVerbose 'foreach $adObject in $ADObjects:' $adObject.ObjectName
+        if (-Not ($adObject.Description))
+        {
+            outLogVerbose 'if (-Not ($adObject.Description)) -> true'
             $adObject.Description = $Config.EmptyDescription
         }
-        if ($typeTag -ieq $FI.TypeTagAppConfiguration) {
-            if ($adObject.OU -cmatch $FI.RelevantGroups.AppConfiguration.Filter) {
+        if ($typeTag -ieq $FI.TypeTagAppConfiguration)
+        {
+            outLogVerbose 'if ($typeTag -ieq $FI.TypeTagAppConfiguration) -> true'
+            if ($adObject.OU -cmatch $FI.RelevantGroups.AppConfiguration.Filter)
+            {
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.AppConfiguration.Filter) -> true'
                 $userMemberShips = getAllUserMemberships $adObject
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.AppConfiguration.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adGroupObjects += $adObjectEntry
                 $counter++  
-                if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                if ($IsTestMode -and ($counter -gt $Config.TestMode) )
+                {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
             }
         }
-        elseif ($typeTag -ieq $FI.TypeTagAppAccess) {
-            if ($adObject.OU -cmatch $FI.RelevantGroups.AppAccess.Filter) {
+        elseif ($typeTag -ieq $FI.TypeTagAppAccess)
+        {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagAppAccess) -> true'
+            if ($adObject.OU -cmatch $FI.RelevantGroups.AppAccess.Filter)
+            {
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.AppAccess.Filter) -> true'
                 $userMemberShips = getAllUserMemberships $adObject
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.AppAccess.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adGroupObjects += $adObjectEntry
                 $counter++  
-                if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                if ($IsTestMode -and ($counter -gt $Config.TestMode) )
+                {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
             }    
         }
-        elseif ($typeTag -ieq $FI.TypeTagFileSystemAccess) {
-            if ($adObject.OU -cmatch $FI.RelevantGroups.FilesystemAccess.Filter) {
+        elseif ($typeTag -ieq $FI.TypeTagFileSystemAccess)
+        {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagFileSystemAccess) -> true'
+            if ($adObject.OU -cmatch $FI.RelevantGroups.FilesystemAccess.Filter)
+            {
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.FilesystemAccess.Filter) -> true'
                 $userMemberShips = getAllUserMemberships $adObject
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.FilesystemAccess.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adGroupObjects += $adObjectEntry
                 $counter++  
-                if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                if ($IsTestMode -and ($counter -gt $Config.TestMode) )
+                {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
             } 
         }
-        elseif ($typeTag -ieq $FI.TypeTagOrganisation) {
-            if ($adObject.OU -cmatch $FI.RelevantGroups.Organisation.Filter) {
+        elseif ($typeTag -ieq $FI.TypeTagOrganisation)
+        {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagOrganisation) -> true'
+            if ($adObject.OU -cmatch $FI.RelevantGroups.Organisation.Filter)
+            {
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.Organisation.Filter) -> true'
                 $userMemberShips = getAllUserMemberships $adObject
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.Organisation.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adGroupObjects += $adObjectEntry
                 $counter++  
-                if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                if ($IsTestMode -and ($counter -gt $Config.TestMode) )
+                {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
             }
         }
-        elseif ($typeTag -ieq $FI.TypeTagSecurity) {
-            if ($adObject.OU -cmatch $FI.RelevantGroups.Security.Filter) {
+        elseif ($typeTag -ieq $FI.TypeTagSecurity)
+        {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagSecurity) -> true'
+            if ($adObject.OU -cmatch $FI.RelevantGroups.Security.Filter)
+            {
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.Security.Filter) -> true'
                 $userMemberShips = getAllUserMemberships $adObject
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.Security.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adGroupObjects += $adObjectEntry
                 $counter++  
-                if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                if ($IsTestMode -and ($counter -gt $Config.TestMode) )
+                {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
             }
@@ -132,7 +170,7 @@ function analyzeADObjectsByType {
     }
 
     $end = Get-Date
-    outLog "finished: analyzeADObjects type " $typeTag "at" $end.ToString("HH:mm:ss.mmm") ", used " ($end - $start) 
+    outLog "finished: analyzeADObjects type " $typeTag "at" $end.ToString("HH:mm:ss.fff") ", used " ($end - $start) 
 
     return $adGroupObjects
 }
diff --git a/Process-ADObjects-Base.ps1 b/Process-ADObjects-Base.ps1
index e0474fb..cb0d958 100644
--- a/Process-ADObjects-Base.ps1
+++ b/Process-ADObjects-Base.ps1
@@ -2,32 +2,18 @@
 function writeHeaders
 {
 
-    ################################################################
-    # --------------------------------------------------------------
-    # Header für $DAWGruppenAnlegenOutFilePath anlegen
-    # --------------------------------------------------------------
     "Basket.Import.ADGroup.Create" | Out-File $DAWGruppenAnlegenOutFilePath -Encoding "utf8NoBOM"
     "GUIMandator" + ";" + "GUIADGroup.Name" + ";" + "GUIADGroup.Description" + ";" + "GUIMandatorADGroupType" + ";" + "GUIADGroup.DisplayName" + ";" + "GUIProcessingNote" + ";" + "OldName" | Out-File $DAWGruppenAnlegenOutFilePath -Append -Encoding "utf8NoBom"
    
-    # --------------------------------------------------------------
-    # Header für $DAWGruppenverwaltungOutFilePath anlegen
-    # --------------------------------------------------------------
     "Basket.Import.ADGroup.ManageMembers" | Out-File "$DAWGruppenverwaltungOutFilePath" -Encoding "utf8NoBom"
     "GUIMandator" + ";" + "GUIMandatorADGroupType" + ";" + "GUIADGroup.LDAP" + ";" + "GUIADGroup.ADGroups.Add.LDAPs" + ";" + "GUIADGroup.ADGroups.Rem.LDAPs" + ";" + "GUIADGroup.Accounts.Add.LDAPs" + ";" + "GUIADGroup.Accounts.Rem.LDAPs" + ";" + "GUIProcessingNote" + ";" + "ADObjectType" + ";" + "Quellgruppe" | Out-File $DAWGruppenverwaltungOutFilePath -Encoding "utf8NoBom" -Append 
 
     "Basket.Import.ADGroup.ManageMembers" | Out-File "$DAWGruppenverwaltungNeuOutFilePath" -Encoding "utf8NoBom"
     "GUIMandator" + ";" + "GUIMandatorADGroupType" + ";" + "GUIADGroup.LDAP" + ";" + "GUIADGroup.ADGroups.Add.LDAPs" + ";" + "GUIADGroup.ADGroups.Rem.LDAPs" + ";" + "GUIADGroup.Accounts.Add.LDAPs" + ";" + "GUIADGroup.Accounts.Rem.LDAPs" + ";" + "GUIProcessingNote" + ";" + "ADObjectType" + ";" + "Quellgruppe" | Out-File $DAWGruppenverwaltungNeuOutFilePath -Encoding "utf8NoBom" -Append 
    
-    # --------------------------------------------------------------
-    # Header für $KURSSollProfile anlegen
-    # --------------------------------------------------------------
     "Profilnummer;Name;Beschreibung;Profilverantwortliche OE/Stelle;Info;InfoKurs" | Out-File $KURSSollProfileOutFilePath -Encoding "utf8NoBom"
     
-    # --------------------------------------------------------------
-    # Header für $IstMitarbeiterProfile anlegen
-    # --------------------------------------------------------------
     "Personalnummer;;Profilnummer;Name Berechtigungsprofil" | Out-File "$KURSIstMitarbeiterProfileOutFilePath" -Encoding "utf8NoBom"
-    ################################################################
 }
 
 function getObjectMemberships
@@ -51,6 +37,7 @@ function getObjectMemberships
     }
     else
     {
+        outLogVerbose 'else -> true (if/elseif (?) -> false)'
         @($bucket) 
     }
 
@@ -73,34 +60,20 @@ function getAllUserMemberships
     $groupMemberships = @(getObjectMemberships $adObjectEntry.ObjectName "group" "group")
     foreach ($groupMembership in $groupMemberships)
     {
+        outLogVerbose 'foreach $groupMembership in $groupMemberships:' $groupMembership.MemberName
         $result.AddRange(@(getObjectMemberships $groupMembership.MemberName "user" "group"))
     }
-    # it's the same, bad odd syntax
-    # return ,$result.ToArray()
     return @($result)
 }
 
 function getUsersByMemberGroup
 {
-    <#
-    .SYNOPSIS
-        Retrieves the user membership entries for a given group via the
-        prebuilt membership index (O(1) lookup, exact class match).
-    .PARAMETER GroupName
-        The group whose user members are requested (matched against GroupName).
-    .OUTPUTS
-        Array of matching membership entries (empty array if none).
-        Object references are preserved from the index.
-    #>
     param
     (
         [Parameter(Mandatory = $true, Position = 0)]
         [string] $GroupName
     )
 
-    # BUGFIX 2026-07-02: was indexing the flat array $ADObjectMemberships with a string
-    # key, which fails silently (non-terminating Int32 conversion error -> $null) and
-    # dropped ALL indirect (group-inherited) user memberships. Must use the hashtable.
     $bucket = $ADObjectMembershipsIndexed[(getMembershipIndexKey $GroupName "user")]
     $result = if ($null -eq $bucket)
     {
@@ -108,47 +81,17 @@ function getUsersByMemberGroup
     }
     else
     {
+        outLogVerbose 'else -> true (if/elseif (?) -> false)'
         @($bucket) 
     }
     return $result
 }
 
-# function getAllUserMemberships
-# {
-#     param([Parameter(Mandatory, Position = 0)] $adObjectEntry)
 
-#     $result = [System.Collections.Generic.List[object]]::new()
-#     $result.AddRange(@(getObjectMemberships $adObjectEntry.ObjectName "user" "user"))
 
-#     $groupMemberships = @(getObjectMemberships $adObjectEntry.ObjectName "group" "group")
-#     foreach ($groupMembership in $groupMemberships)
-#     {
-#         $result.AddRange(@(getObjectMemberships $groupMembership.MemberName "user" "group"))
-#     }
 
-#     # ist beides gleich
-#     # return ,$result.ToArray()
-#     return @($result)
-# }
 
-# function getObjectMemberships
-# {
-#     param
-#     (
-#         [Parameter(Mandatory = $true, Position = 0)]
-#         [String] $adObjectEntryName,
-#         [Parameter(Mandatory = $true, Position = 1)]
-#         [string] $memberShipType,
-#         [Parameter(Mandatory = $true, Position = 2)]
-#         [string] $memberShipOriginalType
-#     )   
 
-#     $objectMemberships = @($ADObjectMemberships | Where-Object {($_.GroupName -ieq $adObjectEntryName) -and ($_.MemberClass -ieq $memberShipType)})
-#     # this is not very nice - we should only add members if they don´t exist - not just to set the values
-#     $objectMemberships | Add-Member -Force "Origin" $memberShipOriginalType
-#     $objectMemberships | Add-Member -Force "OriginName" $adObjectEntryName           
-#     return $objectMemberships
-# }
 
 function getMembershipIndexKey
 {
@@ -164,16 +107,6 @@ function getMembershipIndexKey
 
 function newObjectMembershipsIndex
 {
-    <#
-    .SYNOPSIS
-        Builds a lookup index over membership entries for O(1) retrieval by
-        GroupName + MemberClass, replacing repeated linear Where-Object scans.
-    .PARAMETER ADObjectMemberships
-        The flat collection of membership entries to index.
-    .OUTPUTS
-        Hashtable mapping "<groupname>\0<memberclass>" (lowercased) to a
-        List[object] of the matching entries. Object references are preserved.
-    #>
     param
     (
         [Parameter(Mandatory = $true, Position = 0)]
@@ -185,16 +118,18 @@ function newObjectMembershipsIndex
 
     foreach ($entry in $ADObjectMemberships)
     {
-        # NUL separator avoids key collisions between e.g. "ab"+"c" and "a"+"bc"
+        outLogVerbose 'foreach $entry in $ADObjectMemberships:' $entry.GroupName
         $key = getMembershipIndexKey $($entry.GroupName) $($entry.MemberClass)
         $key0 = "$($entry.GroupName)`0$($entry.MemberClass)".ToLowerInvariant()
         if (-not($key -eq $key0))
         {
+            outLogVerbose 'if (-not($key -eq $key0)) -> true'
             throw "this is BAAAD"
         }
         $bucket = $index[$key]
         if ($null -eq $bucket)
         {
+            outLogVerbose 'if ($null -eq $bucket) -> true'
             $bucket = [System.Collections.Generic.List[object]]::new()
             $index[$key] = $bucket
         }
@@ -213,27 +148,23 @@ function getRoleType
         [Parameter(Mandatory = $true, Position = 1)]
         [String] $typeTag
     )
-    # $FileSystemAccessEntriesNew = @()
     $roleType = "unknown"
-    # BUGFIX 2026-07-02: 'Sort-Object -Property "Order"' does not resolve hashtable keys on
-    # Windows PowerShell 5.1 (silent no-op, declaration order preserved). The scriptblock
-    # form works identically on 5.1 and 7, making rule evaluation order engine-independent.
     $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object {$_.OU -ieq $typeTag} | Sort-Object { [int]$_.Order }
     foreach ($relevantRoleType in $relevantRoleTypes)
     {
+        outLogVerbose 'foreach $relevantRoleType in $relevantRoleTypes:' $relevantRoleType.TypeName
         if ($adObjectEntry.OldName -cmatch $relevantRoleType.TagRegExp)
         {
+            outLogVerbose 'if ($adObjectEntry.OldName -cmatch $relevantRoleType.TagRegExp) -> true'
             $roleType = $relevantRoleType.TypeName 
             break
         }
     }
-    # Ausnahmebehandlungen in Absprache mit N.Zimmer am 21.01.2019
-    #--------------------------------------------------------------
     if (($typeTag -ieq $FI.TypeTagSecurity) -and ($roleType -ieq "unknown"))
     {
+        outLogVerbose 'if (($typeTag -ieq $FI.TypeTagSecurity) -and ($roleType -ieq "unknown")) -> true'
         $roleType = "GPO"
     }
-    #--------------------------------------------------------------    
     return $roletype
 }
 
@@ -246,18 +177,19 @@ function buildPrefixMatcher
 
     if (-not (Test-Path $CsvPath))
     {
+        outLogVerbose 'if (-not (Test-Path $CsvPath)) -> true'
         throw "Prefix CSV not found: $CsvPath" 
     }
 
-    # length -> HashSet[string] of prefixes with exactly that length
     $byLength = [System.Collections.Generic.Dictionary[int, System.Collections.Generic.HashSet[string]]]::new()
 
-    # foreach ($row in (Import-Csv -Path $CsvPath))
     foreach ($row in $SPK.ProfilPrefixes)
     {
+        outLogVerbose 'foreach $row in $SPK.ProfilPrefixes:' $row
         $prefix = $row.Prefix
         if ([string]::IsNullOrEmpty($prefix)) 
         {
+            outLogVerbose 'if ([string]::IsNullOrEmpty($prefix)) -> true'
             continue 
         }
 
@@ -265,18 +197,15 @@ function buildPrefixMatcher
         $bucket = $null
         if (-not $byLength.TryGetValue($len, [ref] $bucket))
         {
+            outLogVerbose 'if (-not $byLength.TryGetValue($len, [ref] $bucket)) -> true'
             $bucket = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal)
             $byLength[$len] = $bucket
         }
         [void]$bucket.Add($prefix)
     }
 
-    # Pre-compute the distinct lengths once, sorted descending so the most specific
-    # (longest) prefix wins first - mirrors the "specific before generic" ordering
-    # of a well-formed elseif cascade.
     $lengths = $byLength.Keys | Sort-Object -Descending
 
-    # Return a small state object carrying both structures.
     return [pscustomobject]@{
         ByLength = $byLength
         Lengths  = $lengths
@@ -294,40 +223,30 @@ function testKnownPrefixes
 
     if ([string]::IsNullOrEmpty($Value))
     {
+        outLogVerbose 'if ([string]::IsNullOrEmpty($Value)) -> true'
         return $false 
     }
 
     $valueLen = $Value.Length
     foreach ($len in $Matcher.Lengths)
     {
+        outLogVerbose 'foreach $len in $Matcher.Lengths:' $len
         if ($len -gt $valueLen)
         {
+            outLogVerbose 'if ($len -gt $valueLen) -> true'
             continue 
-        }              # prefix longer than value -> can't match
+        }
         $candidate = $Value.Substring(0, $len)
         $bucket = $Matcher.ByLength[$len]
         if ($bucket.Contains($candidate))
         {
-            return $true                                  # found a known prefix
+            outLogVerbose 'if ($bucket.Contains($candidate)) -> true'
+            return $true
         }
     }
     return $false
 }
 
-# function getNormalizedDirectoryPaths
-# {
-#     $analyzedDirectoryEntries = @()
-#     #  $header = "Verzeichnisname", "Endpunktname", "Gruppe Lesen", "Gruppe Aendern", "Benutzer mit Leserecht", "Benutzer mit Aenderungsrecht", "Rollen mit Leserecht", "Rollen mit Aenderungsrecht", "Verzeichnisart", "normierter Pfad"
-#     # $directoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";" -Header $header
-#     # $directoriesFilePathEntries = Get-Content -Path $DirectoriesInFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";"
-#     $directoriesFilePathEntries = Get-Content -Path $DirectoriesInFilePath | ConvertFrom-Csv -Delimiter ";"
-#     # $headers = ($directoriesFilePathEntries | Get-Member -MemberType NoteProperty)
-#     # $interstingHeader = $headers.Name -match "Gruppe .ndern"
-#     foreach ($FilePathEntry in $directoriesFilePathEntries)
-#     {
-#         $analyzedDirectoryEntries += $FilePathEntry.Name
-#     }
-# }
 
 
 function postProcess
@@ -337,41 +256,10 @@ function postProcess
         [bool]$convertToAscii = $false
     ) 
     
-    #########################################################
-    # just to be sure that nothing happens: comment it out until you know what`s happening here !
-    #########################################################
 
-    # $tmpFilePath = moveToInstituteTmpPath $DAWGruppenAnlegenOutFilePath $true  
-    # $firstlines = Get-Content -Path $tmpFilePath -TotalCount 2
-    # Get-Content -Path $tmpFilePath -TotalCount 1 | Out-File -Force $DAWGruppenAnlegenOutFilePath
-    # Get-Content -Path $tmpFilePath | Select-Object -Skip 2 | ConvertFrom-Csv -Delimiter ";" | select 'GUIMandator', 'GUIADGroup.Name', 'GUIADGroup.Description', 'GUIMandatorADGroupType', 'GUIADGroup.DisplayName', 'GUIProcessingNote' | ConvertTo-Csv -Delimiter ';' -NoTypeInformation | Out-File -FilePath $DAWGruppenAnlegenOutFilePath -Encoding UTF8 -Append
-    # # Import-Csv $tmpFilePath | select 'GUIMandator','GUIADGroup.Name','GUIADGroup.Description','GUIMandatorADGroupType','GUIADGroup.DisplayName','GUIProcessingNote' | Export-Csv -Path $DAWGruppenAnlegenOutFilePath -Delimiter ";" -Encoding UTF8
 
-    # $tmpFilePath = moveToInstituteTmpPath $DAWGruppenverwaltungOutFilePath $true  
-    # $firstlines = Get-Content -Path $tmpFilePath -TotalCount 2
-    # Get-Content -Path $tmpFilePath -TotalCount 1 | Out-File -Force $DAWGruppenverwaltungOutFilePath
-    # Get-Content -Path $tmpFilePath | Select-Object -Skip 2 | ConvertFrom-Csv -Delimiter ";" | select "GUIMandator", "GUIMandatorADGroupType", "GUIADGroup.LDAP", "GUIADGroup.ADGroups.Add.LDAPs", "GUIADGroup.ADGroups.Rem.LDAPs", "GUIADGroup.Accounts.Add.LDAPs", "GUIADGroup.Accounts.Rem.LDAPs", "GUIProcessingNote"  | ConvertTo-Csv -Delimiter ';' -NoTypeInformation | Out-File -FilePath $DAWGruppenverwaltungOutFilePath -Encoding UTF8 -Append
  
-    # # Import-Csv $tmpFilePath | select "GUIMandator","GUIMandatorADGroupType","GUIADGroup.LDAP","GUIADGroup.ADGroups.Add.LDAPs","GUIADGroup.ADGroups.Rem.LDAPs","GUIADGroup.Accounts.Add.LDAPs","GUIADGroup.Accounts.Rem.LDAPs","GUIProcessingNote" | Export-Csv -Path $DAWGruppenverwaltungOutFilePath -Delimiter ";" -Encoding UTF8 -NoTypeInformation
-    # $tmpFilePath = moveToInstituteTmpPath $DAWGruppenverwaltungNeuOutFilePath $true  
-    # $firstlines = Get-Content -Path $tmpFilePath -TotalCount 2 
-    # Get-Content -Path $tmpFilePath -TotalCount 1 | Out-File -Force $DAWGruppenverwaltungNeuOutFilePath
-    # Get-Content -Path $tmpFilePath | Select-Object -Skip 2 | ConvertFrom-Csv -Delimiter ";" | select "GUIMandator", "GUIMandatorADGroupType", "GUIADGroup.LDAP", "GUIADGroup.ADGroups.Add.LDAPs", "GUIADGroup.ADGroups.Rem.LDAPs", "GUIADGroup.Accounts.Add.LDAPs", "GUIADGroup.Accounts.Rem.LDAPs", "GUIProcessingNote"  | ConvertTo-Csv -Delimiter ';' -NoTypeInformation | Out-File -FilePath $DAWGruppenverwaltungNeuOutFilePath -Encoding UTF8 -Append
 
-    ####################################################### todo ?
-    # $KURSIstProfileOutFilePath 
-    # $KURSIstProfileBerechtigungenOutFilePath
-    # $KURSIstStellenBerechtigungenOutFilePath 
-    # $KURSIstStellenProfileOutFilePath 
-    # $KURSIstOEsBerechtigungenOutFilePath 
-    # $KURSIstOEsProfileOutFilePath
-    # $KURSIstMitarbeiterProfileOutFilePath    
-    # $KURSSollStellenfunktionenOutFilePath
-    # $KURSSollProfileOutFilePath
-    # $KURSSollProfileBerechtigungenOutFilePath
-    # $KURSSollStellenfunktionenBerechtigungenOutFilePath
-    # $KURSSollStellenfunktionenProfileOutFilePath
-    ####################################################### todo ?
     
