function ProcessADObjects
{
  param
  (
    [Parameter(Mandatory = $true, Position = 0)]
    $adObjectEntries,
    [Parameter(Mandatory = $true, Position = 1)]
    [String] $roletypeTag
  )
  $begin = Get-Date
  outLog "ProcessADObjects called at: " $begin $init
   
  $adObjectEntries | Add-Member OldName ""
  $adObjectEntries | Add-Member GroupName ""
  $adObjectEntries | Add-Member GUIADGroupName ""
  $adObjectEntries | Add-Member GUIADGroupDisplayName ""

  $DAWGruppenAnlegenOutList = [System.Collections.Generic.List[string]]::new()
  $DAWGruppenverwaltungOutList = [System.Collections.Generic.List[string]]::new()
  $DAWGruppenverwaltungNeuOutList = [System.Collections.Generic.List[string]]::new()
  $KURSSollProfileOutList = [System.Collections.Generic.List[string]]::new()
  $KURSIstMitarbeiterProfileOutList = [System.Collections.Generic.List[string]]::new()
  # Mitarbeiter einlesen und Persnr zu S-Userid in Array speichern
  $MitarbeiterEntries = Get-Content -Path $MitarbeiterInFilePath | ConvertFrom-Csv -Delimiter ";"
  $mitarbeiter_array = @{"mitarbeiter" = "mitarbeiter"}
  $mitarbeiterStelle_array = @{"mitarbeiter" = "stelle"}
  foreach ($item in $MitarbeiterEntries)
  {
    if ([System.String]::IsNullOrEmpty($item.Benutzerkennung))
    {
      continue
    }
    try
    {
      $mitarbeiter_array.Add($item.Benutzerkennung, ([string]$item.Personalnummer).PadLeft(10, '0'))

      $oe = $item."OE-Schl$([char]0x00fc)ssel"
      $stelle = ($item.'St.-Nr.').PadLeft(4, '0')
      $dum = $oe + "/" + $stelle
      $mitarbeiterStelle_array.Add($item.Benutzerkennung, $dum)
    }
    catch
    {
      writeExceptionInfo $_ -Rethrow
    }
  }

  $pkey_array = @{"key" = 0}
  $rbkey_array = @{"key" = 0}
        
  # FileSystemAccess ---------------------------------------------
  if ($roletypeTag -ieq $FI.TypeTagFilesystemAccess)
  {

    # ToDo: Anwendungszugriff: Mapping #$AnwendungenFilePath $item.Verzeichnisname, Anwendungen werden nicht gefunden

    try
    {
    
      $DirectoriesFilePath = $DirectoriesInFilePath

      $AnwendungenFilePath = $ApplicationsInFilePath
      $AnwendungenFilePathEntries = Get-Content -Path $AnwendungenFilePath | ConvertFrom-Csv -Delimiter ";" 
      $nummer_array = @{"nummer" = "nummer"}

      foreach ($item in $AnwendungenFilePathEntries)
      {
        if ([System.String]::IsNullOrEmpty($item.Verzeichnisname))
        {
          continue
        }
        try
        {
          Write-Host $item.Verzeichnisname + $item.'Nr.'
          $nummer_array[$item.Verzeichnisname] = $item.'Nr.'
        }
        # Leere Eintraege
        catch
        {
          writeExceptionInfo $_ -Rethrow
        }
      }


       
      # UTF / ANSI conflict workaround
      # $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | ConvertFrom-Csv -Delimiter ";" 

      # Einlesen der Datei XXXX_Verzeichnisse.csv
      # "Verzeichnisname" -> wird verwendet
      # "Normierter Pfad" -> wird verwendet
      # "Kontrolle" 
      # "Endpunktname" 
      # "Verzeichnisbuchstabe" 
      # "Verzeichnisart" -> wird verwendet
      # "AWNR" -> wird verwendet
      # "Anwendungskuerzel" -> wird verwendet
      # "Gruppe Lesen" -> wird verwendet
      # "Gruppe Aendern" -> wird verwendet
      # "Benutzer mit Leserecht" 
      # "Benutzer mit Aenderungsrecht" 
      # "Rollen mit Leserecht" 
      # "Rollen mit Aenderungsrecht" 
      # "Name Verantwortlicher" 
      # "Verantwortlicher (Stelle oder Personalnummer)" -> wird verwendet