 }
 
diff --git a/Process-ADObjects-Configuration.ps1 b/Process-ADObjects-Configuration.ps1
index 9231836..8ac6385 100644
--- a/Process-ADObjects-Configuration.ps1
+++ b/Process-ADObjects-Configuration.ps1
@@ -1,48 +1,18 @@
 $Config = @{
-  # DefaultInstitute = "Y013"
-  # DefaultInstitute = "Q017"
-  # DefaultInstitute = "Y058"
-  # DefaultInstitute = "Y028"
-  # DefaultInstitute = "P006"
-  # DefaultInstitute = "P020"
-  # DefaultInstitute = "R045"
-  # DefaultInstitute = "E056"
-  # DefaultInstitute = "Y019"
-  # DefaultInstitute = "Y123"
-  # DefaultInstitute = "Y015"
   DefaultInstitute = "R125"
-  # DefaultInstitute = "Y087"
-  # DefaultInstitute = "Q023"
-  # DefaultInstitute = "P045"
-  # DefaultInstitute = "P030"
-  # DefaultInstitute = "P058"
-  # DefaultInstitute = "Z019"
-  # DefaultInstitute = "Z002"
-  # DefaultInstitute = "Z001"
-  # DefaultInstitute = "Z013"
-  # DefaultInstitute = "P014"
-  # DefaultInstitute = "Z101"
 
-  # Evaluation of "$Config.$DataPathTag" REALLY CAN`T WORK HERE, you stupid!!
-  # DataPathTag      = "Data"
-  # DataRootPath     = $PSScriptroot + "/" + $Config.$DataPathTag + "/"
   DataRootPath     = $PSScriptroot + "/Data/"
   EmptyDescription = "### keine Beschreibung ###"
   NotAvailable     = "N/A"
-  #set TestMode to a value n greater than 0 to import only n entries for every ADObject-rolettype
-  TestMode         = 0
+  TestMode         = 3
   Verbose          = $true
+  ToScreen         = $true
   Analyze          = $false
   ProcessDAW       = $true
   WriteKURS        = $false
   TransferDAW      = $false
-  # PostProcess = $true --- DON'T DO THIS for now !!!
   PostProcess      = $false
   FI               = @{
-    # put RootDomainName-Setting into $SPK, so there`s no need to do erroneous calcultations  
-    # RootDomainName          = "V998DPV"
-    # UserRolePrefix               = "GGX"
-    # ApplicationAccessGroupPrefix = "GGX" 
     TypeTagRole             = "AnwenderRollen"
     TypeTagAppConfiguration = "Anwendungskonfiguration"      
     TypeTagAppAccess        = "Anwendungszugriff"      
@@ -51,7 +21,6 @@ $Config = @{
     TypeTagSecurity         = "Sicherheitseinstellungen"    
     GroupManagementMappings = 
     @(  
-      #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
       @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
       @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
       @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -61,11 +30,6 @@ $Config = @{
       @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
       @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
       @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-      # #####################################################################################################
-      # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-      # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-      # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-      # #####################################################################################################
       @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
       @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
       @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -78,21 +42,11 @@ $Config = @{
       @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
       @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
       @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-      # Spez. aber aktuell nicht vorhanden
-      #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
       @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-      # nicht gemaess FI-Doku
       @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
     )
-    #OU=Benutzergruppen
-    #OU=Gruppen
     RelevantGroups          = 
     @{
-      #AppAccess        = @{Filter = "OU=Anwendungszugriff,OU=Benutzergruppen"; ShortCut = "A_" }
-      #FilesystemAccess = @{Filter = "OU=Dateisystemzugriff,OU=Benutzergruppen"; ShortCut = "V_" }
-      #AppConfiguration = @{Filter = "OU=Anwendungskonfiguration,OU=Benutzergruppen"; ShortCut = "AK_" }
-      #Organisation     = @{Filter = "OU=OrganisatorischeGruppen,OU=Benutzergruppen"; ShortCut = "O_" }
-      #Security         = @{Filter = "OU=Sicherheitseinstellungen,OU=Benutzergruppen"; ShortCut = "S_" }
       AppAccess        = @{Filter = "OU=Anwendungszugriff,OU=Gruppen"; ShortCut = "A_" }
       FilesystemAccess = @{Filter = "OU=Dateisystemzugriff,OU=Gruppen"; ShortCut = "V_" }
       AppConfiguration = @{Filter = "OU=Anwendungskonfiguration,OU=Gruppen"; ShortCut = "AK_" }
@@ -102,11 +56,9 @@ $Config = @{
     }
   }
   SPK              = @{ 
-    #######
     R125 = @{ Region = "R"; No = "125"; Sign = "SK"; Name = "Leipzig"; RootDomainName = "V998DPVR"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -115,11 +67,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -132,15 +79,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
-        # BUGFIX 2026-07-02 (R125 only): Proxy rules moved to Order 130/140 (were 0/1).
-        # Reason: 'Sort-Object -Property Order' on hashtables silently does NOT sort on
-        # Windows PowerShell 5.1 (reference run) but DOES sort on PowerShell 7. With Order 0/1
-        # these rules won on PS7 and 'R125GGX-Proxy*' got type 'Proxy' instead of the
-        # reference value 'GPO'. Order 130/140 = evaluated after the GPO rules on both engines.
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 130 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 140 }
       )
       FileMappings            =
@@ -1556,11 +1495,9 @@ $Config = @{
         @{Prefix = "R125GGX-WG-Data_Alle"}
       )
     }
-    #######
     Y015 = @{ Region = "Y"; No = "015"; Sign = "SK"; Name = "Neuwied"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1569,11 +1506,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1586,10 +1518,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1608,12 +1537,9 @@ $Config = @{
 
     }
 
-    #region    OLD ################################################################################################
-    #######
     Z999 = @{ Region = "Z"; No = "999"; Sign = "JPSK"; Name = "JPrise SparKURS"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1622,11 +1548,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1639,10 +1560,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )         
       FileMappings            =
@@ -1656,7 +1574,6 @@ $Config = @{
     P014 = @{ Region = "P"; No = "014"; Sign = "SLS"; Name = "Sparkass Langen-Seligenstadft"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0},
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0},
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1},
@@ -1670,10 +1587,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 2},
         @{TypeName = "GPO"; TagRegExp = "GGX-Modul"; OU = "Sicherheitseinstellungen"; Order = 3},
         @{TypeName = "GPO"; TagRegExp = "GGX-Fingerprint"; OU = "Sicherheitseinstellungen"; Order = 4},
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 5},
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 6}
       )
       FileMappings            =
@@ -1687,7 +1601,6 @@ $Config = @{
     Z002 = @{ Region = "Z"; No = "002"; Sign = "SKNE"; Name = "Sparkasse Neuss"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1696,11 +1609,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1713,10 +1621,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1739,7 +1644,6 @@ $Config = @{
     Z004 = @{ Region = "Z"; No = "004"; Sign = "SSKD"; Name = "Sparkasse Duesseldorf"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1748,11 +1652,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1765,10 +1664,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1782,7 +1678,6 @@ $Config = @{
     Z101 = @{ Region = "Z"; No = "101"; Sign = "SKB"; Name = "Sparkasse Koeln-Bonn"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1791,11 +1686,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1808,10 +1698,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1825,7 +1712,6 @@ $Config = @{
     Z019 = @{ Region = "Z"; No = "019"; Sign = "SLS"; Name = "Sparkasse Essen"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1834,11 +1720,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1851,10 +1732,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1866,11 +1744,9 @@ $Config = @{
       )
     }
 
-    #######
     Q017 = @{ Region = "Q"; No = "017"; Sign = "LZO"; Name = "Sparkasse zu Oldenburg"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1879,11 +1755,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1896,10 +1767,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1911,11 +1779,9 @@ $Config = @{
       )
     }
 
-    #######
     Y013 = @{ Region = "Y"; No = "013"; Sign = "KOB"; Name = "Sparkasse Koblenz"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1924,11 +1790,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1941,10 +1802,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -1956,11 +1814,9 @@ $Config = @{
       )
     }
 
-    #######
     Z001 = @{ Region = "Z"; No = "001"; Sign = "KRE"; Name = "Sparkasse Krefeld"; RootDomainName = "V998DPVZ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -1969,11 +1825,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -1986,10 +1837,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2001,11 +1849,9 @@ $Config = @{
       )
     }
 
-    #######
     Z013 = @{ Region = "Z"; No = "013"; Sign = "MGL"; Name = "Sparkasse Moenchengladbach"; RootDomainName = "V998DPK1"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2014,11 +1860,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2031,10 +1872,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2046,11 +1884,9 @@ $Config = @{
       )
     }
 
-    #######
     Q023 = @{ Region = "Q"; No = "023"; Sign = "SOL"; Name = "Kreissparkasse Soltau"; RootDomainName = "V998DPVQ"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2059,11 +1895,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2076,10 +1907,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2091,11 +1919,9 @@ $Config = @{
       )
     }
 
-    #######
     P045 = @{ Region = "P"; No = "045"; Sign = "WEI"; Name = "Kreissparkasse Weilburg"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2104,11 +1930,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2121,10 +1942,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2136,11 +1954,9 @@ $Config = @{
       )
     }
 
-    #######
     P020 = @{ Region = "P"; No = "020"; Sign = "LIM"; Name = "Kreissparkasse Limburg"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2149,11 +1965,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2166,10 +1977,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2181,11 +1989,9 @@ $Config = @{
       )
     }
 
-    #######
     Y058 = @{ Region = "Y"; No = "058"; Sign = "BIT"; Name = "Kreissparkasse Bitburg-Pruem"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2194,11 +2000,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2211,10 +2012,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2226,11 +2024,9 @@ $Config = @{
       )
     }
 
-    #######
     Y087 = @{ Region = "Y"; No = "087"; Sign = "VUK"; Name = "Kreissparkasse Vulkaneifel"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2239,11 +2035,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2256,10 +2047,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2271,11 +2059,9 @@ $Config = @{
       )
     }
 
-    #######
     P006 = @{ Region = "P"; No = "006"; Sign = "KGG"; Name = "Kreissparkasse Gross Gerau"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2284,11 +2070,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2301,10 +2082,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2316,11 +2094,9 @@ $Config = @{
       )
     }
 
-    #######
     R045 = @{ Region = "R"; No = "045"; Sign = "KGG"; Name = "Sparkasse Westholstein"; RootDomainName = "V998DPVR"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2329,11 +2105,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2346,10 +2117,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2361,11 +2129,9 @@ $Config = @{
       )
     }
 
-    #######
     E056 = @{ Region = "E"; No = "056"; Sign = "SK"; Name = "Mainfranken"; RootDomainName = "V998DPVE"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2374,11 +2140,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2391,10 +2152,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2406,11 +2164,9 @@ $Config = @{
       )
     }
 
-    #######
     Y123 = @{ Region = "Y"; No = "123"; Sign = "SK"; Name = "Merzig-Wadern"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2419,11 +2175,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2436,10 +2187,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2453,11 +2201,9 @@ $Config = @{
 
 
 
-    #######
     Y019 = @{ Region = "Y"; No = "019"; Sign = "SK"; Name = "Rhein-Haardt"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2466,11 +2212,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2483,10 +2224,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2499,11 +2237,9 @@ $Config = @{
     }
 
 
-    #######
     Y028 = @{ Region = "Y"; No = "028"; Sign = "AHR"; Name = "Kreissparkasse Ahrweiler"; RootDomainName = "V998DPVY"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2512,11 +2248,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2529,10 +2260,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2546,13 +2274,11 @@ $Config = @{
 
 
 
-    #######
 
 
     P030 = @{ Region = "P"; No = "030"; Sign = "FRASPA"; Name = "Sparkasse Frankfurt"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2561,11 +2287,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2578,10 +2299,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2595,7 +2313,6 @@ $Config = @{
     P058 = @{ Region = "P"; No = "058"; Sign = "KASPA"; Name = "Sparkasse Kassel"; RootDomainName = "V998DPVP"
       GroupManagementMappings = 
       @(  
-        #use 'Order'-Property' to set the order of 'TagRegExp'-evaluation for 'OU's - from specific to generic !!!
         @{TypeName = "Role"; TagRegExp = "G.X-"; OU = "AnwenderRollen"; Order = 0 },
         @{TypeName = "IExplore"; TagRegExp = "GGX-IEK_"; OU = "Anwendungskonfiguration"; Order = 0 },
         @{TypeName = "Office"; TagRegExp = "GGX-OFK_"; OU = "Anwendungskonfiguration"; Order = 1 },
@@ -2604,11 +2321,6 @@ $Config = @{
         @{TypeName = "CustomerApplication"; TagRegExp = "GG.-"; OU = "Anwendungszugriff"; Order = 1 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EPEncr-"; OU = "Dateisystemzugriff"; Order = 0 },
         @{TypeName = "FileSystemAccessProd"; TagRegExp = "GDF-EP-"; OU = "Dateisystemzugriff"; Order = 1 },
-        # #####################################################################################################
-        # "*GDT*" und "*GGD*" werden bei allen Sparkassen generell nicht betrachtet 
-        # @{TypeName = "GPO"; TagRegExp = "GDT-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # @{TypeName = "GPO"; TagRegExp = "GGD-SIA"; OU = "Sicherheitseinstellungen"; Order = 1 },
-        # #####################################################################################################
         @{TypeName = "GPO"; TagRegExp = "GGT-IE-Support-Tools"; OU = "Sicherheitseinstellungen"; Order = 10 },
         @{TypeName = "GPO"; TagRegExp = "GGT-TS"; OU = "Sicherheitseinstellungen"; Order = 20 },
         @{TypeName = "GPO"; TagRegExp = "GGW-DL2"; OU = "Sicherheitseinstellungen"; Order = 30 },
@@ -2621,10 +2333,7 @@ $Config = @{
         @{TypeName = "GPO"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 100 },
         @{TypeName = "GPO"; TagRegExp = "GGX-Smartcard"; OU = "Sicherheitseinstellungen"; Order = 110 },
         @{TypeName = "GPO"; TagRegExp = "GGX-TCHelpdesk"; OU = "Sicherheitseinstellungen"; Order = 120 },
-        # Spez. aber aktuell nicht vorhanden
-        #{@Type = "GPOInd"; TagRegExp = "GGX-Ind-"; OU = "Sicherheitseinstellungen"; Order = 5},
         @{TypeName = "Proxy"; TagRegExp = "GGX-PROXY"; OU = "Sicherheitseinstellungen"; Order = 0 },
-        # nicht gemaess FI-Doku
         @{TypeName = "Proxy"; TagRegExp = "GGX-Proxy"; OU = "Sicherheitseinstellungen"; Order = 1 }
       )
       FileMappings            =
@@ -2635,7 +2344,6 @@ $Config = @{
         @{SourceFileName = ""; TargetFileName = ""}
       )
     }
-    #endregion OLD ################################################################################################
   } 
 }
 
diff --git a/Process-ADObjects-Test.ps1 b/Process-ADObjects-Test.ps1
old mode 100755
new mode 100644
index 47fde47..8dd7407
--- a/Process-ADObjects-Test.ps1
+++ b/Process-ADObjects-Test.ps1
@@ -1,5 +1,3 @@
-#Add-Type -Path "Syncfusion.XlsIO.Portable.dll"
-#Add-Type -Path "Syncfusion.Compression.Portable.dll"
 
 function TestExcel {
     $inputFilePath = "/Users/edmond/Develop/PowerShell/BIT-BV/Data/Z999/In/bitBVTest.xlsx"
@@ -16,10 +14,11 @@ function TestExcel {
     $colCount = $workSheet.UsedRange.LastColumn
 
     for ($i = 2; $i -le $rowCount; $i++) { 
+        outLogVerbose 'for ($i = 2; $i -le $rowCount; $i++) iteration:' $i
         for ($j = 1; $j -le $colCount; $j++) { 
+            outLogVerbose 'for ($j = 1; $j -le $colCount; $j++) iteration:' $j
             $value = $workSheet.Range[$i, $j].DisplayText
             $newValue = $value -replace "`n", " --- " -replace "`r", " --- " -replace ";", "--" -replace "`"", "'"
-            # $newValue = convertUTF8ToASCII $newValue
             $workSheet.Range[$i, $j].Text = $newValue
         } 
     } 
diff --git a/Process-ADObjects-Utility.ps1 b/Process-ADObjects-Utility.ps1
old mode 100755
new mode 100644
index bb407db..06b4f60
--- a/Process-ADObjects-Utility.ps1
+++ b/Process-ADObjects-Utility.ps1
@@ -20,25 +20,106 @@ function getTimeStamp
     return $now.ToString($formatString)
 }
 
+function openLog
+{
+    param([string] $Path = $LogFileName)
+    closeLog
+    $parentDir = Split-Path -Parent $Path
+    if ($parentDir -and -not (Test-Path $parentDir))
+    {
+        New-Item -ItemType Directory -Path $parentDir -Force | Out-Null
+    }
+    $Global:LogWriter = [System.IO.StreamWriter]::new(
+        $Path, $true, [System.Text.UTF8Encoding]::new($false))
+    $Global:LogWriter.AutoFlush = $true
+    $Global:LogWriterPath = $Path
+}
+
+function closeLog
+{
+    if ($Global:LogWriter)
+    {
+        $Global:LogWriter.Flush()
+        $Global:LogWriter.Dispose()
+        $Global:LogWriter = $null
+        $Global:LogWriterPath = $null
+    }
+}
+
+function outLogVerbose
+{
+    if (-not $Config.Verbose)
+    {
+        return
+    }
+    outLog @args -ToScreen $false
+}
+
 function outLog
 {
+    [CmdletBinding(PositionalBinding = $false)]
+    param
+    (
+        [Parameter(ValueFromRemainingArguments = $true)]
+        [object[]] $Messages,
+        [bool] $ToScreen = $true
+    )
     $timestamp = Get-Date
-    $outString = $timestamp.ToString("HH:mm:ss.mmm") + ": "
-    for ($i = 0; $i -lt $args.count; $i++)
+    $outString = $timestamp.ToString("HH:mm:ss.fff") + ": "
+    if ($Messages)
     {
-        $j = $i + 1
-        $outString += $args[$i] 
+        $outString += ($Messages -join [Environment]::NewLine)
     }
     if ($previuosTime)
     {
-        $outString += ($end - $start)  
+        $outString += [Environment]::NewLine + ($end - $start)
+    }
+    if (-not $Global:LogWriter -or $Global:LogWriterPath -ne $LogFileName)
+    {
+        openLog $LogFileName
+    }
+    $Global:LogWriter.WriteLine($outString)
+    if ($ToScreen)
+    {
+        Write-Host $outString
     }
-    $outString | Tee-Object -FilePath $LogFileName -Append | Write-Host
 }
+function removeDuplicatesFromSortedList
+{
+    param
+    (
+        [Parameter(Mandatory = $true)]
+        [System.Collections.Generic.List[string]] $List,
+        [Parameter(Mandatory = $false)]
+        [string] $ListName = "list"
+    )
+    if ($List.Count -lt 2)
+    {
+        return
+    }
+    $unique = [System.Collections.Generic.List[string]]::new($List.Count)
+    $previous = $null
+    foreach ($entry in $List)
+    {
+        if ($entry -cne $previous)
+        {
+            $unique.Add($entry)
+            $previous = $entry
+        }
+    }
+    $removedCount = $List.Count - $unique.Count
+    if ($removedCount -gt 0)
+    {
+        $List.Clear()
+        $List.AddRange($unique)
+    }
+    outLog ($ListName + ": removed " + $removedCount + " duplicate lines, " + $List.Count + " remaining")
+}
+
 function outScreen
 {
     $timestamp = Get-Date
-    $outString = $timestamp.ToString("HH:mm:ss.mmm") + ": "
+    $outString = $timestamp.ToString("HH:mm:ss.fff") + ": "
     for ($i = 0; $i -lt $args.count; $i++)
     {
         $j = $i + 1
@@ -57,28 +138,32 @@ function checkInput
     $spk = $spk.ToUpperInvariant()
     if ([string]::IsNullOrEmpty($spk))
     {
+        outLogVerbose 'if ([string]::IsNullOrEmpty($spk)) -> true'
         if (isProbablyDevelopmentUser)
         {
-            Write-Host "no given Institute (parameter '-sparkasse'), using default" $Config.DefaultInstitute
+            outLogVerbose 'if (isProbablyDevelopmentUser) -> true'
             $spk = $Config.DefaultInstitute.ToUpperInvariant()   
         }
         else
         {
+            outLogVerbose 'else -> true (if/elseif (isProbablyDevelopmentUser) -> false)'
             while ($true)
             {
+                outLogVerbose 'while ($true) -> true'
                 $spk = $(Read-Host "please enter Institute Parameter (parameter '-sparkasse'), 'Ctrl-C for exit'" ).ToUpperInvariant()
                 if ([string]::IsNullOrEmpty($spk))
                 {
+                    outLogVerbose 'if ([string]::IsNullOrEmpty($spk)) -> true'
                     continue
                 }
                 elseif (checkInstitute($spk))
                 {
+                    outLogVerbose 'elseif (checkInstitute($spk)) -> true'
                     break
                 }
                 else
                 {
-                    Write-Host "this institute is not in our list of wellknown institutes: " 
-                    Write-Host ($Config.SPK | Format-Table | Out-String)
+                    outLogVerbose 'else -> true (if/elseif (checkInstitute($spk)) -> false)'
                     continue
                 }
             }       
@@ -86,9 +171,7 @@ function checkInput
     }
     elseif (-not (checkInstitute($spk)))
     {
-        # Write-Host "edmond"
-        Write-Host "this institute is not in our list of wellknown institutes: " 
-        Write-Host ($Config.SPK | Format-Table | Out-String)
+        outLogVerbose 'elseif (-not (checkInstitute($spk))) -> true'
         exit  
     }
     return $spk
@@ -98,12 +181,12 @@ function checkInputSourceFiles
 {
     if (-not $InstitutsSourcePath)
     {
-        Write-Host "Source file does not exist: " $InstitutsSourcePath 
+        outLogVerbose 'if (-not $InstitutsSourcePath) -> true'
         return $false
     }
     if (-not $InstitutsSourcePathKURS)
     {
-        Write-Host "Source file does not exist: " $InstitutsSourcePathKURS 
+        outLogVerbose 'if (-not $InstitutsSourcePathKURS) -> true'
         return $false
     }
     return $true
@@ -114,36 +197,43 @@ function checkInputDataFiles
     $ok = $true
     if (-not $ADObjectsFilePath)
     {
+        outLogVerbose 'if (-not $ADObjectsFilePath) -> true'
         outLog "no ADObjectsFile found !"
         $ok = $false
     }
     if (-not $ADObjectMembershipsFilePath)
     {
+        outLogVerbose 'if (-not $ADObjectMembershipsFilePath) -> true'
         outLog "no ADObjectsFile found !"
         $ok = $false
     }
     if (-not $ADApplicationsInFilePath)
     {
+        outLogVerbose 'if (-not $ADApplicationsInFilePath) -> true'
         outLog "no ADApplicationsInFile found !"
         $ok = $false
     }
     if (-not $ADDirectoriesInFilePath)
     {
+        outLogVerbose 'if (-not $ADDirectoriesInFilePath) -> true'
         outLog "no ADDirectoriesInFile found !"
         $ok = $false
     }
     if (-not $SecurityInFilePath)
     {
+        outLogVerbose 'if (-not $SecurityInFilePath) -> true'
         outLog "no SecurityInFile found !"
         $ok = $false
     }
     if (-not $KURSPositionsInFilePath)
     {
+        outLogVerbose 'if (-not $KURSPositionsInFilePath) -> true'
         outLog "no KURSPositionsInFile found !"
         $ok = $false
     }
     if (-not $KURSEmployeesInFilePath)
     {
+        outLogVerbose 'if (-not $KURSEmployeesInFilePath) -> true'
         outLog "no KURSEmployeesInFile found !"
         $ok = $false
     }
@@ -151,6 +241,7 @@ function checkInputDataFiles
     $ADObjectMembershipsFileTimeStamp = (Get-ChildItem $ADObjectMembershipsFilePath).BaseName.Split("_")[2]
     if ($ADObjectsFileTimeStamp -ne $ADObjectMembershipsFileTimeStamp)
     {
+        outLogVerbose 'if ($ADObjectsFileTimeStamp -ne $ADObjectMembershipsFileTimeStamp) -> true'
         outLog "TimeStamps of latest input files found are not equal: ADObjectsFileTimeStamp:" $ADObjectsFileTimeStamp "ADObjectMembershipsFileTimeStamp: " $ADObjectMembershipsFileTimeStamp ", stopping process !"
         $ok = $false
     }  
@@ -161,6 +252,7 @@ function checkTestMode
 {
     if ($Config.TestMode -gt 0)
     {
+        outLogVerbose 'if ($Config.TestMode -gt 0) -> true'
         outLog "entering TestMode, reading the first" $Config.TestMode "ADObject-entries for every roletype"
         return $true
     }
@@ -173,12 +265,12 @@ function isProbablyDevelopmentUser
     $userName = [Environment]::UserName
     if ($userName -ieq "edmond")
     {
-        Write-Host "developer" $userName "found"
+        outLogVerbose 'if ($userName -ieq "edmond") -> true'
         return $true
     }
     elseif ($userName -ieq "burgwink")
     {
-        Write-Host "developer" $userName "found"
+        outLogVerbose 'elseif ($userName -ieq "burgwink") -> true'
         return $true        
     }
     return $false
@@ -245,6 +337,7 @@ function moveToInstituteTmpPath
     $tmpFilePath = $InstituteRootPathTmp + "/" + $fileName
     if ($force)
     {
+        outLogVerbose 'if ($force) -> true'
         Remove-Item -Path $tmpFilePath -ErrorAction Ignore
     }
     Move-Item -Path $filePath -Destination $InstituteRootPathTmp
@@ -288,6 +381,7 @@ function writeExceptionInfo
 
     if ($Rethrow)
     {
+        outLogVerbose 'if ($Rethrow) -> true'
         throw $ErrorRecord
     }
 }
\ No newline at end of file
diff --git a/Process-ADObjects-Work-R125.ps1 b/Process-ADObjects-Work-R125.ps1
index 5b6afac..87e4401 100644
--- a/Process-ADObjects-Work-R125.ps1
+++ b/Process-ADObjects-Work-R125.ps1
@@ -22,14 +22,15 @@ function ProcessADObjects
   $KURSIstMitarbeiterProfileOutList = [System.Collections.Generic.List[string]]::new()
 
 
-  # Mitarbeiter einlesen und Persnr zu S-Userid in Array speichern
   $MitarbeiterEntries = Get-Content -Path $MitarbeiterInFilePath | ConvertFrom-Csv -Delimiter ";"
   $mitarbeiter_array = @{ "mitarbeiter" = "mitarbeiter" }
   $mitarbeiterStelle_array = @{ "mitarbeiter" = "stelle" }
   foreach ($item in $MitarbeiterEntries)
   {
+    outLogVerbose 'foreach $item in $MitarbeiterEntries:' $item.'St.-Nr.'
     if ([System.String]::IsNullOrEmpty($item.Benutzerkennung))
     {
+      outLogVerbose 'if ([System.String]::IsNullOrEmpty($item.Benutzerkennung)) -> true'
       continue
     }
     try
@@ -49,10 +50,9 @@ function ProcessADObjects
   $pkey_array = @{ "key" = 0 }
   $rbkey_array = @{ "key" = 0 }
 
-  # FileSystemAccess ---------------------------------------------
   if ($roletypeTag -ieq $FI.TypeTagFilesystemAccess)
   {
-    # ToDo: Anwendungszugriff: Mapping #$AnwendungenFilePath $item.Verzeichnisname, Anwendungen werden nicht gefunden
+    outLogVerbose 'if ($roletypeTag -ieq $FI.TypeTagFilesystemAccess) -> true'
     try
     {
 
@@ -64,16 +64,16 @@ function ProcessADObjects
 
       foreach ($item in $AnwendungenFilePathEntries)
       {
+        outLogVerbose 'foreach $item in $AnwendungenFilePathEntries:' $item.Verzeichnisname
         if ([System.String]::IsNullOrEmpty($item.Verzeichnisname))
         {
+          outLogVerbose 'if ([System.String]::IsNullOrEmpty($item.Verzeichnisname)) -> true'
           continue
         }
         try
         {
-          Write-Host $item.Verzeichnisname + $item.'Nr.'
           $nummer_array[$item.Verzeichnisname] = $item.'Nr.'
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow
@@ -81,33 +81,12 @@ function ProcessADObjects
       }
 
 
-      # UTF / ANSI conflict workaround
-      # $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | ConvertFrom-Csv -Delimiter ";" 
 
-      # Einlesen der Datei XXXX_Verzeichnisse.csv
-      # "Verzeichnisname" -> wird verwendet
-      # "Normierter Pfad" -> wird verwendet
-      # "Kontrolle" 
-      # "Endpunktname" 
-      # "Verzeichnisbuchstabe" 
-      # "Verzeichnisart" -> wird verwendet
-      # "AWNR" -> wird verwendet
-      # "Anwendungskuerzel" -> wird verwendet
-      # "Gruppe Lesen" -> wird verwendet
-      # "Gruppe Aendern" -> wird verwendet
-      # "Benutzer mit Leserecht" 
-      # "Benutzer mit Aenderungsrecht" 
-      # "Rollen mit Leserecht" 
-      # "Rollen mit Aenderungsrecht" 
-      # "Name Verantwortlicher" 
-      # "Verantwortlicher (Stelle oder Personalnummer)" -> wird verwendet
 
-      #$header = "Verzeichnisname", "Normierter Pfad" , "Kontrolle" , "Endpunktname", "Verzeichnisbuchstabe", "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Benutzer mit Leserecht", "Benutzer mit Aenderungsrecht", "Rollen mit Leserecht", "Rollen mit Aenderungsrecht", "Name Verantwortlicher", "Verantwortlicher (Stelle oder Personalnummer)" 
 
       $header = "Verzeichnisname", "Normierter Pfad", "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Verantwortlicher (Stelle oder Personalnummer)"
       $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";" -Header $header
 
-      # Arrays mit Zusatzdaten
 
       $art_array = @{ "art" = "art" }
       $path_array = @{ "path" = "path" }
@@ -119,40 +98,22 @@ function ProcessADObjects
 
       foreach ($item in $DirectoriesFilePathEntries)
       {
-        # Arrays mit Zusatzdaten fuellen
-        # $item | Out-String
+        outLogVerbose 'foreach $item in $DirectoriesFilePathEntries:' $item.Verzeichnisname
         try
         {
-          # $art_array.Add($item.'Gruppe Lesen', $item.Verzeichnisart)
-          #Write-Host "----: " $item.Verzeichnisart " :----"
-          # $path_array.Add($item.'Gruppe Lesen', $item.'Normierter Pfad')
-          # $verantwortlicher_array.Add($item.'Gruppe Lesen', $item.'Verantwortlicher (Stelle oder Personalnummer)')
-          # $dkz_array.Add($item.'Gruppe Lesen', $item.Anwendungskuerzel)
-          # $dnummer_array.Add($item.'Gruppe Lesen', $item.AWNR)
-          # $fullpath_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
-          # $fullpath_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
-          #Write-Host "----: " $item.'Gruppe Lesen' $item.Verzeichnisart $item.Anwendungskuerzel $item.AWNR          
-          #Write-Host $item.'Gruppe Lesen' " -> " "----: " $item.Verzeichnisname " :----"
 
-          # Neu auch Aendern betrachten
-          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
-          # $dkz_array.Add($item.'Gruppe Aendern', $item.Anwendungskuerzel)
-          # $dnummer_array.Add($item.'Gruppe Aendern', $item.AWNR)
 
           $art_array[$item.'Gruppe Lesen'] = $item.Verzeichnisart         
           $path_array[$item.'Gruppe Lesen'] = $item.'Normierter Pfad' 
           $verantwortlicher_array[$item.'Gruppe Lesen'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
           $dkz_array[$item.'Gruppe Lesen'] = $item.Anwendungskuerzel
           $dnummer_array[$item.'Gruppe Lesen'] = $item.AWNR
-          Write-Host $item.'Gruppe Lesen' $item.AWNR
           $fullpath_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
           $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
           $dkz_array[$item.'Gruppe Aendern'] = $item.Anwendungskuerzel
           $dnummer_array[$item.'Gruppe Aendern'] = $item.AWNR
-          Write-Host $item.'Gruppe Aendern' $item.AWNR
           $fullpath_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
@@ -160,27 +121,17 @@ function ProcessADObjects
         try
         {
           $endpunkt_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
-          # $endpunkt_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
-          #Write-Host $item.'Gruppe Lesen' $item.Verzeichnisname            
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
         }
 
-        # UTF / ANSI conflict workaround
-        # $art_array.Add($item.'Gruppe �ndern', $item.Verzeichnisart);
-        # $path_array.Add($item.'Gruppe �ndern', $item.'normierter Pfad');
 
-        #Write-Host "+--:" $item.'Gruppe Aendern' $item.Verzeichnisart $item.'Verantwortlicher (Stelle oder Personalnummer)'
         try
         {
           $art_array[$item.'Gruppe Aendern'] = $item.Verzeichnisart
-          # $art_array.Add($item.'Gruppe Aendern', $item.Verzeichnisart)
-          #Write-Host "Art Array: " $item.'Gruppe Aendern' $item.Verzeichnisart
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
@@ -188,128 +139,110 @@ function ProcessADObjects
 
         try
         {
-          # $path_array.Add($item.'Gruppe Aendern', $item.'Normierter Pfad')
-          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
           $path_array[$item.'Gruppe Aendern'] = $item.'Normierter Pfad' 
           $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
         }
-        # Leere Eintraege
         catch
         {
-          #Write-Host "Schon enthalten in array: " $item.'Gruppe Aendern'                               
           writeExceptionInfo $_ -Rethrow        
         }
-        #Write-Host $item.'Gruppe Aendern' ": " $item.'Verantwortlicher (Stelle oder Personalnummer)'
         try
         {
-          # $endpunkt_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
           $endpunkt_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
-          #Write-Host $item.'Gruppe Aendern' $item.Verzeichnisname            
         }
-        # Leere Eintraege
         catch
         {
-          #Write-Host "Schon enthalten in endpunkt_array: " $item.'Gruppe Aendern'                               
           writeExceptionInfo $_ -Rethrow
         }
       }
 
-      #exit
       $FileSystemAccessEntries = Import-Csv -Path $FileSystemAccessTmpFilePath -Delimiter ";"
-      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
       $FileSystemAccessEntriesNew = [System.Collections.Generic.List[object]]::new()
 
-      # Arrays zum Speichern der Schluessel fuer die verschiedenen Unterbereiche
       $key_array = @{ "key" = 0 }
       $avkey_array = @{ "key" = 0 }
-      #$pkey_array = @{"key" = 0}
 
-      # $cntEntries = 0
-      # $cntNichtGelistet = 0
 
-      # $blaCnt = 0
 
       foreach ($item in $FileSystemAccessEntries)
       {
-        #$item | Out-String
+        outLogVerbose 'foreach $item in $FileSystemAccessEntries:' $item.Name
 
         if ( $item.Name.Contains("GGF-VDA-"))
         {
+          outLogVerbose 'if ($item.Name.Contains("GGF-VDA-")) -> true'
           continue
         }
 
-        #$blaCnt++
 
-        #if($blaCnt -ge 10) {
-        #    exit
-        #}
 
         $DisplayName = $item.ShortCut + $item.Name.Substring($item.Name.IndexOf('-') + 1)
         $TempString = $item.Name.Split('-')
 
-        # String fuer Namensende ermitteln
         $EndString = ""
         if ( $item.Name.EndsWith("_L"))
         {
+          outLogVerbose 'if ($item.Name.EndsWith("_L")) -> true'
           $EndString = "_L"
         }
         elseif ($item.Name.EndsWith("_A"))
         {
+          outLogVerbose 'elseif ($item.Name.EndsWith("_A")) -> true'
           $EndString = "_A"
         }
-        # Sollte nicht vorkommen
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($item.Name.EndsWith("_A")) -> false)'
           $EndString = "_X"
         }
 
         $NewShortName = ""
 
-        # Praefix fuer die Unterbereiche
-        #$V = "V1_"
         $V = ""
 
-        #Write-Host $art_array.Item($item.Name)
 
-        #Prj
-        #Aus
-        #Tea
-        #Pgr
 
         $V = $art_array.Item($item.Name) + "_"
 
         if ($art_array.Item($item.Name) -ieq "FAC123")
         {
+          outLogVerbose 'if ($art_array.Item($item.Name) -ieq "FAC123") -> true'
           $V = "FAC_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "AUS123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "AUS123") -> true'
           $V = "AUS_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "PKU123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "PKU123") -> true'
           $V = "PKU_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "SON123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "SON123") -> true'
           $V = "SON_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "UBE123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "UBE123") -> true'
           $V = "UBE_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "UNT123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "UNT123") -> true'
           $V = "UNT_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "VAW123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "VAW123") -> true'
 
           $V = "VAW_"
           $AWNRNEW = "9997"
@@ -317,16 +250,15 @@ function ProcessADObjects
 
           try
           {
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
             if (-not $AWNRNEW)
             {
+              outLogVerbose 'if (-not $AWNRNEW) -> true'
               $AWNRNEW = "9997"
             }
           }
           catch
           {
-            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
             writeExceptionInfo $_ -Rethrow 
           }
 
@@ -336,81 +268,76 @@ function ProcessADObjects
 
             if (-not $DKZ)
             {
+              outLogVerbose 'if (-not $DKZ) -> true'
               $DKZ = "XXXXX"
             }
           }
           catch
           {
-            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
             writeExceptionInfo $_ -Rethrow
           }
 
-          Write-Host "####: " $AWNRNEW $DKZ $item.Name
-          #$V = "V_" + $AWNRNEW + "_" + $endpunkt_array.Item($item.Name) + $EndString
           $V = "VAW_" + $AWNRNEW + "_" + $path_array.Item($item.Name) + $EndString
-          #$V = "VX_" + $AWNRNEW + "_"
           $VDUM = $V.Replace("_VR_", "_")
           $V = $VDUM
-          Write-Host "##--: " $V $VDUM
         }
 
-        # Pruefen ob Name im Array (in der Verzeichnisliste) vorhanden ist
         if ( $art_array.Contains($item.Name))
         {
+          outLogVerbose 'if ($art_array.Contains($item.Name)) -> true'
           if ($art_array.Item($item.Name) -ieq "Programm-Ablage")
           {
+            outLogVerbose 'if ($art_array.Item($item.Name) -ieq "Programm-Ablage") -> true'
             $NewShortName = $V
-            #Write-Host "---: " $item.Name $AWNRNEW $V
           }
           elseif ($art_array.Item($item.Name) -ieq "VAW")
           {
+            outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "VAW") -> true'
             $NewShortName = $V
           }
           elseif ($art_array.Item($item.Name) -ieq "PRG")
           {
+            outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "PRG") -> true'
             try
             {
               $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
               if (-not $AWNRNEW)
               {
+                outLogVerbose 'if (-not $AWNRNEW) -> true'
                 $AWNRNEW = "9998"
               }
             }
             catch
             {
-              Write-Host "AWNRNEW nicht gefunden: " $item.OldName
               $AWNRNEW = "9998"
               writeExceptionInfo $_ -Rethrow
             }
-            Write-Host "AWNRNEW ----: " $AWNRNEW
 
             $NewShortName = "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_" + $path_array.Item($item.Name) + $EndString
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($art_array.Item($item.Name) -ieq "PRG") -> false)'
             $NewShortName = $V + $path_array.Item($item.Name) + $EndString
-            #$NewShortName = $V
           }
         }
         else
         {
-          # '_A' oder '_L' entfernen
+          outLogVerbose 'else -> true (if/elseif ($art_array.Contains($item.Name)) -> false)'
           $test = $item.Name.Substring(0, $item.Name.Length - 2)
 
           if ( $key_array.ContainsKey($test))
           {
-            #$key_array.Item("OE_" + $oenum[0])++
-            #Write-Host "+++ gefunden +++: " $key_array.Item($test)
+            outLogVerbose 'if ($key_array.ContainsKey($test)) -> true'
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($key_array.ContainsKey($test)) -> false)'
             $cntNichtGelistet++
             $key_array.Add($test, $cntNichtGelistet)
-            #Write-Host "+++ insert +++: " $key_array.Count
           }
 
           $NewShortName = "VX_" + "nicht" + "_" + "gelistet" + "_" + $key_array.Item($test) + $EndString
-          #Write-Host "nicht gelistet: "  $item.Name " " $key_array.Item($test) " " $test " " $NewShortName
         }
 
         $NewFullName = $Institut + "GGX-" + $NewShortName
@@ -419,26 +346,20 @@ function ProcessADObjects
 
         if ( $Description.Contains("## keine Beschreibung ##"))
         {
+          outLogVerbose 'if ($Description.Contains("## keine Beschreibung ##")) -> true'
           $VA = $verantwortlicher_array.Item($item.Name)
-          #Write-Host $VA
           $Description = $Description + " Verantwortlicher: " + $VA
-          #Write-Host $NewFullName $Description
         }
 
         $FileSystemAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName; GUIProcessingNote = ""; OldName = $item.Name })
-        # $outFileEntry = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
-        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append    
         $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
         $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
 
-        Write-Host "-_-_-_-_: " $NewShortName
-        Write-Host "-_-_-_-_: " $NewFullName
       }
       $i = 1
 
       $CntPRG = 0000000
       $CntSON = 0100000
-      # $CntSPA = 0200000
       $CntSKL = 0200000
       $CntSPK = 0300000
       $CntVRZ = 0400000
@@ -450,29 +371,24 @@ function ProcessADObjects
 
       foreach ($item in $FileSystemAccessEntriesNew)
       {
-        # Write-Host "processing entry #"$i.ToString()
-        #$item | Select-Object -Property *
+        outLogVerbose 'foreach $item in $FileSystemAccessEntriesNew:' $item.OldName
         $item | Out-String
 
-        #if ($item.Name.Contains("GGF-VDA-")) {
-        #    continue
-        #}
 
 
         $roleType = "unknown"
-        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagFilesystemAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
+        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagFilesystemAccess } | Sort-Object { [int]$_.Order }
         foreach ($relevantRoleType in $relevantRoleTypes)
         {
+          outLogVerbose 'foreach $relevantRoleType in $relevantRoleTypes:' $relevantRoleType.TypeName
           if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
           {
+            outLogVerbose 'if ($item.OldName -cmatch $relevantRoleType.TagRegExp) -> true'
             $roleType = $relevantRoleType.TypeName
-            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
             break
           }
         }
 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
         $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
@@ -488,6 +404,7 @@ function ProcessADObjects
 
           if (-not $DKZ)
           {
+            outLogVerbose 'if (-not $DKZ) -> true'
             $MYANR = "9997"
           }
         }
@@ -499,9 +416,7 @@ function ProcessADObjects
 
         $FullPath = $fullpath_array.Item($item.OldName)
 
-        Write-Host $item.OldName " -> " "--- MYANR: " $MYANR ": " $VerzeichnisArt ": " $FullPath "!"
 