      #$header = "Verzeichnisname", "Normierter Pfad" , "Kontrolle" , "Endpunktname", "Verzeichnisbuchstabe", "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Benutzer mit Leserecht", "Benutzer mit Aenderungsrecht", "Rollen mit Leserecht", "Rollen mit Aenderungsrecht", "Name Verantwortlicher", "Verantwortlicher (Stelle oder Personalnummer)" 

      $header = "Verzeichnisname", "Normierter Pfad" , "Verzeichnisart", "AWNR", "Anwendungskuerzel", "Gruppe Lesen", "Gruppe Aendern", "Verantwortlicher (Stelle oder Personalnummer)" 
      $DirectoriesFilePathEntries = Get-Content -Path $DirectoriesFilePath | Select-Object -Skip 1 | ConvertFrom-Csv -Delimiter ";" -Header $header
        
      # Arrays mit Zusatzdaten
      $art_array = @{"art" = "art"}
      $path_array = @{"path" = "path"}
      $endpunkt_array = @{"endpunkt" = "endpunkt"}
      $verantwortlicher_array = @{"verantwortlicher" = "verantwortlicher"}
      $dkz_array = @{"kz" = "kz"}
      $dnummer_array = @{"dnummer" = "dnummer"}
      $fullpath_array = @{"fullpath" = "fullpath"}

      foreach ($item in $DirectoriesFilePathEntries)
      {
        # Arrays mit Zusatzdaten fuellen
        # $item | Out-String
        try
        {
          # $art_array.Add($item.'Gruppe Lesen', $item.Verzeichnisart)
          #Write-Host "----: " $item.Verzeichnisart " :----"
          # $path_array.Add($item.'Gruppe Lesen', $item.'Normierter Pfad')
          # $verantwortlicher_array.Add($item.'Gruppe Lesen', $item.'Verantwortlicher (Stelle oder Personalnummer)')
          # $dkz_array.Add($item.'Gruppe Lesen', $item.Anwendungskuerzel)
          # $dnummer_array.Add($item.'Gruppe Lesen', $item.AWNR)
          # $fullpath_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
          # $fullpath_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
          #Write-Host "----: " $item.'Gruppe Lesen' $item.Verzeichnisart $item.Anwendungskuerzel $item.AWNR          
          #Write-Host $item.'Gruppe Lesen' " -> " "----: " $item.Verzeichnisname " :----"

          # Neu auch Aendern betrachten
          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
          # $dkz_array.Add($item.'Gruppe Aendern', $item.Anwendungskuerzel)
          # $dnummer_array.Add($item.'Gruppe Aendern', $item.AWNR)
          $art_array[$item.'Gruppe Lesen'] = $item.Verzeichnisart         
          $path_array[$item.'Gruppe Lesen'] = $item.'Normierter Pfad' 
          $verantwortlicher_array[$item.'Gruppe Lesen'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
          $dkz_array[$item.'Gruppe Lesen'] = $item.Anwendungskuerzel
          $dnummer_array[$item.'Gruppe Lesen'] = $item.AWNR
          Write-Host $item.'Gruppe Lesen' $item.AWNR
          $fullpath_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
          $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
          $dkz_array[$item.'Gruppe Aendern'] = $item.Anwendungskuerzel
          $dnummer_array[$item.'Gruppe Aendern'] = $item.AWNR
          Write-Host $item.'Gruppe Aendern' $item.AWNR

          $fullpath_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
        }
        # Leere Eintraege
        catch
        {
          writeExceptionInfo $_ -Rethrow        
        }
        try
        {
          $endpunkt_array[$item.'Gruppe Lesen'] = $item.Verzeichnisname
          # $endpunkt_array.Add($item.'Gruppe Lesen', $item.Verzeichnisname)
          #Write-Host $item.'Gruppe Lesen' $item.Verzeichnisname            
        }
        # Leere Eintraege
        catch
        {
          writeExceptionInfo $_ -Rethrow        
        }

        # UTF / ANSI conflict workaround
        # $art_array.Add($item.'Gruppe �ndern', $item.Verzeichnisart);
        # $path_array.Add($item.'Gruppe �ndern', $item.'normierter Pfad');