-        ###############################################
         $AWNRNEW = "9997"
         $EndString = ""
 
@@ -510,236 +425,269 @@ function ProcessADObjects
           $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
           if (-not $AWNRNEW)
           {
+            outLogVerbose 'if (-not $AWNRNEW) -> true'
             $AWNRNEW = "9998"
           }
 
-          Write-Host "AWNRNEW ----: " $AWNRNEW
         }
         catch
         {
-          Write-Host "AWNRNEW nicht gefunden: " $item.OldName
           $AWNRNEW = "9998"
           writeExceptionInfo $_ -Rethrow
         }
 
         if ($VerzeichnisArt -ieq "SKL")
         {
+          outLogVerbose 'if ($VerzeichnisArt -ieq "SKL") -> true'
           $ProfilNummer = "42" + ([string]$CntSKL).PadLeft(7, '0')
           $CntSKL++
 
           $ProfilName = "SKL " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SKL aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SKL lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "SON")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SON") -> true'
           $ProfilNummer = "42" + ([string]$CntSON).PadLeft(7, '0')
           $CntSON++
 
           $ProfilName = "SON " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SON aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SON lesen " + $NewFullName
           }
         }
 
         elseif ($VerzeichnisArt -ieq "AKT")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "AKT") -> true'
           $ProfilNummer = "42" + ([string]$CntAKT).PadLeft(7, '0')
           $CntAKT++
 
           $ProfilName = "AKT " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf AKT aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf AKT lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "MSV")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "MSV") -> true'
           $ProfilNummer = "42" + ([string]$CntMSV).PadLeft(7, '0')
           $CntMSV++
 
           $ProfilName = "MSV " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf MSV aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf MSV lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "PRO")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PRO") -> true'
           $ProfilNummer = "42" + ([string]$CntPRO).PadLeft(7, '0')
           $CntPRO++
 
           $ProfilName = "PRO " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf PRO aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf PRO lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "SPK")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SPK") -> true'
           $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
           $CntSPK++
 
           $ProfilName = "SPK " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
           }
         }
         elseif ($VerzeichnisArt -ieq "VRZ")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VRZ") -> true'
           $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
           $CntVRZ++
 
           $ProfilName = "VRZ " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "VOE")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VOE") -> true'
           $ProfilNummer = "42" + ([string]$CntVOE).PadLeft(7, '0')
           $CntVOE++
 
           $ProfilName = "VOE " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VOE aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VOE lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "PRG")
         {
-          Write-Host "AWNRNEW ----: " $AWNRNEW
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PRG") -> true'
 
           if ($AWNRNEW -ieq "9997")
           {
+            outLogVerbose 'if ($AWNRNEW -ieq "9997") -> true'
             $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
             $CntPRG++
           }
           elseif ($AWNRNEW -ieq "0000")
           {
+            outLogVerbose 'elseif ($AWNRNEW -ieq "0000") -> true'
             $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
             $CntPRG++
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($AWNRNEW -ieq "0000") -> false)'
             if ( $rbkey_array.ContainsKey("PAN_" + $AWNRNEW))
             {
+              outLogVerbose 'if ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> true'
               $rbkey_array.Item("PAN_" + $AWNRNEW)++
-              #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
             }
             else
             {
+              outLogVerbose 'else -> true (if/elseif ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> false)'
               $rbkey_array.Add("PAN_" + $AWNRNEW, 200)
-              #Write-Host "+++ insert +++: " $pkey_array.Count
             }
 
             $ProfilNummer = "40" + ([string]$AWNRNEW).PadLeft(4, '0') + $rbkey_array.Item("PAN_" + $AWNRNEW)
-            #$CntPRGDUM++
           }
 
-          #$ProfilNummer = "61" + ([string]$CntPRG).PadLeft(7, '0')
-          #$CntPRG++
-          #$NewFullName = $NewFullName.Replace("PRG_", "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_")
           $NewFullName = $NewFullName.Replace("PRG_", "PRG_")
 
           $ProfilName = "SIA " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SIA aendern " + $NewFullName.Replace($SPKID + "GGX-", "")
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SIA lesen " + $NewFullName.Replace($SPKID + "GGX-", "")
           }
 
         }
         elseif ($VerzeichnisArt -ieq "PRG12")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PRG12") -> true'
           $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
           $CntPRG++
 
           $ProfilName = "PROG " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf PRG aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf PRG lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "VRZ")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VRZ") -> true'
           $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
           $CntVRZ++
 
           $ProfilName = "VRZ " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "SPK")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SPK") -> true'
           $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
           $CntSPK++
 
           $ProfilName = "SPK " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
           }
 
@@ -747,113 +695,104 @@ function ProcessADObjects
 
         elseif ($VerzeichnisArt -ieq "PROG1")
         {
-          #Write-Host "Anwendungszugriff"
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PROG1") -> true'
           $ProfilNummer = $CntProgramm
           $CntProgramm++
 
           $ProfilName = "Anwendungsverzeichnis " + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf Programm aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf Programm lesen " + $NewFullName
           }
 
-          #nummer_array
           $AWNRNEW = "9997"
           $EndString = ""
 
           try
           {
-            #Write-Host "Anwendungszugriff"
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
             if (-not $AWNRNEW)
             {
+              outLogVerbose 'if (-not $AWNRNEW) -> true'
               $AWNRNEW = "9997"
             }
 
-            #Write-Host "----: " $AWNRNEW
           }
           catch
           {
-            Write-Host "Nicht gefunden: " $item.OldName
-            #Write-Host "Nicht gefunden: " $item.Name
           }
 
           try
           {
-            #Write-Host "Anwendungszugriff"
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $DKZ = $dkz_array.Item($item.OldName)
 
             if (-not $DKZ)
             {
+              outLogVerbose 'if (-not $DKZ) -> true'
               $DKZ = "XXXXX"
             }
 
             $bla = $NewFullName.Replace("-AV_", "-AZ_")
-            # $NewFullName = $DKZ + $bla.Substring(7)
             $NewFullName = $bla.Substring(7)
-            #Write-Host "----: " $AWNRNEW $DKZ $NewFullName
           }
           catch
           {
-            Write-Host "Nicht gefunden: " $item.OldName
             writeExceptionInfo $_ -Rethrow
           }
 
           if ( $pkey_array.ContainsKey("PAN_" + $AWNRNEW))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> true'
             $pkey_array.Item("PAN_" + $AWNRNEW)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> false)'
             $pkey_array.Add("PAN_" + $AWNRNEW, 1)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
 
-          # Profilnummer bauen: 50<AWNummer>9nn
           $ProfilNummer = "10" + $AWNRNEW + "" + ([string]$pkey_array.Item("PAN_" + $AWNRNEW)).PadLeft(3, '0')
-          #Write-Host $CntProgramm $NewFullName $item.OldName $ProfilNummer
         }
         elseif ($VerzeichnisArt -ieq "AW")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "AW") -> true'
           if ( $avkey_array.ContainsKey("AV_" + $MYANR))
           {
+            outLogVerbose 'if ($avkey_array.ContainsKey("AV_" + $MYANR)) -> true'
             $avkey_array.Item("AV_" + $MYANR)++
-            #Write-Host "+++ update +++: " $avkey_array.Item("AV_" + $MYANR)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($avkey_array.ContainsKey("AV_" + $MYANR)) -> false)'
             $avkey_array.Add("AV_" + $MYANR, 1)
-            #Write-Host "+++ insert +++: " $avkey_array.Count
           }
 
 
           $ProfilNummer = "40" + $MYANR.PadLeft(4, '0') + ([string]$avkey_array.Item("AV_" + $MYANR)).PadLeft(3, '0')
-          #Write-Host $ProfilNummer
           $CntAv++
 
           $ProfilName = "AW_" + $NewFullName
           if ( $NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf Anwendungsverzeichnisse aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf Anwendungsverzeichnisse lesen " + $NewFullName
           }
 
         }
         else
         {
-          #Write-Host "+-+-+-+-+-+-+- Unbekannte-Ablage: " $VerzeichnisArt
+          outLogVerbose 'else -> true (if/elseif ($VerzeichnisArt -ieq "AW") -> false)'
           try
           {
             $ProfilNummer = "97000" + ([string]$CntElse).PadLeft(4, '0')
@@ -870,68 +809,56 @@ function ProcessADObjects
         $dum = $verantwortlicher_array.Item($item.OldName)
         if ($dum)
         {
+          outLogVerbose 'if ($dum) -> true'
           if ( $dum.StartsWith("S" + $SPKNO))
           {
+            outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
             $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
           }
         }
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
           $dum = "0570000/0012"
         }
-        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("P030GGX-", "") + ";" + $ProfilName + ";" + $dum + ";" + $item.OldName | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
-
-        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("Z001GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";" + $VerzeichnisArt | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
 
 
-        #Fullpath $FullPath
 
-        # ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
+
         $KURSSollProfileOutLine = ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt
         $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
 
 
         foreach ($item1 in $ADObjectMemberships)
         {
+          outLogVerbose 'foreach $item1 in $ADObjectMemberships:' $item1.GroupName
           if ($item1.GroupName -ieq $item.OldName)
           {
+            outLogVerbose 'if ($item1.GroupName -ieq $item.OldName) -> true'
             if ($item1.MemberClass -ieq "user")
             {
-              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
-              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+              outLogVerbose 'if ($item1.MemberClass -ieq "user") -> true'
               $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + ""
               $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
 
-              # Kurs Daten schreiben
-              #Write-Host $u.MemberName $mitarbeiter_array.Item($u.MemberName)
               $dum = $mitarbeiter_array.Item($item1.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $item1.MemberName
               }
-              # dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
               $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"
               $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
             }
             elseif ($item1.MemberClass -ieq "group")
             {
-              # O(1) index lookup instead of a full linear scan over $ADObjectMemberships.
-              # Key matches buildAllUserMembershipsCache: GroupName + "|" + MemberClass.
-              #edmond
-              # $userKey = $item1.MemberName + "|user"
-              # $userKey = getMembershipIndexKey $item1.MemberName "user"
-              # $users = $null
-              # if (-not $membershipIndex.TryGetValue($userKey, [ref] $users))
-              # {
-              #   $users = [System.Collections.Generic.List[object]]::new()
-              # }             
+              outLogVerbose 'elseif ($item1.MemberClass -ieq "group") -> true'
               $users = getUsersByMemberGroup $item1.MemberName
 
               foreach ($u in $users)
               {
-                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
-                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+                outLogVerbose 'foreach $u in $users:' $u.MemberName
                 $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName
                 $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
               }
@@ -947,12 +874,11 @@ function ProcessADObjects
       writeExceptionInfo $_ -Rethrow 
     }
 
-    #exit
   }
 
-  # AppAccess ---------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagAppAccess)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagAppAccess) -> true'
     try
     {
 
@@ -966,87 +892,72 @@ function ProcessADObjects
       $Verantwortlicher
       $MyKey
 
-      # Anwendungsliste einlesen
-      # Nr. -> wird verwendet
-      # AWK -> wird verwendet
-      # FullAccount -> wird verwendet
-      # Verzeichnisname
-      # Endpunktname 
-      # Gruppe Ändern 
-      # Verantwortlicher -> wird verwendet
 
 
       foreach ($item in $AnwendungenFilePathEntries)
       {
+        outLogVerbose 'foreach $item in $AnwendungenFilePathEntries:' $item.'Nr.'
         $Verantwortlicher = $item.'Verantwortlicher (FPV)'
 
-        #write-host "-----------------: "  $Verantwortlicher
 
         if (-not $Verantwortlicher)
         {
+          outLogVerbose 'if (-not $Verantwortlicher) -> true'
           $Verantwortlicher = "0570000/0012"
         }
         else
         {
+          outLogVerbose 'else -> true (if/elseif (-not $Verantwortlicher) -> false)'
           if ( $Verantwortlicher.StartsWith("S" + $SPKNO))
           {
+            outLogVerbose 'if ($Verantwortlicher.StartsWith("S" + $SPKNO)) -> true'
             $dum = $mitarbeiterStelle_array.Item($Verantwortlicher)
             $Verantwortlicher = $dum
           }
         }
         $MyKey = $item.FullAccount.Split('\')
 
-        Write-Host "-----------------:" $MyKey[0] $MyKey[1]
 
-        Write-Host "#############-------------:" $MyKey[1] $item.'Nr.' $Verantwortlicher
 
         if ($MyKey[1])
         {
+          outLogVerbose 'if ($MyKey[1]) -> true'
           if (-not $nummer_array.ContainsKey($MyKey[1]))
           {
+            outLogVerbose 'if (-not $nummer_array.ContainsKey($MyKey[1])) -> true'
             $nummer_array[$MyKey[1]] = $item.'Nr.'
             $verantwortlicher_array[$MyKey[1]] = $Verantwortlicher
             $kz_array[$MyKey[1]] = $item.'AWK'
-            # $item.'Beschreibung' was changed to $item.'Beschreibung (256 Zeichen)'
             $beschreibung_array[$MyKey[1]] = $item.'Beschreibung (256 Zeichen)'
-            Write-Host "+++--------------:" $item.'Nr.' $Verantwortlicher $item.'AWK'
           }
         }
       }
 
-      #Exit
 
       $AppAccessEntries = Import-Csv -Path $AppAccessTmpFilePath -Delimiter ";"
-      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
       $AppAccessEntriesNew = [System.Collections.Generic.List[object]]::new()
       foreach ($item in $AppAccessEntries)
       {
+        outLogVerbose 'foreach $item in $AppAccessEntries:' $item.Name
 
-        # Anwendungsnummer fuer Objekt suchen
         $AWNR = $nummer_array.Item($item.Name)
-        Write-Host "--------: " $item.Name $AWNR
-        # Wenn nicht gefunden mit '9999' besetzen
         if (-not $AWNR)
         {
+          outLogVerbose 'if (-not $AWNR) -> true'
           $AWNR = 9000
         }
-        # Nummer 4 stellig mit fuehrenden Nullen auffuellen
         $AWNR = ([string]$AWNR).PadLeft(4, '0')
-        # Shortcut setzen
         $ShortCut = "AZ_"
-        # Ausnahme fuer Shortcut (z.B. VRZ) wenn 'GGF-', laut N.Z. fuer alle Kassen da von FI gesetzt
         if ( $item.Name.Contains("GGF-"))
         {
+          outLogVerbose 'if ($item.Name.Contains("GGF-")) -> true'
           $ShortCut = "AZ_"
         }
 
         $NewShortName = $ShortCut + $AWNR + "_" + $item.Name.Substring($item.Name.IndexOf('-') + 1)
         $NewFullName = $Institut + "GGX-" + $NewShortName.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")
-        #Serviceportal
 
         $AppAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName.Replace("Serviceportal", "SVP"); GUIProcessingNote = ""; OldName = $item.Name })
-        # $outFileEntry = $Institut + ";" + $NewFullName + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
-        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
         $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
         $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
       }
@@ -1057,28 +968,27 @@ function ProcessADObjects
 
       foreach ($item in $AppAccessEntriesNew)
       {
-        # Write-Host "processing entry #"$i.ToString()
+        outLogVerbose 'foreach $item in $AppAccessEntriesNew:' $item.OldName
 
         $roleType = "unknown"
-        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagAppAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
+        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagAppAccess } | Sort-Object { [int]$_.Order }
         foreach ($relevantRoleType in $relevantRoleTypes)
         {
+          outLogVerbose 'foreach $relevantRoleType in $relevantRoleTypes:' $relevantRoleType.TypeName
           if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
           {
+            outLogVerbose 'if ($item.OldName -cmatch $relevantRoleType.TagRegExp) -> true'
             $roleType = $relevantRoleType.TypeName
-            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
             break
           }
         }
 
         if ($item.OldName -like "*GGT-0-*")
         {
+          outLogVerbose 'if ($item.OldName -like "*GGT-0-*") -> true'
           $roleType = "ApplicationSIA"
-          Write-Host "---------------:" $roleType $item.OldName
         }
 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
         $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
@@ -1086,9 +996,9 @@ function ProcessADObjects
 
         $NeueBeschreibung = ""
 
-        # Muell
         if ($item.'GUIADGroup.Name' -like "*GGX-A_*")
         {
+          outLogVerbose 'if ($item.''GUIADGroup.Name'' -like "*GGX-A_*") -> true'
           $PnrStr = ([string]$ProfilNummerAZ).PadLeft(3, '0')
           $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')
           $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
@@ -1099,64 +1009,58 @@ function ProcessADObjects
 
           $aname = $item.'GUIADGroup.Name'.Substring(15)
 
-          Write-Host "++++++++++: " $aname $item.'GUIADGroup.Name'
 
           if ($dum)
           {
+            outLogVerbose 'if ($dum) -> true'
             if ($dum.StartsWith("S" + $SPKNO))
             {
+              outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
               $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
             }
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
             $dum = "0570000/0012"
           }
 
           if ( $pkey_array.ContainsKey("PAZ_" + $AWNR))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> true'
             $pkey_array.Item("PAZ_" + $AWNR)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> false)'
             $pkey_array.Add("PAZ_" + $AWNR, 1000)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
 
-          #$PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
 
-          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           if ($AWNR -ieq "0000")
           {
+            outLogVerbose 'if ($AWNR -ieq "0000") -> true'
             $AWNR = "9000"
           }
 
           $ProfilNummerAZ++
-          Write-Host "-+++++: " $ProfilNummerAZ
-          Write-Host "++++++: " $PnrStr
 
-          ##"4" + $AWNR + "" + ($PnrStr).ToString() + ";" + $kz + "-" + $aname + ";" + $ProfilName.Replace("P030GGX-", "") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
-          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"
           $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
 
           $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
-          #Write-Host "---: " $item.'GUIADGroup.Name'
           $ProfilNummerAZ++
         }
-        # Anwendungszugriff
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($item.''GUIADGroup.Name'' -like "*GGX-A_*") -> false)'
           $AWK = "1"
           $PnrStr = ([string]$ProfilNummerAV).PadLeft(3, '0')
           $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')
 
           $AWK = ([string]$kz_array.Item($item.OldName)).PadLeft(5, '0')
 
-          #$kz_array.Add($MyKey[1], $item.'AWK')
 
-          #$ProfilName = "Anwendungsverzeichnis " + $item.'GUIADGroup.Name'
           $dum = $verantwortlicher_array.Item($item.OldName)
 
           $kz = $kz_array.Item($item.OldName)
@@ -1166,113 +1070,100 @@ function ProcessADObjects
 
           if (-not $NeueBeschreibung)
           {
+            outLogVerbose 'if (-not $NeueBeschreibung) -> true'
             $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif (-not $NeueBeschreibung) -> false)'
             $ProfilName = $NeueBeschreibung
           }
 
-          Write-Host "+++ neue Beschreibung +++: " $ProfilName
-          #$ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
 
-          Write-Host "########: " $aname $item.'GUIADGroup.Name' $AWK
 
           if ($dum)
           {
+            outLogVerbose 'if ($dum) -> true'
             if ($dum.StartsWith("S" + $SPKNO))
             {
+              outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
               $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
             }
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
             $dum = "0570000/0012"
           }
 
           if (-not $kz)
           {
+            outLogVerbose 'if (-not $kz) -> true'
             $kz = "XXXXX"
           }
 
           if ( $pkey_array.ContainsKey("PAZ_" + $AWNR))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> true'
             $pkey_array.Item("PAZ_" + $AWNR)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
           }
           else
           {
-            #$pkey_array.Add("PA_" + $AWNR, 500)
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> false)'
             $pkey_array.Add("PAZ_" + $AWNR, 100)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
 
           $PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
-          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
-          ##$NNNAME = $kz + "-" + $aname
 
-          #Anwendungsnummer im Namen
           $NNNAME = "AZ_" + $AWNR + $aname
 
-          #Anwendungskuerzel im Namen
-          #$NNNAME = "AZ_" + $AWK + $aname
 
 
           if ($AWNR -ieq "0000")
           {
+            outLogVerbose 'if ($AWNR -ieq "0000") -> true'
             $AWNR = "9998"
           }
-          Write-Host "-+++++: " $ProfilNummerAV
-          Write-Host "++++++: " $PnrStr
 
           $MYDESC007 = $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")
 
-          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"
           $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
           $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
           $ProfilNummerAV++
         }
-        #            foreach ($userMemberShip in $userMemberShips) {
 
 
         foreach ($item1 in $ADObjectMemberships)
         {
+          outLogVerbose 'foreach $item1 in $ADObjectMemberships:' $item1.GroupName
 
           if ($item1.GroupName -ieq $item.OldName)
           {
-            #Write-Host $item1.MemberClass ": " $item.OldName
+            outLogVerbose 'if ($item1.GroupName -ieq $item.OldName) -> true'
             if ($item1.MemberClass -ieq "user")
             {
-              #Write-Host "User"
-              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
-              #$Institut + ";" + "RoleRalph" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+              outLogVerbose 'if ($item1.MemberClass -ieq "user") -> true'
               $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName
               $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
 
-              # Kurs Daten schreiben
               $dum = $mitarbeiter_array.Item($item1.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $item1.MemberName
               }
-              # $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append                        
               $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"
               $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
             }
             elseif ($item1.MemberClass -ieq "group")
             {
-              # BUGFIX 2026-07-05: this assignment was deleted during comment cleanup.
-              # Without it, $users is empty/stale here and the foreach below never emits
-              # the indirect (group-inherited) AZ_* membership rows (83,532 rows lost).
+              outLogVerbose 'elseif ($item1.MemberClass -ieq "group") -> true'
               $users = getUsersByMemberGroup $item1.MemberName
               foreach ($u in $users)
               {
-                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
-                #$Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+                outLogVerbose 'foreach $u in $users:' $u.MemberName
                 $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName
                 $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
               }
@@ -1288,60 +1179,61 @@ function ProcessADObjects
       writeExceptionInfo $_ -Rethrow
     }
   }
-  # AppConfiguration ---------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagAppConfiguration)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagAppConfiguration) -> true'
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
 
 
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1)
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
 
-      Write-Host $DisplayName
 
       $NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
 
       if ( $NewFullName.Contains("IntExK"))
       {
+        outLogVerbose 'if ($NewFullName.Contains("IntExK")) -> true'
         continue
       }
 
       if ($DisplayName -eq "AK_WEB_SSKMG-STD")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_SSKMG-STD") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
       }
       if ($DisplayName -eq "AK_IEK_Admins")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_IEK_Admins") -> true'
         $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
       }
       if ($DisplayName -eq "AK_OFK_Office_Default")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_OFK_Office_Default") -> true'
         $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
       }
       if ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
       }
       if ($DisplayName -eq "AK_WEB_OhneIntranet")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_OhneIntranet") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
       }
 
-      #Write-Host $NewFullName
-      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
-      #Write-Host $NewFullName
 
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName
-      # $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
     }
 
-    #Exit
 
     $i = 1
     $PNR = 1000000
@@ -1351,75 +1243,62 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      Write-Host "processing entry #" $i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1)
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
-      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
 
-      #450000000	AKO_OFFK_Office_Default
-      #460000000	AKE_IntExK_Admins
-      #480000000	AKW_WEB_SSKMG-STD
-      #480000001	AKW_WEB_IE_ALT_Videoueberwachung
-      #480000002	AKW_WEB_OhneIntranet
 
       $NewFullName = $Institut + $DisplayName
       if ($DisplayName -eq "AK_WEB_SSKMG-STD")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_SSKMG-STD") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
         $MPNR = 500000001
       }
       elseif ($DisplayName -eq "AK_IEK_Admins")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_IEK_Admins") -> true'
         $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
         $MPNR = 500000002
       }
       elseif ($DisplayName -eq "AK_OFK_Office_Default")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_OFK_Office_Default") -> true'
         $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
         $MPNR = 500000003
       }
       elseif ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
         $MPNR = 500000004
       }
       elseif ($DisplayName -eq "AK_WEB_OhneIntranet")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_WEB_OhneIntranet") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
         $MPNR = 500000005
       }
       else
       {
+        outLogVerbose 'else -> true (if/elseif ($DisplayName -eq "AK_WEB_OhneIntranet") -> false)'
         $NewFullName = $DisplayName
         $MPNR = $DUMPNR
-        #$DUMPNR++;
       }
 
 
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
       $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       $NewFullName1 = $NewFullName
-      #$StelleVerant = "9999999/9999"
-      #$StelleVerant = "3410200/0015"
 
-      ## Richtige Stelle
 
-      $StelleVerant = "0570000/0012" #auch fuer SEC, WEBBROWSER
+      $StelleVerant = "0570000/0012"
 
-      Write-Host 1
-      Write-Host $MPNR
-      Write-Host $NewFullName1
-      Write-Host $StelleVerant
-      Write-Host $adObjectEntry.OldName
-      Write-Host 6
 
-      # "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
       $KURSSollProfileOutLine = "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $PNR++
@@ -1427,27 +1306,24 @@ function ProcessADObjects
 
       foreach ($userMemberShip in $userMemberShips)
       {
-        # Fehler
-        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" +  "" + ";" +  "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
-        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
-        #Write-Host "## o: " $userMemberShip.Origin
 
         $persnr = "0000000000"
-        #$ProfilNR = "4000007000"
         $ProfilNR = "" + $DUMPNR
 
         if ($userMemberShip.Origin -ieq "user")
         {
-          #Write-Host "##: " + $userMemberShip.MemberName
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
@@ -1457,9 +1333,6 @@ function ProcessADObjects
             outLog "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
-          #Write-Host "PN: " + $persnr
-          # Kurs Daten schreiben
-          # persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1468,9 +1341,9 @@ function ProcessADObjects
       $i++
     }
   }
-  # AppOrganisation ---------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagOrganisation)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagOrganisation) -> true'
 
     $i = 1
     $ProfilNummer = 1
@@ -1478,15 +1351,14 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
 
-      # DAWGruppenAnlegenOutArray füllen
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1)
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
 
       $NewFullName = $Institut + "GGX-" + $DisplayName
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG")
-      #$DisplayName1 = $DisplayName.Replace("O_G_", "OG_G_")
       $DisplayName1 = $DisplayName.Replace("O_", "OG_")
 
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
@@ -1497,15 +1369,7 @@ function ProcessADObjects
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName1 + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName1 + ";" + "" + ";" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
 
-      # Write-Host "processing entry #"$i.ToString()
-      # not used here, see above 
-      # $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
-      # $TempString = $adObjectEntry.ObjectName.Split('-')
-      # $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
-      # $NewFullName = $Institut + "GGX-" + $DisplayName 
-      # $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG") 
 
-      #$roleType = getRoleType $adObjectEntry $roletypeTag
 
       $roleType = "Organisation"
 
@@ -1513,11 +1377,9 @@ function ProcessADObjects
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
       $PnrStr = ([string]$ProfilNummer).PadLeft(2, '0')
-      # $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(3, '0')
       $AWNR = "xxxx"
       $ProfilName = "Organisatorische Gruppe " + $NewFullName1
       $ProfilNR++
-      #$ProfilNR = "48" + $AWNR + "7" + ($PnrStr).ToString()
 
       $KURSSollProfileOutLine = [string]$ProfilNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + $ProfilName.Replace($SPKID + "GGX-OG_", "") + ";" + "0570000/0012" + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";OG"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
@@ -1525,37 +1387,32 @@ function ProcessADObjects
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
       foreach ($userMemberShip in $userMemberShips)
       {
-        # Fehler laut Norbert
-        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
-        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass
-        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append
-        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass
 
-        #$userMemberShip | Out-String
 
         $persnr = "0000000000"
 
         if ($userMemberShip.Origin -ieq "user")
         {
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
           }
           catch
           {
-            Write-Host "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
 
-          # Kurs Daten schreiben
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "Organisation"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1565,27 +1422,27 @@ function ProcessADObjects
     }
   }
 
-  # Security ------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagSecurity)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagSecurity) -> true'
 
     $SicherheitseinstellungenFilePath = $SecurityInFilePath
     $SicherheitseinstellungenFilePathEntries = Get-Content -Path $SicherheitseinstellungenFilePath | ConvertFrom-Csv -Delimiter ";"
     $sec_array = @{ "nummer" = "nummer" }
     foreach ($item in $SicherheitseinstellungenFilePathEntries)
     {
-      #write-host $item.Name $item.Verantwortlicher
+      outLogVerbose 'foreach $item in $SicherheitseinstellungenFilePathEntries:' $item.Name
       $sec_array[$item.Name] = $item.Verantwortlicher
     }
 
-    #exit
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.OldName
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
-      Write-Host "--++ OLDNAME: " $adObjectEntry.OldName
       if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
       {
+        outLogVerbose 'if ($adObjectEntry.OldName.Contains($SPKID + "GDT")) -> true'
         continue
       }
 
@@ -1595,33 +1452,24 @@ function ProcessADObjects
 
       $NewFullName = $Institut + "GGX-" + $DisplayName
 
-      Write-Host "Sicherheit: " + $NewFullName + $DisplayName + $NewFullName.Replace($SPKID + "GGX-S_", "SE_")
 
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName
-      # $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
-      Write-Host "--++ OLDNAME: Ende"
     }
 
-    # --- once, before the loop -------------------------------------------------
-    # Parametrised PN prefixes:
-    #   $pnPrefix1 = two-digit numeric string  (e.g. "43")
-    #   $pnPrefix2 = four-digit numeric string (e.g. "9000")
-    # Final PN = prefix1 + prefix2 + three-digit suffix from the CSV.
     $pnPrefix1 = "43"
     $pnPrefix2 = "9000"
-    # Load the ordered rule list. Order in the file = match priority (most specific
-    # first), exactly like the original if/elseif cascade.
   
     $pnRules = [System.Collections.Generic.List[object]]::new()
     foreach ($row in $SPK.ProfileNumberMappings)
     {
+      outLogVerbose 'foreach $row in $SPK.ProfileNumberMappings:' $row
       $pnRules.Add([pscustomobject]@{
           Pattern = $row.Pattern
-          PN      = $pnPrefix1 + $pnPrefix2 + $row.Suffix   # e.g. "43" + "9000" + "017"
+          PN      = $pnPrefix1 + $pnPrefix2 + $row.Suffix
         })
     }
 
@@ -1632,12 +1480,12 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      #Write-Host "processing entry #"$i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.OldName
 
-      Write-Host "OLDNAME: " $adObjectEntry.OldName
 
       if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
       {
+        outLogVerbose 'if ($adObjectEntry.OldName.Contains($SPKID + "GDT")) -> true'
         continue
       }
 
@@ -1647,44 +1495,41 @@ function ProcessADObjects
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
       $NewFullName = $Institut + "GGX-" + $DisplayName
 
-      #Write-Host "----------------------------------------------" $DisplayName $NewFullName
 
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
       $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
       $PN = $null
       foreach ($rule in $pnRules)
       {
+        outLogVerbose 'foreach $rule in $pnRules:' $rule
         if ($DisplayName.Contains($rule.Pattern))
         {
+          outLogVerbose 'if ($DisplayName.Contains($rule.Pattern)) -> true'
           $PN = $rule.PN
-          break                      # first match wins, just like elseif
+          break
         }
       }   
       if ($null -eq $PN)
       {
-        # the original 'else' branch
+        outLogVerbose 'if ($null -eq $PN) -> true'
         $PN = ($ProfilNummerSonstigesStartWert + $iSonstiges).ToString()
         $iSonstiges++
       }
 
-      #############################################
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")
 
-      Write-Host $NewFullName1
 
       $StelleVerant = $sec_array.Item($adObjectEntry.OldName)
 
-      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
       $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       foreach ($userMemberShip in $userMemberShips)
       {
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
@@ -1693,24 +1538,23 @@ function ProcessADObjects
 
         if ($userMemberShip.Origin -ieq "user")
         {
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
           }
           catch
           {
-            Write-Host "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
 
-          # Kurs Daten schreiben
-          # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1719,11 +1563,12 @@ function ProcessADObjects
     }
   }
 
-  # Anwenderrollen ------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagRole)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagRole) -> true'
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
 
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1)
       $TempString = $adObjectEntry.ObjectName.Split('-')
@@ -1731,16 +1576,12 @@ function ProcessADObjects
 
       $NewFullName = $SPKID + "GGX-" + $DisplayName 
 
-      Write-Host "Rolle: " + $NewFullName + $DisplayName + $NewFullName
 
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName
-      #$Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace("P030GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | out-file $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
     }
 
-    # BUGFIX 2026-07-02: re-enabled - with this commented out, the allowlist filter
-    # below never ran and entries the original cascade skipped were processed.
     $prefixMatcher = buildPrefixMatcher $KURSProfilePrefixes
 
     $ProfilNummer = 470000000
@@ -1751,87 +1592,72 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      # Write-Host "processing entry #"$i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1)
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
       $NewFullName = $Institut + "GGX-" + $DisplayName
-      #Write-Host "--##++ So sollte der Name lauten: "  $adObjectEntry.OldName
    
-      # ===== This single check REPLACES the entire 1000-branch if/elseif cascade =====
-      # Original behaviour: known prefix -> continue processing; unknown -> 'continue'.
-      # BUGFIX 2026-07-02: re-enabled. Note: the original cascade's FIRST branch is
-      #   if ($OldName.StartsWith($SPKID + "GUX")) { }   <- empty body, NO 'continue'
-      # i.e. GUX entries fall through and ARE processed. The explicit check below
-      # preserves that regardless of whether $SPKID + "GUX" is listed in the prefix CSV.
       if (-not ($adObjectEntry.OldName.StartsWith($SPKID + "GUX")) -and
         -not (testKnownPrefixes $adObjectEntry.OldName $prefixMatcher))
       {
+        outLogVerbose 'if (-not ($adObjectEntry.OldName.StartsWith($SPKID + "GUX")) -and -not (testKnownPrefixes $adObjectEntry.OldName $ ...) -> true'
         continue
       }
 
-      #R125GGX-Energieberater
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
       if ( $NewFullName.Contains("R_LM_"))
       {
+        outLogVerbose 'if ($NewFullName.Contains("R_LM_")) -> true'
         $PN = ($ProfilNummerLM).ToString()
         $ProfilNummerLM++
         $NewFullName = $NewFullName.Replace("AR_LM_", "LM_")
       }
       else
       {
+        outLogVerbose 'else -> true (if/elseif ($NewFullName.Contains("R_LM_")) -> false)'
         $PN = ($ProfilNummer + $iSonstiges).ToString()
         $iSonstiges++
       }
-      #Write-Host $PN
-      #Write-Host $NewFullName
 
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")
 
-      Write-Host $NewFullName1
 
-      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
       $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       if (1 -lt 2)
       {
+        outLogVerbose 'if (1 -lt 2) -> true'
         foreach ($userMemberShip in $userMemberShips)
         {
-          # Fehler
-          #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
-          # $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+          outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
           $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
           $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
-          #Write-Host "TypeTagSecurity: " $userMemberShip.MemberClass
-          #$userMemberShip | Out-String
 
 
           $persnr = "0000000000"
 
           if ($userMemberShip.Origin -ieq "user")
           {
+            outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
             try
             {
               $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
               $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $userMemberShip.MemberName
               }
               $persnr = $dum
             }
             catch
             {
-              Write-Host "User nicht gefunden: " $u.MemberName
               writeExceptionInfo $_ -Rethrow
             }
 
-            # Kurs Daten schreiben
-            # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
             $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW"
             $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
           }
@@ -1842,42 +1668,38 @@ function ProcessADObjects
   }
 
 
-  # ===== Post-processing of output collections (2026-07-05) =====================
-  # 1) All collections are sorted ONCE before writing (deterministic, culture-
-  #    independent ordinal order). Inline writes stay unsorted and cheap.
-  # 2) The 'Neu' Gruppenverwaltung variant is no longer produced along the way;
-  #    it is DERIVED from the sorted Out list: rows assigning an account to a
-  #    target group (Accounts.Add non-empty) are grouped by GUIADGroup.LDAP.
-  #    The first row of each group keeps all columns; subsequent rows carry only
-  #    the Accounts.Add column. Rows without an account assignment (e.g. group
-  #    creation rows) pass through unchanged.
   $ordinalComparer = [System.StringComparer]::Ordinal
   $DAWGruppenAnlegenOutList.Sort($ordinalComparer)
   $DAWGruppenverwaltungOutList.Sort($ordinalComparer)
   $KURSSollProfileOutList.Sort($ordinalComparer)
   $KURSIstMitarbeiterProfileOutList.Sort($ordinalComparer)
+  removeDuplicatesFromSortedList $DAWGruppenAnlegenOutList "DAWGruppenAnlegenOutList"
+  removeDuplicatesFromSortedList $DAWGruppenverwaltungOutList "DAWGruppenverwaltungOutList"
+  removeDuplicatesFromSortedList $KURSSollProfileOutList "KURSSollProfileOutList"
+  removeDuplicatesFromSortedList $KURSIstMitarbeiterProfileOutList "KURSIstMitarbeiterProfileOutList"
 
   $DAWGruppenverwaltungNeuOutList.Clear()
   $lastLdap = $null
   foreach ($outLine in $DAWGruppenverwaltungOutList)
   {
+    outLogVerbose 'foreach $outLine in $DAWGruppenverwaltungOutList:' $outLine
     $cols = $outLine.Split(";")
     if ([string]::IsNullOrEmpty($cols[5]))
     {
-      # no account assignment -> pass through unchanged
+      outLogVerbose 'if ([string]::IsNullOrEmpty($cols[5])) -> true'
       $DAWGruppenverwaltungNeuOutList.Add($outLine)
       $lastLdap = $null
       continue
     }
     if ($cols[2] -cne $lastLdap)
     {
-      # first row of a GUIADGroup.LDAP block -> all columns
+      outLogVerbose 'if ($cols[2] -cne $lastLdap) -> true'
       $DAWGruppenverwaltungNeuOutList.Add($outLine)
       $lastLdap = $cols[2]
     }
     else
     {
-      # subsequent row of the same block -> only GUIADGroup.Accounts.Add.LDAPs
+      outLogVerbose 'else -> true (if/elseif ($cols[2] -cne $lastLdap) -> false)'
       $DAWGruppenverwaltungNeuOutList.Add(";;;;;" + $cols[5] + ";;;;")
     }
   }
diff --git a/Process-ADObjects-Work-Y015.ps1 b/Process-ADObjects-Work-Y015.ps1
index d837b57..5d70058 100644
--- a/Process-ADObjects-Work-Y015.ps1
+++ b/Process-ADObjects-Work-Y015.ps1
@@ -20,14 +20,15 @@ function ProcessADObjects
   $DAWGruppenverwaltungNeuOutList = [System.Collections.Generic.List[string]]::new()
   $KURSSollProfileOutList = [System.Collections.Generic.List[string]]::new()
   $KURSIstMitarbeiterProfileOutList = [System.Collections.Generic.List[string]]::new()
-  # Mitarbeiter einlesen und Persnr zu S-Userid in Array speichern
   $MitarbeiterEntries = Get-Content -Path $MitarbeiterInFilePath | ConvertFrom-Csv -Delimiter ";"
   $mitarbeiter_array = @{"mitarbeiter" = "mitarbeiter"}
   $mitarbeiterStelle_array = @{"mitarbeiter" = "stelle"}
   foreach ($item in $MitarbeiterEntries)
   {
+    outLogVerbose 'foreach $item in $MitarbeiterEntries:' $item.'St.-Nr.'
     if ([System.String]::IsNullOrEmpty($item.Benutzerkennung))
     {
+      outLogVerbose 'if ([System.String]::IsNullOrEmpty($item.Benutzerkennung)) -> true'
       continue
     }
     try
@@ -48,11 +49,10 @@ function ProcessADObjects
   $pkey_array = @{"key" = 0}
   $rbkey_array = @{"key" = 0}
         
-  # FileSystemAccess ---------------------------------------------
   if ($roletypeTag -ieq $FI.TypeTagFilesystemAccess)
   {
+    outLogVerbose 'if ($roletypeTag -ieq $FI.TypeTagFilesystemAccess) -> true'
 
-    # ToDo: Anwendungszugriff: Mapping #$AnwendungenFilePath $item.Verzeichnisname, Anwendungen werden nicht gefunden
 
     try
     {
@@ -65,16 +65,16 @@ function ProcessADObjects
 
       foreach ($item in $AnwendungenFilePathEntries)
       {
+        outLogVerbose 'foreach $item in $AnwendungenFilePathEntries:' $item.Verzeichnisname
         if ([System.String]::IsNullOrEmpty($item.Verzeichnisname))
         {
+          outLogVerbose 'if ([System.String]::IsNullOrEmpty($item.Verzeichnisname)) -> true'
           continue
         }
         try
         {
-          Write-Host $item.Verzeichnisname + $item.'Nr.'
           $nummer_array[$item.Verzeichnisname] = $item.'Nr.'
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow
@@ -83,33 +83,12 @@ function ProcessADObjects
 
 
        
-      # UTF / ANSI conflict workaround
-      # $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | ConvertFrom-Csv -Delimiter ";" 
 
-      # Einlesen der Datei XXXX_Verzeichnisse.csv
-      # "Verzeichnisname" -> wird verwendet
-      # "Normierter Pfad" -> wird verwendet
-      # "Kontrolle" 
-      # "Endpunktname" 
-      # "Verzeichnisbuchstabe" 
-      # "Verzeichnisart" -> wird verwendet
-      # "AWNR" -> wird verwendet
-      # "Anwendungskuerzel" -> wird verwendet
-      # "Gruppe Lesen" -> wird verwendet
-      # "Gruppe Aendern" -> wird verwendet
-      # "Benutzer mit Leserecht" 
-      # "Benutzer mit Aenderungsrecht" 
-      # "Rollen mit Leserecht" 
-      # "Rollen mit Aenderungsrecht" 
-      # "Name Verantwortlicher" 
-      # "Verantwortlicher (Stelle oder Personalnummer)" -> wird verwendet
 
-      #$header = "Verzeichnisname", "Normierter Pfad" , "Kontrolle" , "Endpunktname", "Verzeichnisbuchstabe", "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Benutzer mit Leserecht", "Benutzer mit Aenderungsrecht", "Rollen mit Leserecht", "Rollen mit Aenderungsrecht", "Name Verantwortlicher", "Verantwortlicher (Stelle oder Personalnummer)" 
 
       $header = "Verzeichnisname", "Normierter Pfad" , "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Verantwortlicher (Stelle oder Personalnummer)" 
       $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";" -Header $header
         