        #Write-Host "+--:" $item.'Gruppe Aendern' $item.Verzeichnisart $item.'Verantwortlicher (Stelle oder Personalnummer)'
        try
        {
          $art_array[$item.'Gruppe Aendern'] = $item.Verzeichnisart
          # $art_array.Add($item.'Gruppe Aendern', $item.Verzeichnisart)
          #Write-Host "Art Array: " $item.'Gruppe Aendern' $item.Verzeichnisart
        }
        # Leere Eintraege
        catch
        {
          writeExceptionInfo $_ -Rethrow        
        }
            
        try
        {
          # $path_array.Add($item.'Gruppe Aendern', $item.'Normierter Pfad')
          # $verantwortlicher_array.Add($item.'Gruppe Aendern', $item.'Verantwortlicher (Stelle oder Personalnummer)')
          $path_array[$item.'Gruppe Aendern'] = $item.'Normierter Pfad' 
          $verantwortlicher_array[$item.'Gruppe Aendern'] =  $item.'Verantwortlicher (Stelle oder Personalnummer)'
        }
        # Leere Eintraege
        catch
        {
          #Write-Host "Schon enthalten in array: " $item.'Gruppe Aendern'                               
          writeExceptionInfo $_ -Rethrow        
        }
        #Write-Host $item.'Gruppe Aendern' ": " $item.'Verantwortlicher (Stelle oder Personalnummer)'
        try
        {
          # $endpunkt_array.Add($item.'Gruppe Aendern', $item.Verzeichnisname)
          $endpunkt_array[$item.'Gruppe Aendern'] = $item.Verzeichnisname
          #Write-Host $item.'Gruppe Aendern' $item.Verzeichnisname            
        }
        # Leere Eintraege
        catch
        {
          #Write-Host "Schon enthalten in endpunkt_array: " $item.'Gruppe Aendern'                               
          writeExceptionInfo $_ -Rethrow
        }
      }

      #exit
      $FileSystemAccessEntries = Import-Csv -Path $FileSystemAccessTmpFilePath -Delimiter ";"
      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
      $FileSystemAccessEntriesNew = [System.Collections.Generic.List[object]]::new()

      # Arrays zum Speichern der Schluessel fuer die verschiedenen Unterbereiche
      $key_array = @{"key" = 0}
      $avkey_array = @{"key" = 0}
      #$pkey_array = @{"key" = 0}

      # $cntEntries = 0
      # $cntNichtGelistet = 0

      #$blaCnt = 0

      foreach ($item in $FileSystemAccessEntries)
      {
        #$item | Out-String

        if ($item.Name.Contains("GGF-VDA-"))
        {
          continue
        }

        #$blaCnt++

        #if($blaCnt -ge 10) {
        #    exit
        #}

        $DisplayName = $item.ShortCut + $item.Name.Substring($item.Name.IndexOf('-') + 1) 
        $TempString = $item.Name.Split('-')

        # String fuer Namensende ermitteln
        $EndString = ""
        if ($item.Name.EndsWith("_L"))
        {
          $EndString = "_L"
        }
        elseif ($item.Name.EndsWith("_A"))
        {
          $EndString = "_A"
        }
        # Sollte nicht vorkommen
        else
        {
          $EndString = "_X"
        }
            
        $NewShortName = ""

        # Praefix fuer die Unterbereiche
        #$V = "V1_"
        $V = ""

        #Write-Host $art_array.Item($item.Name)

        #Prj
        #Aus
        #Tea
        #Pgr


        $V = $art_array.Item($item.Name) + "_"

        if ($art_array.Item($item.Name) -ieq "FAC123")
        {
          $V = "FAC_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "AUS123")
        {
          $V = "AUS_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "PKU123")
        {
          $V = "PKU_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "SON123")
        {
          $V = "SON_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "UBE123")
        {
          $V = "UBE_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "UNT123")
        {
          $V = "UNT_"
          $V = ""
        }
        elseif ($art_array.Item($item.Name) -ieq "VAW123")
        {
                
          $V = "VAW_"
          $AWNRNEW = "9997"
          $DKZ = "XXXXX"

          try
          {
            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
            $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
            if(-not $AWNRNEW)
            {
              $AWNRNEW = "9997"
            }
          }
          catch
          {
            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
            writeExceptionInfo $_ -Rethrow 
          }

          try
          {
            $DKZ = $dkz_array.Item($item.Name)

            if(-not $DKZ)
            {
              $DKZ = "XXXXX"
            }
          }
          catch
          {
            #Write-Host "Nicht gefunden: " $endpunkt_array.Item($item.Name)
            writeExceptionInfo $_ -Rethrow
          }

          Write-Host "####: " $AWNRNEW $DKZ $item.Name
          #$V = "V_" + $AWNRNEW + "_" + $endpunkt_array.Item($item.Name) + $EndString
          $V = "VAW_" + $AWNRNEW + "_" + $path_array.Item($item.Name) + $EndString
          #$V = "VX_" + $AWNRNEW + "_"
          $VDUM = $V.Replace("_VR_", "_")
          $V =  $VDUM
          Write-Host "##--: " $V $VDUM
        }
 
        # Pruefen ob Name im Array (in der Verzeichnisliste) vorhanden ist
        if ($art_array.Contains($item.Name))
        {
          if ($art_array.Item($item.Name) -ieq "Programm-Ablage")
          {
            $NewShortName = $V
            #Write-Host "---: " $item.Name $AWNRNEW $V
          }
          elseif ($art_array.Item($item.Name) -ieq "VAW")
          {
            $NewShortName = $V
          }
          elseif ($art_array.Item($item.Name) -ieq "PRG")
          {
            try
            {
              $AWNRNEW = $dnummer_array.Item($item.Name).PadLeft(4, '0')
              if(-not $AWNRNEW)
              {
                $AWNRNEW = "9998"
              }
            }
            catch
            {
              Write-Host "AWNRNEW nicht gefunden: " $item.OldName
              $AWNRNEW = "9998"
              writeExceptionInfo $_ -Rethrow
            }
            Write-Host "AWNRNEW ----: " $AWNRNEW
    
            $NewShortName = "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_" + $path_array.Item($item.Name) + $EndString
          }                
          else
          {
            $NewShortName = $V + $path_array.Item($item.Name) + $EndString
            #$NewShortName = $V
          }
        }
        else
        {
          # '_A' oder '_L' entfernen
          $test = $item.Name.Substring(0, $item.Name.Length - 2)

          if ($key_array.ContainsKey($test))
          {
            #$key_array.Item("OE_" + $oenum[0])++
            #Write-Host "+++ gefunden +++: " $key_array.Item($test)
          }
          else
          {
            $cntNichtGelistet++
            $key_array.Add($test, $cntNichtGelistet)
            #Write-Host "+++ insert +++: " $key_array.Count
          }

          $NewShortName = "VX_" + "nicht" + "_" + "gelistet" + "_" + $key_array.Item($test) + $EndString
          #Write-Host "nicht gelistet: "  $item.Name " " $key_array.Item($test) " " $test " " $NewShortName
        }

        $NewFullName = $Institut + "GGX-" + $NewShortName 

        $Description = $item.Description

        if ($Description.Contains("## keine Beschreibung ##"))
        {
          $VA = $verantwortlicher_array.Item($item.Name)
          #Write-Host $VA
          $Description = $Description + " Verantwortlicher: " + $VA
          #Write-Host $NewFullName $Description
        }

        $FileSystemAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName; GUIProcessingNote = ""; OldName = $item.Name })
        # $outFileEntry = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append    
        $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
        $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
        Write-Host "-_-_-_-_: " $NewShortName
        Write-Host "-_-_-_-_: " $NewFullName
      }

      $i = 1

      $CntPRG = 0000000
      $CntSON = 0100000
      $CntSPA = 0200000
      # $CntSKL = 0200000
      $CntSPK = 0300000
      $CntVRZ = 0400000
      $CntVOE = 0500000        

      foreach ($item in $FileSystemAccessEntriesNew)
      {
        # Write-Host "processing entry #"$i.ToString()
        #$item | Select-Object -Property *
        $item | Out-String

        #if ($item.Name.Contains("GGF-VDA-")) {
        #    continue
        #}

            
        $roleType = "unknown"
        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagFilesystemAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
        foreach ($relevantRoleType in $relevantRoleTypes)
        {
          if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
          {
            $roleType = $relevantRoleType.TypeName 
            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
            break
          }
        }

        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
        $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
        $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
        # BUGFIX 2026-07-05 (ported from R125): removed a second Add of the (former) Neu
        # line into the Out list, which duplicated every FileSystemAccess creation row.
        $NewFullName = $item.'GUIADGroup.Name'

        $ProfilNummer = 0
        $ProfilName = ""
        $VerzeichnisArt = $art_array.Item($item.OldName)

        try
        {
          $MYANR = $dnummer_array.Item($item.OldName)
          $DKZ = $dkz_array.Item($item.OldName)

          if(-not $DKZ)
          {
            $MYANR = "9997"
          }
        }
        catch
        {
          $MYANR = "9997"
          writeExceptionInfo $_ -Rethrow
        }

        $FullPath = $fullpath_array.Item($item.OldName)

        Write-Host $item.OldName " -> " "--- MYANR: " $MYANR ": " $VerzeichnisArt ": " $FullPath "!"