-      # Arrays mit Zusatzdaten
       $art_array = @{"art" = "art"}
       $path_array = @{"path" = "path"}
       $endpunkt_array = @{"endpunkt" = "endpunkt"}
@@ -120,40 +99,22 @@ function ProcessADObjects
 
       foreach ($item in $DirectoriesFilePathEntries)
       {
-        # Arrays mit Zusatzdaten fuellen
-        # $item | Out-String
+        outLogVerbose 'foreach $item in $DirectoriesFilePathEntries:' $item.Verzeichnisname
         try
         {
-          # $art_array.Add($item.'Gruppe Lesen', $item.Verzeichnisart)
-          #Write-Host "----: " $item.Verzeichnisart " :----"
-          # $path_array.Add($item.'Gruppe Lesen', $item.'Normierter Pfad')
-          # $verantwortlicher_array.Add($item.'Gruppe Lesen', $item.'Verantwortlicher (Stelle oder Personalnummer)')
-          # $dkz_array.Add($item.'Gruppe Lesen', $item.Anwendungskuerzel)
-          # $dnummer_array.Add($item.'Gruppe Lesen', $item.AWNR)
-          # $fullpath_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
-          # $fullpath_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
-          #Write-Host "----: " $item.'Gruppe Lesen' $item.Verzeichnisart $item.Anwendungskuerzel $item.AWNR          
-          #Write-Host $item.'Gruppe Lesen' " -> " "----: " $item.Verzeichnisname " :----"
 
-          # Neu auch Aendern betrachten
-          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
-          # $dkz_array.Add($item.'Gruppe Aendern', $item.Anwendungskuerzel)
-          # $dnummer_array.Add($item.'Gruppe Aendern', $item.AWNR)
           $art_array[$item.'Gruppe Lesen'] = $item.Verzeichnisart         
           $path_array[$item.'Gruppe Lesen'] = $item.'Normierter Pfad' 
           $verantwortlicher_array[$item.'Gruppe Lesen'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
           $dkz_array[$item.'Gruppe Lesen'] = $item.Anwendungskuerzel
           $dnummer_array[$item.'Gruppe Lesen'] = $item.AWNR
-          Write-Host $item.'Gruppe Lesen' $item.AWNR
           $fullpath_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
           $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
           $dkz_array[$item.'Gruppe Aendern'] = $item.Anwendungskuerzel
           $dnummer_array[$item.'Gruppe Aendern'] = $item.AWNR
-          Write-Host $item.'Gruppe Aendern' $item.AWNR
 
           $fullpath_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
@@ -161,27 +122,17 @@ function ProcessADObjects
         try
         {
           $endpunkt_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
-          # $endpunkt_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
-          #Write-Host $item.'Gruppe Lesen' $item.Verzeichnisname            
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
         }
 
-        # UTF / ANSI conflict workaround
-        # $art_array.Add($item.'Gruppe �ndern', $item.Verzeichnisart);
-        # $path_array.Add($item.'Gruppe �ndern', $item.'normierter Pfad');
 
-        #Write-Host "+--:" $item.'Gruppe Aendern' $item.Verzeichnisart $item.'Verantwortlicher (Stelle oder Personalnummer)'
         try
         {
           $art_array[$item.'Gruppe Aendern'] = $item.Verzeichnisart
-          # $art_array.Add($item.'Gruppe Aendern', $item.Verzeichnisart)
-          #Write-Host "Art Array: " $item.'Gruppe Aendern' $item.Verzeichnisart
         }
-        # Leere Eintraege
         catch
         {
           writeExceptionInfo $_ -Rethrow        
@@ -189,129 +140,111 @@ function ProcessADObjects
             
         try
         {
-          # $path_array.Add($item.'Gruppe Aendern', $item.'Normierter Pfad')
-          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
           $path_array[$item.'Gruppe Aendern'] = $item.'Normierter Pfad' 
           $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
         }
-        # Leere Eintraege
         catch
         {
-          #Write-Host "Schon enthalten in array: " $item.'Gruppe Aendern'                               
           writeExceptionInfo $_ -Rethrow        
         }
-        #Write-Host $item.'Gruppe Aendern' ": " $item.'Verantwortlicher (Stelle oder Personalnummer)'
         try
         {
-          # $endpunkt_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
           $endpunkt_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
-          #Write-Host $item.'Gruppe Aendern' $item.Verzeichnisname            
         }
-        # Leere Eintraege
         catch
         {
-          #Write-Host "Schon enthalten in endpunkt_array: " $item.'Gruppe Aendern'                               
           writeExceptionInfo $_ -Rethrow
         }
       }
 
-      #exit
       $FileSystemAccessEntries = Import-Csv -Path $FileSystemAccessTmpFilePath -Delimiter ";"
-      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
       $FileSystemAccessEntriesNew = [System.Collections.Generic.List[object]]::new()
 
-      # Arrays zum Speichern der Schluessel fuer die verschiedenen Unterbereiche
       $key_array = @{"key" = 0}
       $avkey_array = @{"key" = 0}
-      #$pkey_array = @{"key" = 0}
 
-      # $cntEntries = 0
-      # $cntNichtGelistet = 0
 
-      #$blaCnt = 0
 
       foreach ($item in $FileSystemAccessEntries)
       {
-        #$item | Out-String
+        outLogVerbose 'foreach $item in $FileSystemAccessEntries:' $item.Name
 
         if ($item.Name.Contains("GGF-VDA-"))
         {
+          outLogVerbose 'if ($item.Name.Contains("GGF-VDA-")) -> true'
           continue
         }
 
-        #$blaCnt++
 
-        #if($blaCnt -ge 10) {
-        #    exit
-        #}
 
         $DisplayName = $item.ShortCut + $item.Name.Substring($item.Name.IndexOf('-') + 1) 
         $TempString = $item.Name.Split('-')
 
-        # String fuer Namensende ermitteln
         $EndString = ""
         if ($item.Name.EndsWith("_L"))
         {
+          outLogVerbose 'if ($item.Name.EndsWith("_L")) -> true'
           $EndString = "_L"
         }
         elseif ($item.Name.EndsWith("_A"))
         {
+          outLogVerbose 'elseif ($item.Name.EndsWith("_A")) -> true'
           $EndString = "_A"
         }
-        # Sollte nicht vorkommen
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($item.Name.EndsWith("_A")) -> false)'
           $EndString = "_X"
         }
             
         $NewShortName = ""
 
-        # Praefix fuer die Unterbereiche
-        #$V = "V1_"
         $V = ""
 
-        #Write-Host $art_array.Item($item.Name)
 
-        #Prj
-        #Aus
-        #Tea
-        #Pgr
 
 
         $V = $art_array.Item($item.Name) + "_"
 
         if ($art_array.Item($item.Name) -ieq "FAC123")
         {
+          outLogVerbose 'if ($art_array.Item($item.Name) -ieq "FAC123") -> true'
           $V = "FAC_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "AUS123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "AUS123") -> true'
           $V = "AUS_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "PKU123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "PKU123") -> true'
           $V = "PKU_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "SON123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "SON123") -> true'
           $V = "SON_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "UBE123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "UBE123") -> true'
           $V = "UBE_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "UNT123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "UNT123") -> true'
           $V = "UNT_"
           $V = ""
         }
         elseif ($art_array.Item($item.Name) -ieq "VAW123")
         {
+          outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "VAW123") -> true'
                 
           $V = "VAW_"
           $AWNRNEW = "9997"
@@ -319,16 +252,15 @@ function ProcessADObjects
 
           try
           {
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
             if(-not $AWNRNEW)
             {
+              outLogVerbose 'if (-not $AWNRNEW) -> true'
               $AWNRNEW = "9997"
             }
           }
           catch
           {
-            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
             writeExceptionInfo $_ -Rethrow 
           }
 
@@ -338,81 +270,76 @@ function ProcessADObjects
 
             if(-not $DKZ)
             {
+              outLogVerbose 'if (-not $DKZ) -> true'
               $DKZ = "XXXXX"
             }
           }
           catch
           {
-            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
             writeExceptionInfo $_ -Rethrow
           }
 
-          Write-Host "####: " $AWNRNEW $DKZ $item.Name
-          #$V = "V_" + $AWNRNEW + "_" + $endpunkt_array.Item($item.Name) + $EndString
           $V = "VAW_" + $AWNRNEW + "_" + $path_array.Item($item.Name) + $EndString
-          #$V = "VX_" + $AWNRNEW + "_"
           $VDUM = $V.Replace("_VR_", "_")
           $V =  $VDUM
-          Write-Host "##--: " $V $VDUM
         }
  
-        # Pruefen ob Name im Array (in der Verzeichnisliste) vorhanden ist
         if ($art_array.Contains($item.Name))
         {
+          outLogVerbose 'if ($art_array.Contains($item.Name)) -> true'
           if ($art_array.Item($item.Name) -ieq "Programm-Ablage")
           {
+            outLogVerbose 'if ($art_array.Item($item.Name) -ieq "Programm-Ablage") -> true'
             $NewShortName = $V
-            #Write-Host "---: " $item.Name $AWNRNEW $V
           }
           elseif ($art_array.Item($item.Name) -ieq "VAW")
           {
+            outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "VAW") -> true'
             $NewShortName = $V
           }
           elseif ($art_array.Item($item.Name) -ieq "PRG")
           {
+            outLogVerbose 'elseif ($art_array.Item($item.Name) -ieq "PRG") -> true'
             try
             {
               $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
               if(-not $AWNRNEW)
               {
+                outLogVerbose 'if (-not $AWNRNEW) -> true'
                 $AWNRNEW = "9998"
               }
             }
             catch
             {
-              Write-Host "AWNRNEW nicht gefunden: " $item.OldName
               $AWNRNEW = "9998"
               writeExceptionInfo $_ -Rethrow
             }
-            Write-Host "AWNRNEW ----: " $AWNRNEW
     
             $NewShortName = "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_" + $path_array.Item($item.Name) + $EndString
           }                
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($art_array.Item($item.Name) -ieq "PRG") -> false)'
             $NewShortName = $V + $path_array.Item($item.Name) + $EndString
-            #$NewShortName = $V
           }
         }
         else
         {
-          # '_A' oder '_L' entfernen
+          outLogVerbose 'else -> true (if/elseif ($art_array.Contains($item.Name)) -> false)'
           $test = $item.Name.Substring(0, $item.Name.Length - 2)
 
           if ($key_array.ContainsKey($test))
           {
-            #$key_array.Item("OE_" + $oenum[0])++
-            #Write-Host "+++ gefunden +++: " $key_array.Item($test)
+            outLogVerbose 'if ($key_array.ContainsKey($test)) -> true'
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($key_array.ContainsKey($test)) -> false)'
             $cntNichtGelistet++
             $key_array.Add($test, $cntNichtGelistet)
-            #Write-Host "+++ insert +++: " $key_array.Count
           }
 
           $NewShortName = "VX_" + "nicht" + "_" + "gelistet" + "_" + $key_array.Item($test) + $EndString
-          #Write-Host "nicht gelistet: "  $item.Name " " $key_array.Item($test) " " $test " " $NewShortName
         }
 
         $NewFullName = $Institut + "GGX-" + $NewShortName 
@@ -421,19 +348,14 @@ function ProcessADObjects
 
         if ($Description.Contains("## keine Beschreibung ##"))
         {
+          outLogVerbose 'if ($Description.Contains("## keine Beschreibung ##")) -> true'
           $VA = $verantwortlicher_array.Item($item.Name)
-          #Write-Host $VA
           $Description = $Description + " Verantwortlicher: " + $VA
-          #Write-Host $NewFullName $Description
         }
 
         $FileSystemAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName; GUIProcessingNote = ""; OldName = $item.Name })
-        # $outFileEntry = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
-        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append    
         $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
         $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
-        Write-Host "-_-_-_-_: " $NewShortName
-        Write-Host "-_-_-_-_: " $NewFullName
       }
 
       $i = 1
@@ -441,40 +363,32 @@ function ProcessADObjects
       $CntPRG = 0000000
       $CntSON = 0100000
       $CntSPA = 0200000
-      # $CntSKL = 0200000
       $CntSPK = 0300000
       $CntVRZ = 0400000
       $CntVOE = 0500000        
 
       foreach ($item in $FileSystemAccessEntriesNew)
       {
-        # Write-Host "processing entry #"$i.ToString()
-        #$item | Select-Object -Property *
+        outLogVerbose 'foreach $item in $FileSystemAccessEntriesNew:' $item.OldName
         $item | Out-String
 
-        #if ($item.Name.Contains("GGF-VDA-")) {
-        #    continue
-        #}
 
             
         $roleType = "unknown"
-        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagFilesystemAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
+        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagFilesystemAccess } | Sort-Object { [int]$_.Order }
         foreach ($relevantRoleType in $relevantRoleTypes)
         {
+          outLogVerbose 'foreach $relevantRoleType in $relevantRoleTypes:' $relevantRoleType.TypeName
           if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
           {
+            outLogVerbose 'if ($item.OldName -cmatch $relevantRoleType.TagRegExp) -> true'
             $roleType = $relevantRoleType.TypeName 
-            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
             break
           }
         }
 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
         $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
-        # BUGFIX 2026-07-05 (ported from R125): removed a second Add of the (former) Neu
-        # line into the Out list, which duplicated every FileSystemAccess creation row.
         $NewFullName = $item.'GUIADGroup.Name'
 
         $ProfilNummer = 0
@@ -488,6 +402,7 @@ function ProcessADObjects
 
           if(-not $DKZ)
           {
+            outLogVerbose 'if (-not $DKZ) -> true'
             $MYANR = "9997"
           }
         }
@@ -499,9 +414,7 @@ function ProcessADObjects
 
         $FullPath = $fullpath_array.Item($item.OldName)
 
-        Write-Host $item.OldName " -> " "--- MYANR: " $MYANR ": " $VerzeichnisArt ": " $FullPath "!"
 
-        ###############################################
         $AWNRNEW = "9997"
         $EndString = ""
 
@@ -510,188 +423,212 @@ function ProcessADObjects
           $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
           if(-not $AWNRNEW)
           {
+            outLogVerbose 'if (-not $AWNRNEW) -> true'
             $AWNRNEW = "9998"
           }
-          Write-Host "AWNRNEW ----: " $AWNRNEW
         }
         catch
         {
-          Write-Host "AWNRNEW nicht gefunden: " $item.OldName
           $AWNRNEW = "9998"
           writeExceptionInfo $_ -Rethrow
         }
 
         if ($VerzeichnisArt -ieq "SPA")
         {
+          outLogVerbose 'if ($VerzeichnisArt -ieq "SPA") -> true'
           $ProfilNummer = "42" + ([string]$CntSPA).PadLeft(7, '0')
           $CntSPA++
 
           $ProfilName = "SPA " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SPA aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SPA lesen " + $NewFullName
           }
 
         }
         elseif ($VerzeichnisArt -ieq "SON")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SON") -> true'
           $ProfilNummer = "42" + ([string]$CntSON).PadLeft(7, '0')
           $CntSON++
 
           $ProfilName = "SON " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SON aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SON lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "SPK")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SPK") -> true'
           $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
           $CntSPK++
 
           $ProfilName = "SPK " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "VRZ")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VRZ") -> true'
           $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
           $CntVRZ++
 
           $ProfilName = "VRZ " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "VOE")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VOE") -> true'
           $ProfilNummer = "42" + ([string]$CntVOE).PadLeft(7, '0')
           $CntVOE++
 
           $ProfilName = "VOE " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VOE aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VOE lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "PRG")
         {
-          Write-Host "AWNRNEW ----: " $AWNRNEW
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PRG") -> true'
 
           if ($AWNRNEW -ieq "9997")
           {
+            outLogVerbose 'if ($AWNRNEW -ieq "9997") -> true'
             $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
             $CntPRG++
           }
           elseif ($AWNRNEW -ieq "0000")
           {
+            outLogVerbose 'elseif ($AWNRNEW -ieq "0000") -> true'
             $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
             $CntPRG++
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($AWNRNEW -ieq "0000") -> false)'
             if ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW))
             {
+              outLogVerbose 'if ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> true'
               $rbkey_array.Item("PAN_" + $AWNRNEW)++
-              #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
             }
             else
             {
+              outLogVerbose 'else -> true (if/elseif ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> false)'
               $rbkey_array.Add("PAN_" + $AWNRNEW, 200)
-              #Write-Host "+++ insert +++: " $pkey_array.Count
             }
     
             $ProfilNummer = "40" + ([string]$AWNRNEW).PadLeft(4, '0') + $rbkey_array.Item("PAN_" + $AWNRNEW)
-            #$CntPRGDUM++
           }
 
-          #$ProfilNummer = "61" + ([string]$CntPRG).PadLeft(7, '0')
-          #$CntPRG++
-          #$NewFullName = $NewFullName.Replace("PRG_", "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_")
           $NewFullName = $NewFullName.Replace("PRG_", "PRG_")
 
           $ProfilName = "SIA " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SIA aendern " + $NewFullName.Replace($SPKID + "GGX-", "")
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SIA lesen " + $NewFullName.Replace($SPKID + "GGX-", "")
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "PRG12")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PRG12") -> true'
           $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
           $CntPRG++
 
           $ProfilName = "PROG " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf PRG aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf PRG lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "VRZ")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "VRZ") -> true'
           $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
           $CntVRZ++
 
           $ProfilName = "VRZ " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
           }
                 
         }
         elseif ($VerzeichnisArt -ieq "SPK")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "SPK") -> true'
           $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
           $CntSPK++
 
           $ProfilName = "SPK " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
           }
                 
@@ -699,113 +636,104 @@ function ProcessADObjects
 
         elseif ($VerzeichnisArt -ieq "PROG1")
         {
-          #Write-Host "Anwendungszugriff"
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "PROG1") -> true'
           $ProfilNummer = $CntProgramm
           $CntProgramm++
 
           $ProfilName = "Anwendungsverzeichnis " + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf Programm aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf Programm lesen " + $NewFullName
           }
 
-          #nummer_array
           $AWNRNEW = "9997"
           $EndString = ""
 
           try
           {
-            #Write-Host "Anwendungszugriff"
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
             if(-not $AWNRNEW)
             {
+              outLogVerbose 'if (-not $AWNRNEW) -> true'
               $AWNRNEW = "9997"
             }
 
-            #Write-Host "----: " $AWNRNEW
           }
           catch
           {
-            Write-Host "Nicht gefunden: " $item.OldName
-            #Write-Host "Nicht gefunden: " $item.Name
           }
 
           try
           {
-            #Write-Host "Anwendungszugriff"
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
-            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
             $DKZ = $dkz_array.Item($item.OldName)
 
             if(-not $DKZ)
             {
+              outLogVerbose 'if (-not $DKZ) -> true'
               $DKZ = "XXXXX"
             }
 
             $bla = $NewFullName.Replace("-AV_", "-AZ_")
-            # $NewFullName = $DKZ + $bla.Substring(7)
             $NewFullName = $bla.Substring(7)
-            #Write-Host "----: " $AWNRNEW $DKZ $NewFullName
           }
           catch
           {
-            Write-Host "Nicht gefunden: " $item.OldName
             writeExceptionInfo $_ -Rethrow
           }
 
           if ($pkey_array.ContainsKey("PAN_" + $AWNRNEW))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> true'
             $pkey_array.Item("PAN_" + $AWNRNEW)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAN_" + $AWNRNEW)) -> false)'
             $pkey_array.Add("PAN_" + $AWNRNEW, 1)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
                 
-          # Profilnummer bauen: 50<AWNummer>9nn
           $ProfilNummer = "10" + $AWNRNEW + "" + ([string]$pkey_array.Item("PAN_" + $AWNRNEW)).PadLeft(3, '0')
-          #Write-Host $CntProgramm $NewFullName $item.OldName $ProfilNummer
         }
         elseif ($VerzeichnisArt -ieq "AW")
         {
+          outLogVerbose 'elseif ($VerzeichnisArt -ieq "AW") -> true'
           if ($avkey_array.ContainsKey("AV_" + $MYANR))
           {
+            outLogVerbose 'if ($avkey_array.ContainsKey("AV_" + $MYANR)) -> true'
             $avkey_array.Item("AV_" + $MYANR)++
-            #Write-Host "+++ update +++: " $avkey_array.Item("AV_" + $MYANR)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($avkey_array.ContainsKey("AV_" + $MYANR)) -> false)'
             $avkey_array.Add("AV_" + $MYANR, 1)
-            #Write-Host "+++ insert +++: " $avkey_array.Count
           }
 
 
           $ProfilNummer = "40" + $MYANR.PadLeft(4, '0') + ([string]$avkey_array.Item("AV_" + $MYANR)).PadLeft(3, '0')
-          #Write-Host $ProfilNummer
           $CntAv++
 
           $ProfilName = "AW_" + $NewFullName
           if ($NewFullName.EndsWith("_A"))
           {
+            outLogVerbose 'if ($NewFullName.EndsWith("_A")) -> true'
             $ProfilName = "Zugriff auf Anwendungsverzeichnisse aendern " + $NewFullName
           }
           elseif ($NewFullName.EndsWith("_L"))
           {
+            outLogVerbose 'elseif ($NewFullName.EndsWith("_L")) -> true'
             $ProfilName = "Zugriff auf Anwendungsverzeichnisse lesen " + $NewFullName
           }
 
         }
         else
         {
-          #Write-Host "+-+-+-+-+-+-+- Unbekannte-Ablage: " $VerzeichnisArt
+          outLogVerbose 'else -> true (if/elseif ($VerzeichnisArt -ieq "AW") -> false)'
           try
           {
             $ProfilNummer = "97000"  + ([string]$CntElse).PadLeft(4, '0')
@@ -822,66 +750,54 @@ function ProcessADObjects
         $dum = $verantwortlicher_array.Item($item.OldName)
         if ($dum)
         {
+          outLogVerbose 'if ($dum) -> true'
           if ( $dum.StartsWith("S" + $SPKNO))
           {
+            outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
             $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
           }
         }
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
           $dum = "0570000/0012"
         }
-        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("P030GGX-", "") + ";" + $ProfilName + ";" + $dum + ";" + $item.OldName | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
  
-        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("Z001GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";" + $VerzeichnisArt | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
 
 
-        #Fullpath $FullPath
-        # ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
         $KURSSollProfileOutLine = ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt
         $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
 
 
         foreach ($item1 in $ADObjectMemberships)
         {
+          outLogVerbose 'foreach $item1 in $ADObjectMemberships:' $item1.GroupName
           if ($item1.GroupName -ieq $item.OldName)
           {
+            outLogVerbose 'if ($item1.GroupName -ieq $item.OldName) -> true'
             if ($item1.MemberClass -ieq "user")
             {
-              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
-              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+              outLogVerbose 'if ($item1.MemberClass -ieq "user") -> true'
               $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + ""
               $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
 
-              # Kurs Daten schreiben
-              #Write-Host $u.MemberName $mitarbeiter_array.Item($u.MemberName)
               $dum = $mitarbeiter_array.Item($item1.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $item1.MemberName
               }
-              # dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
               $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"
               $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
             }
             elseif ($item1.MemberClass -ieq "group")
             {
-              # O(1) index lookup instead of a full linear scan over $ADObjectMemberships.
-              # Key matches buildAllUserMembershipsCache: GroupName + "|" + MemberClass.
-              #edmond
-              # $userKey = $item1.MemberName + "|user"
-              # $userKey = getMembershipIndexKey $item1.MemberName "user"
-              # $users = $null
-              # if (-not $membershipIndex.TryGetValue($userKey, [ref] $users))
-              # {
-              #   $users = [System.Collections.Generic.List[object]]::new()
-              # }             
+              outLogVerbose 'elseif ($item1.MemberClass -ieq "group") -> true'
               $users = getUsersByMemberGroup $item1.MemberName
               foreach ($u in $users)
               {
-                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
-                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+                outLogVerbose 'foreach $u in $users:' $u.MemberName
                 $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName
                 $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
               }
@@ -897,13 +813,12 @@ function ProcessADObjects
       writeExceptionInfo $_ -Rethrow 
     }       
 
-    #exit
   }
 
 
-  # AppAccess ---------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagAppAccess)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagAppAccess) -> true'
     try
     {
 
@@ -917,88 +832,73 @@ function ProcessADObjects
       $Verantwortlicher
       $MyKey
 
-      # Anwendungsliste einlesen
-      # Nr. -> wird verwendet
-      # AWK -> wird verwendet
-      # FullAccount -> wird verwendet
-      # Verzeichnisname
-      # Endpunktname 
-      # Gruppe Ändern 
-      # Verantwortlicher -> wird verwendet
 
 
       foreach ($item in $AnwendungenFilePathEntries)
       {
+        outLogVerbose 'foreach $item in $AnwendungenFilePathEntries:' $item.'Nr.'
         $Verantwortlicher = $item.'Verantwortlicher (FPV)'
 
-        #write-host "-----------------: "  $Verantwortlicher
 
         if (-not $Verantwortlicher)
         {
+          outLogVerbose 'if (-not $Verantwortlicher) -> true'
           $Verantwortlicher = "0570000/0012"
         }
         else
         {
+          outLogVerbose 'else -> true (if/elseif (-not $Verantwortlicher) -> false)'
           if ( $Verantwortlicher.StartsWith("S" + $SPKNO))
           {
+            outLogVerbose 'if ($Verantwortlicher.StartsWith("S" + $SPKNO)) -> true'
             $dum = $mitarbeiterStelle_array.Item($Verantwortlicher)
             $Verantwortlicher = $dum
           }
         }
         $MyKey = $item.FullAccount.Split('\')
 
-        Write-Host "-----------------:" $MyKey[0] $MyKey[1]
 
-        Write-Host "#############-------------:" $MyKey[1] $item.'Nr.' $Verantwortlicher
 
         if($MyKey[1])
         {
+          outLogVerbose 'if ($MyKey[1]) -> true'
           if (-not $nummer_array.ContainsKey($MyKey[1]))
           {
+            outLogVerbose 'if (-not $nummer_array.ContainsKey($MyKey[1])) -> true'
             $nummer_array[$MyKey[1]] = $item.'Nr.'
             $verantwortlicher_array[$MyKey[1]] = $Verantwortlicher
             $kz_array[$MyKey[1]] = $item.'AWK'
-            # $item.'Beschreibung' was changed to $item.'Beschreibung (256 Zeichen)'
             $beschreibung_array[$MyKey[1]] = $item.'Beschreibung (256 Zeichen)'
 
-            Write-Host "+++--------------:" $item.'Nr.' $Verantwortlicher $item.'AWK'
           }
         }
       }
 
-      #Exit
 
       $AppAccessEntries = Import-Csv -Path $AppAccessTmpFilePath -Delimiter ";"
-      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
       $AppAccessEntriesNew = [System.Collections.Generic.List[object]]::new()
       foreach ($item in $AppAccessEntries)
       {
+        outLogVerbose 'foreach $item in $AppAccessEntries:' $item.Name
             
-        # Anwendungsnummer fuer Objekt suchen
         $AWNR = $nummer_array.Item($item.Name)
-        Write-Host "--------: " $item.Name $AWNR
-        # Wenn nicht gefunden mit '9999' besetzen
         if (-not $AWNR)
         {
+          outLogVerbose 'if (-not $AWNR) -> true'
           $AWNR = 9000
         }
-        # Nummer 4 stellig mit fuehrenden Nullen auffuellen
         $AWNR = ([string]$AWNR).PadLeft(4, '0')
-        # Shortcut setzen
         $ShortCut = "AZ_"
-        # Ausnahme fuer Shortcut (z.B. VRZ) wenn 'GGF-', laut N.Z. fuer alle Kassen da von FI gesetzt
         if ($item.Name.Contains("GGF-"))
         {
+          outLogVerbose 'if ($item.Name.Contains("GGF-")) -> true'
           $ShortCut = "AZ_" 
         }
 
         $NewShortName = $ShortCut + $AWNR + "_" + $item.Name.Substring($item.Name.IndexOf('-') + 1)
         $NewFullName = $Institut + "GGX-" + $NewShortName.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")
-        #Serviceportal
 
         $AppAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName.Replace("Serviceportal", "SVP"); GUIProcessingNote = ""; OldName = $item.Name })
-        # $outFileEntry = $Institut + ";" + $NewFullName + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
-        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
         $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
         $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
       }
@@ -1009,28 +909,27 @@ function ProcessADObjects
 
       foreach ($item in $AppAccessEntriesNew)
       {
-        # Write-Host "processing entry #"$i.ToString()
+        outLogVerbose 'foreach $item in $AppAccessEntriesNew:' $item.OldName
 	    
         $roleType = "unknown"
-        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagAppAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
+        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagAppAccess } | Sort-Object { [int]$_.Order }
         foreach ($relevantRoleType in $relevantRoleTypes)
         {
+          outLogVerbose 'foreach $relevantRoleType in $relevantRoleTypes:' $relevantRoleType.TypeName
           if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
           {
+            outLogVerbose 'if ($item.OldName -cmatch $relevantRoleType.TagRegExp) -> true'
             $roleType = $relevantRoleType.TypeName 
-            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
             break
           }
         }
 
         if($item.OldName -like "*GGT-0-*")
         {
+          outLogVerbose 'if ($item.OldName -like "*GGT-0-*") -> true'
           $roleType = "ApplicationSIA"
-          Write-Host "---------------:" $roleType $item.OldName
         }
 	    	    
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
         $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
@@ -1038,9 +937,9 @@ function ProcessADObjects
 
         $NeueBeschreibung = ""
 
-        # Muell
         if ($item.'GUIADGroup.Name' -like "*GGX-A_*")
         {
+          outLogVerbose 'if ($item.''GUIADGroup.Name'' -like "*GGX-A_*") -> true'
           $PnrStr = ([string]$ProfilNummerAZ).PadLeft(3, '0')
           $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')
           $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
@@ -1051,63 +950,57 @@ function ProcessADObjects
 
           $aname = $item.'GUIADGroup.Name'.Substring(15)
 
-          Write-Host "++++++++++: " $aname $item.'GUIADGroup.Name'
 
           if ($dum)
           {
-            if ($dum.StartsWith("S" + SPKNO))
+            outLogVerbose 'if ($dum) -> true'
+            if ($dum.StartsWith("S" + $SPKNO))
             {
+              outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
               $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
             }
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
             $dum = "0570000/0012"
           }
 
           if ($pkey_array.ContainsKey("PAZ_" + $AWNR))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> true'
             $pkey_array.Item("PAZ_" + $AWNR)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> false)'
             $pkey_array.Add("PAZ_" + $AWNR, 1000)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
 
-          #$PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
     
-          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           if ($AWNR -ieq "0000")
           {
+            outLogVerbose 'if ($AWNR -ieq "0000") -> true'
             $AWNR = "9000"
           }
 
           $ProfilNummerAZ++
-          Write-Host "-+++++: " $ProfilNummerAZ
-          Write-Host "++++++: " $PnrStr
 
-          ##"4" + $AWNR + "" + ($PnrStr).ToString() + ";" + $kz + "-" + $aname + ";" + $ProfilName.Replace("P030GGX-", "") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
-          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"
           $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
           $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
-          #Write-Host "---: " $item.'GUIADGroup.Name'
           $ProfilNummerAZ++
         }
-        # Anwendungszugriff
         else
         {
+          outLogVerbose 'else -> true (if/elseif ($item.''GUIADGroup.Name'' -like "*GGX-A_*") -> false)'
           $AWK = "1"
           $PnrStr = ([string]$ProfilNummerAV).PadLeft(3, '0')
           $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')
 
           $AWK = ([string]$kz_array.Item($item.OldName)).PadLeft(5, '0')
 
-          #$kz_array.Add($MyKey[1], $item.'AWK')
 
-          #$ProfilName = "Anwendungsverzeichnis " + $item.'GUIADGroup.Name'
           $dum = $verantwortlicher_array.Item($item.OldName)
 
           $kz = $kz_array.Item($item.OldName)
@@ -1117,112 +1010,99 @@ function ProcessADObjects
 
           if (-not $NeueBeschreibung)
           {
+            outLogVerbose 'if (-not $NeueBeschreibung) -> true'
             $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif (-not $NeueBeschreibung) -> false)'
             $ProfilName = $NeueBeschreibung
           }
 
-          Write-Host "+++ neue Beschreibung +++: " $ProfilName
-          #$ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
 
-          Write-Host "########: " $aname $item.'GUIADGroup.Name' $AWK
 
           if ($dum)
           {
-            if ($dum.StartsWith("S" + SPKNO))
+            outLogVerbose 'if ($dum) -> true'
+            if ($dum.StartsWith("S" + $SPKNO))
             {
+              outLogVerbose 'if ($dum.StartsWith("S" + $SPKNO)) -> true'
               $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
             }
           }
           else
           {
+            outLogVerbose 'else -> true (if/elseif ($dum) -> false)'
             $dum = "0570000/0012"
           }
 
           if (-not $kz)
           {
+            outLogVerbose 'if (-not $kz) -> true'
             $kz = "XXXXX"
           }
     
           if ($pkey_array.ContainsKey("PAZ_" + $AWNR))
           {
+            outLogVerbose 'if ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> true'
             $pkey_array.Item("PAZ_" + $AWNR)++
-            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
           }
           else
           {
-            #$pkey_array.Add("PA_" + $AWNR, 500)
+            outLogVerbose 'else -> true (if/elseif ($pkey_array.ContainsKey("PAZ_" + $AWNR)) -> false)'
             $pkey_array.Add("PAZ_" + $AWNR, 100)
-            #Write-Host "+++ insert +++: " $pkey_array.Count
           }
 
           $PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
-          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
-          ##$NNNAME = $kz + "-" + $aname
                 
-          #Anwendungsnummer im Namen
           $NNNAME = "AZ_" + $AWNR + $aname
 
-          #Anwendungskuerzel im Namen
-          #$NNNAME = "AZ_" + $AWK + $aname
 
             
           if ($AWNR -ieq "0000")
           {
+            outLogVerbose 'if ($AWNR -ieq "0000") -> true'
             $AWNR = "9998"
           }
-          Write-Host "-+++++: " $ProfilNummerAV
-          Write-Host "++++++: " $PnrStr
 
           $MYDESC007 = $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")
 
-          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
           $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"
           $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
           $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
           $ProfilNummerAV++
         }
-        #            foreach ($userMemberShip in $userMemberShips) {
 
 
         foreach ($item1 in $ADObjectMemberships)
         {
+          outLogVerbose 'foreach $item1 in $ADObjectMemberships:' $item1.GroupName
 
           if ($item1.GroupName -ieq $item.OldName)
           {   
-            #Write-Host $item1.MemberClass ": " $item.OldName
+            outLogVerbose 'if ($item1.GroupName -ieq $item.OldName) -> true'
             if ($item1.MemberClass -ieq "user")
             {
-              #Write-Host "User"
-              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
-              #$Institut + ";" + "RoleRalph" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+              outLogVerbose 'if ($item1.MemberClass -ieq "user") -> true'
               $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName
               $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
     
-              # Kurs Daten schreiben
               $dum = $mitarbeiter_array.Item($item1.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $item1.MemberName
               }
-              # $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append                        
               $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"
               $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
             }
             elseif ($item1.MemberClass -ieq "group")
             {
-              # BUGFIX 2026-07-05 (ported from R125): without this assignment $users is
-              # empty/stale here and the foreach below never emits the indirect
-              # (group-inherited) AZ_* membership rows.
+              outLogVerbose 'elseif ($item1.MemberClass -ieq "group") -> true'
               $users = getUsersByMemberGroup $item1.MemberName
               foreach ($u in $users)
               {
-                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
-                #$Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+                outLogVerbose 'foreach $u in $users:' $u.MemberName
                 $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName
                 $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
               }
@@ -1238,60 +1118,61 @@ function ProcessADObjects
       writeExceptionInfo $_ -Rethrow
     }       
   }
-  # AppConfiguration ---------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagAppConfiguration)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagAppConfiguration) -> true'
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
 
  
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
 
-      Write-Host $DisplayName
 
       $NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
 
       if ($NewFullName.Contains("IntExK"))
       {
+        outLogVerbose 'if ($NewFullName.Contains("IntExK")) -> true'
         continue
       }
 
       if ($DisplayName -eq "AK_WEB_SSKMG-STD")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_SSKMG-STD") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
       }
       if ($DisplayName -eq "AK_IEK_Admins")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_IEK_Admins") -> true'
         $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
       }
       if ($DisplayName -eq "AK_OFK_Office_Default")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_OFK_Office_Default") -> true'
         $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
       }
       if ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
       }
       if ($DisplayName -eq "AK_WEB_OhneIntranet")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_OhneIntranet") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
       }
     
-      #Write-Host $NewFullName
-      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
-      #Write-Host $NewFullName
 
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
-      # $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
     }
 
-    #Exit
 
     $i = 1
     $PNR = 1000000
@@ -1301,75 +1182,62 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      Write-Host "processing entry #" $i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
-      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
 
-      #450000000	AKO_OFFK_Office_Default
-      #460000000	AKE_IntExK_Admins
-      #480000000	AKW_WEB_SSKMG-STD
-      #480000001	AKW_WEB_IE_ALT_Videoueberwachung
-      #480000002	AKW_WEB_OhneIntranet
 
       $NewFullName = $Institut + $DisplayName
       if ($DisplayName -eq "AK_WEB_SSKMG-STD")
       {
+        outLogVerbose 'if ($DisplayName -eq "AK_WEB_SSKMG-STD") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
         $MPNR = 500000001
       }
       elseif ($DisplayName -eq "AK_IEK_Admins")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_IEK_Admins") -> true'
         $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
         $MPNR = 500000002
       }
       elseif ($DisplayName -eq "AK_OFK_Office_Default")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_OFK_Office_Default") -> true'
         $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
         $MPNR = 500000003
       }
       elseif ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
         $MPNR = 500000004
       }
       elseif ($DisplayName -eq "AK_WEB_OhneIntranet")
       {
+        outLogVerbose 'elseif ($DisplayName -eq "AK_WEB_OhneIntranet") -> true'
         $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
         $MPNR = 500000005
       }
       else
       {
+        outLogVerbose 'else -> true (if/elseif ($DisplayName -eq "AK_WEB_OhneIntranet") -> false)'
         $NewFullName = $DisplayName
         $MPNR = $DUMPNR
-        #$DUMPNR++;
       }
 
     
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
       $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       $NewFullName1 = $NewFullName
-      #$StelleVerant = "9999999/9999"
-      #$StelleVerant = "3410200/0015"
 
-      ## Richtige Stelle
 
-      $StelleVerant = "0570000/0012" #auch fuer SEC, WEBBROWSER
+      $StelleVerant = "0570000/0012"
 
-      Write-Host 1
-      Write-Host $MPNR
-      Write-Host $NewFullName1
-      Write-Host $StelleVerant
-      Write-Host $adObjectEntry.OldName
-      Write-Host 6
 
-      # "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
       $KURSSollProfileOutLine = "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $PNR++
@@ -1377,27 +1245,24 @@ function ProcessADObjects
 
       foreach ($userMemberShip in $userMemberShips)
       {
-        # Fehler
-        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" +  "" + ";" +  "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
-        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
-        #Write-Host "## o: " $userMemberShip.Origin
 
         $persnr = "0000000000"
-        #$ProfilNR = "4000007000"
         $ProfilNR = "" + $DUMPNR
 
         if ($userMemberShip.Origin -ieq "user")
         {
-          #Write-Host "##: " + $userMemberShip.MemberName
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
@@ -1407,9 +1272,6 @@ function ProcessADObjects
             outLog "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
-          #Write-Host "PN: " + $persnr
-          # Kurs Daten schreiben
-          # persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1418,23 +1280,22 @@ function ProcessADObjects
       $i++
     }
   }
-  # AppOrganisation ---------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagOrganisation)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagOrganisation) -> true'
     $i = 1
     $ProfilNummer = 1
     $ProfilNR = 440000000
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
                 
-      # DAWGruppenAnlegenOutArray füllen
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
     
       $NewFullName = $Institut + "GGX-" + $DisplayName 
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG")
-      #$DisplayName1 = $DisplayName.Replace("O_G_", "OG_G_")
       $DisplayName1 = $DisplayName.Replace("O_", "OG_")
     
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
@@ -1443,61 +1304,46 @@ function ProcessADObjects
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName1 + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName1 + ";" + "" + ";" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
 
-      # Write-Host "processing entry #"$i.ToString()
-      # not used here, see above 
-      # $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
-      # $TempString = $adObjectEntry.ObjectName.Split('-')
-      # $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
-      # $NewFullName = $Institut + "GGX-" + $DisplayName 
-      # $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG") 
     
-      #$roleType = getRoleType $adObjectEntry $roletypeTag
       $roleType = "Organisation"
       $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
       $PnrStr = ([string]$ProfilNummer).PadLeft(2, '0')
-      # $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(3, '0')
       $AWNR = "xxxx"
       $ProfilName = "Organisatorische Gruppe " + $NewFullName1
       $ProfilNR++
-      #$ProfilNR = "48" + $AWNR + "7" + ($PnrStr).ToString()
       $KURSSollProfileOutLine = [string]$ProfilNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + $ProfilName.Replace($SPKID + "GGX-OG_", "") + ";" + "0570000/0012" + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";OG"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $ProfilNummer++
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
       foreach ($userMemberShip in $userMemberShips)
       {
-        # Fehler laut Norbert
-        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
-        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass
-        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append
-        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass
 
-        #$userMemberShip | Out-String
 
         $persnr = "0000000000"
 
         if ($userMemberShip.Origin -ieq "user")
         {
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
           }
           catch
           {
-            Write-Host "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
 
-          # Kurs Daten schreiben
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "Organisation"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1507,27 +1353,27 @@ function ProcessADObjects
     }
   }
 
-  # Security ------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagSecurity)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagSecurity) -> true'
 
     $SicherheitseinstellungenFilePath = $SecurityInFilePath
     $SicherheitseinstellungenFilePathEntries = Get-Content -Path $SicherheitseinstellungenFilePath | ConvertFrom-Csv -Delimiter ";" 
     $sec_array = @{"nummer" = "nummer"}
     foreach ($item in $SicherheitseinstellungenFilePathEntries)
     {
-      #write-host $item.Name $item.Verantwortlicher
+      outLogVerbose 'foreach $item in $SicherheitseinstellungenFilePathEntries:' $item.Name
       $sec_array[$item.Name] = $item.Verantwortlicher
     }
 
-    #exit
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.OldName
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
-      Write-Host "--++ OLDNAME: " $adObjectEntry.OldName
       if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
       {
+        outLogVerbose 'if ($adObjectEntry.OldName.Contains($SPKID + "GDT")) -> true'
         continue
       }
                 
@@ -1537,31 +1383,22 @@ function ProcessADObjects
     
       $NewFullName = $Institut + "GGX-" + $DisplayName 
 
-      Write-Host "Sicherheit: " + $NewFullName + $DisplayName + $NewFullName.Replace($SPKID + "GGX-S_", "SE_")
     
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
-      # $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
       $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName
       $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
-      Write-Host "--++ OLDNAME: Ende"
     }
-    # --- once, before the loop -------------------------------------------------
-    # Parametrised PN prefixes:
-    #   $pnPrefix1 = two-digit numeric string  (e.g. "43")
-    #   $pnPrefix2 = four-digit numeric string (e.g. "9000")
-    # Final PN = prefix1 + prefix2 + three-digit suffix from the CSV.
     $pnPrefix1 = "43"
     $pnPrefix2 = "9000"
-    # Load the ordered rule list. Order in the file = match priority (most specific
-    # first), exactly like the original if/elseif cascade.
     $pnRules = [System.Collections.Generic.List[object]]::new()
     foreach ($row in (Import-Csv -Path $KURSProfileNumberMapping -Delimiter ";"))
     {
+      outLogVerbose 'foreach $row in (Import-Csv -Path $KURSProfileNumberMapping -Delimiter ";"):' $row
       $pnRules.Add([pscustomobject]@{
           Pattern = $row.Pattern
-          PN      = $pnPrefix1 + $pnPrefix2 + $row.Suffix   # e.g. "43" + "9000" + "017"
+          PN      = $pnPrefix1 + $pnPrefix2 + $row.Suffix
         })
     }
 
@@ -1572,12 +1409,12 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      #Write-Host "processing entry #"$i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.OldName
 
-      Write-Host "OLDNAME: " $adObjectEntry.OldName
 
       if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
       {
+        outLogVerbose 'if ($adObjectEntry.OldName.Contains($SPKID + "GDT")) -> true'
         continue
       }
 
@@ -1587,45 +1424,42 @@ function ProcessADObjects
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
       $NewFullName = $Institut + "GGX-" + $DisplayName 
 
-      #Write-Host "----------------------------------------------" $DisplayName $NewFullName
     
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
       $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
       $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
       $PN = $null
       foreach ($rule in $pnRules)
       {
+        outLogVerbose 'foreach $rule in $pnRules:' $rule
         if ($DisplayName.Contains($rule.Pattern))
         {
+          outLogVerbose 'if ($DisplayName.Contains($rule.Pattern)) -> true'
           $PN = $rule.PN
-          break                      # first match wins, just like elseif
+          break
         }
       }
       if ($null -eq $PN)
       {
-        # the original 'else' branch
+        outLogVerbose 'if ($null -eq $PN) -> true'
         $PN = ($ProfilNummerSonstigesStartWert + $iSonstiges).ToString()
         $iSonstiges++    
       }
 
-      #############################################
 
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")
 
-      Write-Host $NewFullName1
 
       $StelleVerant = $sec_array.Item($adObjectEntry.OldName)
 
-      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
       $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       foreach ($userMemberShip in $userMemberShips)
       {
+        outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
         $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
         $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
 
@@ -1634,24 +1468,23 @@ function ProcessADObjects
 
         if ($userMemberShip.Origin -ieq "user")
         {
+          outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
           try
           {
             $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
             $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
             if (-not $dum)
             {
+              outLogVerbose 'if (-not $dum) -> true'
               $dum = $userMemberShip.MemberName
             }
             $persnr = $dum
           }
           catch
           {
-            Write-Host "User nicht gefunden: " $u.MemberName
             writeExceptionInfo $_ -Rethrow 
           }
 
-          # Kurs Daten schreiben
-          # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
           $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security"
           $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
         }
@@ -1660,11 +1493,12 @@ function ProcessADObjects
     }
   }
 
-  # Anwenderrollen ------------------------------------------
   elseif ($roletypeTag -ieq $FI.TypeTagRole)
   {
+    outLogVerbose 'elseif ($roletypeTag -ieq $FI.TypeTagRole) -> true'
     foreach ($adObjectEntry in $adObjectEntries)
     {
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
                 
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
       $TempString = $adObjectEntry.ObjectName.Split('-')
@@ -1672,15 +1506,11 @@ function ProcessADObjects
     
       $NewFullName = $SPKID + "GGX-" + $DisplayName 
 
-      Write-Host "Rolle: " + $NewFullName + $DisplayName + $NewFullName 
     
       $adObjectEntry.OldName = $adObjectEntry.ObjectName
       $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
       $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
-      #$Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace("P030GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | out-file $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
     }
-    # BUGFIX 2026-07-02: re-enabled - with this commented out, the allowlist filter
-    # below never ran and entries the original cascade skipped were processed.
     $prefixMatcher = buildPrefixMatcher $KURSProfilePrefixes
 
     $ProfilNummer = 470000000
@@ -1691,86 +1521,71 @@ function ProcessADObjects
 
     foreach ($adObjectEntry in $adObjectEntries)
     {
-      # Write-Host "processing entry #"$i.ToString()
+      outLogVerbose 'foreach $adObjectEntry in $adObjectEntries:' $adObjectEntry.ObjectName
       $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
       $TempString = $adObjectEntry.ObjectName.Split('-')
       $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
       $NewFullName = $Institut + "GGX-" + $DisplayName 
-      #Write-Host "--##++ So sollte der Name lauten: "  $adObjectEntry.OldName
 
-      # ===== This single check REPLACES the entire 1000-branch if/elseif cascade =====
-      # Original behaviour: known prefix -> continue processing; unknown -> 'continue'.
-      # BUGFIX 2026-07-02: re-enabled. Note: the original cascade's FIRST branch is
-      #   if ($OldName.StartsWith($SPKID + "GUX")) { }   <- empty body, NO 'continue'
-      # i.e. GUX entries fall through and ARE processed. The explicit check below
-      # preserves that regardless of whether $SPKID + "GUX" is listed in the prefix CSV.
       if (-not ($adObjectEntry.OldName.StartsWith($SPKID + "GUX")) -and
         -not (testKnownPrefixes $adObjectEntry.OldName $prefixMatcher))
       {
+        outLogVerbose 'if (-not ($adObjectEntry.OldName.StartsWith($SPKID + "GUX")) -and -not (testKnownPrefixes $adObjectEntry.OldName $ ...) -> true'
         continue 
       }
-      #R125GGX-Energieberater
       $roleType = getRoleType $adObjectEntry $roletypeTag
-      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
-      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
       if ($NewFullName.Contains("R_LM_"))
       { 
+        outLogVerbose 'if ($NewFullName.Contains("R_LM_")) -> true'
         $PN = ($ProfilNummerLM).ToString()
         $ProfilNummerLM++
         $NewFullName = $NewFullName.Replace("AR_LM_","LM_")
       }
       else
       {
+        outLogVerbose 'else -> true (if/elseif ($NewFullName.Contains("R_LM_")) -> false)'
         $PN = ($ProfilNummer + $iSonstiges).ToString()
         $iSonstiges++
       }
-      #Write-Host $PN
-      #Write-Host $NewFullName
 
       $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")
 
-      Write-Host $NewFullName1
 
-      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
       $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR"
       $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
       $userMemberShips = @(getAllUserMemberships $adObjectEntry)
 
       if(1 -lt 2)
       {
+        outLogVerbose 'if (1 -lt 2) -> true'
         foreach ($userMemberShip in $userMemberShips)
         {
-          # Fehler
-          #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
-          # $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
+          outLogVerbose 'foreach $userMemberShip in $userMemberShips:' $userMemberShip.MemberName
           $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
           $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
-          #Write-Host "TypeTagSecurity: " $userMemberShip.MemberClass
-          #$userMemberShip | Out-String
 
 
           $persnr = "0000000000"
 
           if ($userMemberShip.Origin -ieq "user")
           {
+            outLogVerbose 'if ($userMemberShip.Origin -ieq "user") -> true'
             try
             {
               $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
               $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
               if (-not $dum)
               {
+                outLogVerbose 'if (-not $dum) -> true'
                 $dum = $userMemberShip.MemberName
               }
               $persnr = $dum
             }
             catch
             {
-              Write-Host "User nicht gefunden: " $u.MemberName
               writeExceptionInfo $_ -Rethrow
             }
 
-            # Kurs Daten schreiben
-            # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
             $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW"
             $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
           }
@@ -1781,42 +1596,38 @@ function ProcessADObjects
   }
 
 
-  # ===== Post-processing of output collections (2026-07-05) =====================
-  # 1) All collections are sorted ONCE before writing (deterministic, culture-
-  #    independent ordinal order). Inline writes stay unsorted and cheap.
-  # 2) The 'Neu' Gruppenverwaltung variant is no longer produced along the way;
-  #    it is DERIVED from the sorted Out list: rows assigning an account to a
-  #    target group (Accounts.Add non-empty) are grouped by GUIADGroup.LDAP.
-  #    The first row of each group keeps all columns; subsequent rows carry only
-  #    the Accounts.Add column. Rows without an account assignment (e.g. group
-  #    creation rows) pass through unchanged.
   $ordinalComparer = [System.StringComparer]::Ordinal
   $DAWGruppenAnlegenOutList.Sort($ordinalComparer)
   $DAWGruppenverwaltungOutList.Sort($ordinalComparer)
   $KURSSollProfileOutList.Sort($ordinalComparer)
   $KURSIstMitarbeiterProfileOutList.Sort($ordinalComparer)
+  removeDuplicatesFromSortedList $DAWGruppenAnlegenOutList "DAWGruppenAnlegenOutList"
+  removeDuplicatesFromSortedList $DAWGruppenverwaltungOutList "DAWGruppenverwaltungOutList"
+  removeDuplicatesFromSortedList $KURSSollProfileOutList "KURSSollProfileOutList"
+  removeDuplicatesFromSortedList $KURSIstMitarbeiterProfileOutList "KURSIstMitarbeiterProfileOutList"
 
   $DAWGruppenverwaltungNeuOutList.Clear()
   $lastLdap = $null
   foreach ($outLine in $DAWGruppenverwaltungOutList)
   {
+    outLogVerbose 'foreach $outLine in $DAWGruppenverwaltungOutList:' $outLine
     $cols = $outLine.Split(";")
     if ([string]::IsNullOrEmpty($cols[5]))
     {
-      # no account assignment -> pass through unchanged
+      outLogVerbose 'if ([string]::IsNullOrEmpty($cols[5])) -> true'
       $DAWGruppenverwaltungNeuOutList.Add($outLine)
       $lastLdap = $null
       continue
     }
     if ($cols[2] -cne $lastLdap)
     {
-      # first row of a GUIADGroup.LDAP block -> all columns
+      outLogVerbose 'if ($cols[2] -cne $lastLdap) -> true'
       $DAWGruppenverwaltungNeuOutList.Add($outLine)
       $lastLdap = $cols[2]
     }
     else
     {
-      # subsequent row of the same block -> only GUIADGroup.Accounts.Add.LDAPs
+      outLogVerbose 'else -> true (if/elseif ($cols[2] -cne $lastLdap) -> false)'
       $DAWGruppenverwaltungNeuOutList.Add(";;;;;" + $cols[5] + ";;;;")
     }
   }
diff --git a/Process-ADObjects-Work.ps1 b/Process-ADObjects-Work.ps1
old mode 100755
new mode 100644
index a673975..2c6930d
--- a/Process-ADObjects-Work.ps1
+++ b/Process-ADObjects-Work.ps1
@@ -1,6 +1,3 @@
-# --------------------------------------------------------------
-# Relevante OU filtern und fuer jede OU eigene Datei generieren
-# --------------------------------------------------------------
 function prepareADObjectsByType {
     Param
     (
@@ -11,17 +8,17 @@ function prepareADObjectsByType {
     $counter = 1
     $count = $ADObjects.Count
     foreach ($adObject in $ADObjects) {
+        outLogVerbose 'foreach $adObject in $ADObjects:' $adObject.ObjectName
         if (-Not ($adObject.Description)) {
+            outLogVerbose 'if (-Not ($adObject.Description)) -> true'
             $adObject.Description = $Config.EmptyDescription
         }
-        #$adObject.Description = $Config.EmptyDescription
-        #$activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-        #Write-Host $activityMessage
 
         $currentADObject = $null
         if ($typeTag -ieq $FI.TypeTagAppConfiguration) {
+            outLogVerbose 'if ($typeTag -ieq $FI.TypeTagAppConfiguration) -> true'
             if ($adObject.OU -cmatch $FI.RelevantGroups.AppConfiguration.Filter) {
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.AppConfiguration.Filter) -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.AppConfiguration.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.AppConfiguration.ShortCut + ";" + $adObject.Description
@@ -29,15 +26,15 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                # $activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                # Write-Host $activityMessage
             }
         }
         elseif ($typeTag -ieq $FI.TypeTagAppAccess) {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagAppAccess) -> true'
             if ($adObject.OU -cmatch $FI.RelevantGroups.AppAccess.Filter) {
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.AppAccess.Filter) -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.AppAccess.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.AppAccess.ShortCut + ";" + $adObject.Description
@@ -45,16 +42,15 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                # $activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                # Write-Host $activityMessage
             }    
         }
         elseif ($typeTag -ieq $FI.TypeTagFileSystemAccess) {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagFileSystemAccess) -> true'
             if ($adObject.OU -cmatch $FI.RelevantGroups.FilesystemAccess.Filter) {
-                # Teile gehoeren in den Block Anwendungszugriff
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.FilesystemAccess.Filter) -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.FilesystemAccess.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.FilesystemAccess.ShortCut + ";" + $adObject.Description
@@ -62,15 +58,15 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                # $activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                # Write-Host $activityMessage
             } 
         }
         elseif ($typeTag -ieq $FI.TypeTagOrganisation) {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagOrganisation) -> true'
             if ($adObject.OU -cmatch $FI.RelevantGroups.Organisation.Filter) {
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.Organisation.Filter) -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.Organisation.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.Organisation.ShortCut + ";" + $adObject.Description
@@ -78,15 +74,15 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                # $activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                # Write-Host $activityMessage
             }
         }
         elseif ($typeTag -ieq $FI.TypeTagSecurity) {
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagSecurity) -> true'
             if ($adObject.OU -cmatch $FI.RelevantGroups.Security.Filter) {
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -cmatch $FI.RelevantGroups.Security.Filter) -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.Security.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.Security.ShortCut + ";" + $adObject.Description
@@ -94,19 +90,16 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                # $activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                # Write-Host $activityMessage
             }
         }
         elseif ($typeTag -ieq $FI.TypeTagRole) {
-            #Write-Host "----: " $FI.TypeTagRole " -> " $typeTag " -> " $FI.RelevantGroups.Role.Filter " -> " $adObject.OU
-            #-contains "find"
+            outLogVerbose 'elseif ($typeTag -ieq $FI.TypeTagRole) -> true'
 
-            #if ($adObject.OU -cmatch $FI.RelevantGroups.Role.Filter) {
             if ($adObject.OU -like "*Anwenderrollen*") {
-                # $userMemberShips = getAllUserMemberships $adObject
+                outLogVerbose 'if ($adObject.OU -like "*Anwenderrollen*") -> true'
                 $userMemberShips = @()
                 $adObjectEntry = @{ObjectName = $adObject.ObjectName; Path = $adObject.OU; ShortCut = $FI.RelevantGroups.Role.ShortCut; Description = $adObject.Description; Users = $userMemberShips}
                 $adObjectFileEntry = $adObject.ObjectName + ";" + $adObject.OU + ";" + $FI.RelevantGroups.Role.ShortCut + ";" + $adObject.Description
@@ -114,18 +107,14 @@ function prepareADObjectsByType {
                 $adGroupObjects += $adObjectEntry
                 $counter++  
 
-                #Write-Host "+---: " $FI.TypeTagRole " -> " $typeTag " -> " $counter
 
                 if ($IsTestMode -and ($counter -gt $Config.TestMode) ) {
+                    outLogVerbose 'if ($IsTestMode -and ($counter -gt $Config.TestMode)) -> true'
                     break
                 }
-                #$activityMessage = "Processing entry " + $counter + " of " + $count + ", type " + $typeTag + " object " + $adObject.ObjectName
-                #Write-Host $activityMessage
             }
         }
 
-        # $percentCompleted = $counter / $count * 100
-        # Write-Progress -Activity $activityMessage -Status "zzz" -PercentComplete -1
     }
     return $adGroupObjects
 }
diff --git a/Process-ADObjects.ps1 b/Process-ADObjects.ps1
index ee55bf7..ead978a 100755
--- a/Process-ADObjects.ps1
+++ b/Process-ADObjects.ps1
@@ -203,8 +203,7 @@ if ($Config.Analyze)
 }
 
 $importingTime = Get-Date
-# Write-Host "finished: importing at" $importingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm")", used" ($importingTime - $startTime) 
-outLog "finished: importing at " $importingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm") ", used " ($importingTime - $startTime) 
+outLog ("finished: importing at " + $importingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm") + ", used " + ($importingTime - $startTime)) 
 
 "Name;Path;ShortCut;Description" | Out-File "$AppAccessTmpFilePath" -Encoding "utf8NoBom" 
 "Name;Path;ShortCut;Description" | Out-File "$FilesystemAccessTmpFilePath" -Encoding "utf8NoBom" 
@@ -223,14 +222,13 @@ $ADObjectsSecurity += prepareADObjectsByType $FI.TypeTagSecurity
 $ADObjectsRole += prepareADObjectsByType $FI.TypeTagRole
 
 $preparingTime = Get-Date
-# Write-Host "finished: preparing at " $preparingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm")", used" ($preparingTime - $importingTime) 
-outLog "finished: preparing at " $preparingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm") ", used " ($preparingTime - $importingTime) 
-outlog "found " $ADObjectsOrganisation.Count " entries of type " $FI.TypeTagOrganisation
-outlog "found " $ADObjectsAppAccess.Count " entries of type " $FI.TypeTagAppAccess
-outlog "found " $ADObjectsFilesystemAccess.Count " entries of type " $FI.TypeTagFilesystemAccess
-outlog "found " $ADObjectsAppConfiguration.Count " entries of type " $FI.TypeTagAppConfiguration
-outlog "found " $ADObjectsSecurity.Count " entries of type " $FI.TypeTagSecurity
-outlog "found " $ADObjectsRole.Count " entries of type " $FI.TypeTagRole
+outLog ("finished: preparing at " + $preparingTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm") + ", used " + ($preparingTime - $importingTime))
+outlog ("found " + $ADObjectsOrganisation.Count + " entries of type " + $FI.TypeTagOrganisation)
+outlog ("found " + $ADObjectsAppAccess.Count + " entries of type " + $FI.TypeTagAppAccess)
+outlog ("found " + $ADObjectsFilesystemAccess.Count + " entries of type " + $FI.TypeTagFilesystemAccess)
+outlog ("found " + $ADObjectsAppConfiguration.Count + " entries of type " + $FI.TypeTagAppConfiguration)
+outlog ("found " + $ADObjectsSecurity.Count + " entries of type " + $FI.TypeTagSecurity)
+outlog ("found " + $ADObjectsRole.Count + " entries of type " + $FI.TypeTagRole)
 
 $processingTime = Get-Date
 
@@ -272,7 +270,7 @@ if ($Config.WriteKURS)
   . $InstitutsSourcePathKURS
   WriteKURS
   $endTimeWriteKURS = Get-Date
-  outLog "finished: processing WriteKURS at " $endTimeWriteKURS.ToString("HH:mm:ss.mmm")", used " ($endTimeWriteKURS - $startTimeWriteKURS)
+  outLog ("finished: processing WriteKURS at " + $endTimeWriteKURS.ToString("HH:mm:ss.mmm") + ", used " + ($endTimeWriteKURS - $startTimeWriteKURS))
 }
 else
 {
@@ -285,7 +283,7 @@ if ($Config.TransferDAW)
   . $InstitutsSourcePathDAW
   TransferDAW
   $endTimeTransferDAW = Get-Date
-  outLog "finished: processing TransferDAW at " $endTimeTransferDAW.ToString("HH:mm:ss.mmm")", used " ($endTimeTransferDAW - $startTimeTransferDAW)
+  outLog ("finished: processing TransferDAW at " + $endTimeTransferDAW.ToString("HH:mm:ss.mmm") + ", used " + ($endTimeTransferDAW - $startTimeTransferDAW))
 }
 else
 {
@@ -297,7 +295,7 @@ if ($Config.PostProcess)
   $startTimePostProcess = Get-Date
   postProcess
   $endTimePostProcess = Get-Date
-  outLog "finished: processing PostProcess at " $endTimePostProcess.ToString("HH:mm:ss.mmm")", used " ($endTimePostProcess - $startTimePostProcess)
+  outLog ("finished: processing PostProcess at " + $endTimePostProcess.ToString("HH:mm:ss.mmm") + ", used " + ($endTimePostProcess - $startTimePostProcess))
 }
 else
 {
@@ -306,9 +304,9 @@ else
 
 
 $endTime = Get-Date
-outLog "finished: processing at " $endTime.ToString("HH:mm:ss.mmm")", used " ($endTime - $processingTime) 
-outLog "finished: ========================================================== " $endTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm") 
-outLog "used:     "($endTime - $startTime)
+outLog ("finished: processing at " + $endTime.ToString("HH:mm:ss.mmm") + ", used " + ($endTime - $processingTime))
+outLog ("finished: ========================================================== " + $endTime.ToString("yyyy.MM.dd-HH:mm:ss.mmm"))
+outLog ("used:     " + ($endTime - $startTime))
 
 # }
 # finally
diff --git a/Test-ScriptSyntax.ps1 b/Test-ScriptSyntax.ps1
new file mode 100644
index 0000000..62400d3
--- /dev/null
+++ b/Test-ScriptSyntax.ps1
@@ -0,0 +1,20 @@
+# Test-ScriptSyntax.ps1 - parses all .ps1 files without executing them
+param([string] $Path = ".")
+
+Get-ChildItem -Path $Path -Filter *.ps1 | ForEach-Object {
+  $tokens = $null
+  $errors = $null
+  [System.Management.Automation.Language.Parser]::ParseFile(
+    $_.FullName, [ref]$tokens, [ref]$errors) | Out-Null
+  if ($errors.Count -gt 0)
+  {
+    Write-Output "FAIL: $($_.Name) ($($errors.Count) Fehler)"
+    $errors | ForEach-Object {
+      Write-Output ("  Zeile {0}: {1}" -f $_.Extent.StartLineNumber, $_.Message)
+    }
+  }
+  else
+  {
+    Write-Output "OK:   $($_.Name)"
+  }
+}
\ No newline at end of file