        ###############################################
        $AWNRNEW = "9997"
        $EndString = ""

        try
        {
          $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
          if(-not $AWNRNEW)
          {
            $AWNRNEW = "9998"
          }
          Write-Host "AWNRNEW ----: " $AWNRNEW
        }
        catch
        {
          Write-Host "AWNRNEW nicht gefunden: " $item.OldName
          $AWNRNEW = "9998"
          writeExceptionInfo $_ -Rethrow
        }

        if ($VerzeichnisArt -ieq "SPA")
        {
          $ProfilNummer = "42" + ([string]$CntSPA).PadLeft(7, '0')
          $CntSPA++

          $ProfilName = "SPA " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf SPA aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf SPA lesen " + $NewFullName
          }

        }
        elseif ($VerzeichnisArt -ieq "SON")
        {
          $ProfilNummer = "42" + ([string]$CntSON).PadLeft(7, '0')
          $CntSON++

          $ProfilName = "SON " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf SON aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf SON lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "SPK")
        {
          $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
          $CntSPK++

          $ProfilName = "SPK " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "VRZ")
        {
          $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
          $CntVRZ++

          $ProfilName = "VRZ " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "VOE")
        {
          $ProfilNummer = "42" + ([string]$CntVOE).PadLeft(7, '0')
          $CntVOE++

          $ProfilName = "VOE " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf VOE aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf VOE lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "PRG")
        {
          Write-Host "AWNRNEW ----: " $AWNRNEW

          if ($AWNRNEW -ieq "9997")
          {
            $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
            $CntPRG++
          }
          elseif ($AWNRNEW -ieq "0000")
          {
            $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
            $CntPRG++
          }
          else
          {
            if ($rbkey_array.ContainsKey("PAN_" + $AWNRNEW))
            {
              $rbkey_array.Item("PAN_" + $AWNRNEW)++
              #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
            }
            else
            {
              $rbkey_array.Add("PAN_" + $AWNRNEW, 200)
              #Write-Host "+++ insert +++: " $pkey_array.Count
            }
    
            $ProfilNummer = "40" + ([string]$AWNRNEW).PadLeft(4, '0') + $rbkey_array.Item("PAN_" + $AWNRNEW)
            #$CntPRGDUM++
          }

          #$ProfilNummer = "61" + ([string]$CntPRG).PadLeft(7, '0')
          #$CntPRG++
          #$NewFullName = $NewFullName.Replace("PRG_", "PRG_" + ([string]$AWNRNEW).PadLeft(4, '0') + "_")
          $NewFullName = $NewFullName.Replace("PRG_", "PRG_")

          $ProfilName = "SIA " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf SIA aendern " + $NewFullName.Replace($SPKID + "GGX-", "")
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf SIA lesen " + $NewFullName.Replace($SPKID + "GGX-", "")
          }
                
        }
        elseif ($VerzeichnisArt -ieq "PRG12")
        {
          $ProfilNummer = "42" + ([string]$CntPRG).PadLeft(7, '0')
          $CntPRG++

          $ProfilName = "PROG " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf PRG aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf PRG lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "VRZ")
        {
          $ProfilNummer = "42" + ([string]$CntVRZ).PadLeft(7, '0')
          $CntVRZ++

          $ProfilName = "VRZ " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf VRZ aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf VRZ lesen " + $NewFullName
          }
                
        }
        elseif ($VerzeichnisArt -ieq "SPK")
        {
          $ProfilNummer = "42" + ([string]$CntSPK).PadLeft(7, '0')
          $CntSPK++

          $ProfilName = "SPK " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf SPK aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf SPK lesen " + $NewFullName
          }
                
        }

        elseif ($VerzeichnisArt -ieq "PROG1")
        {
          #Write-Host "Anwendungszugriff"
          $ProfilNummer = $CntProgramm
          $CntProgramm++

          $ProfilName = "Anwendungsverzeichnis " + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf Programm aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf Programm lesen " + $NewFullName
          }

          #nummer_array
          $AWNRNEW = "9997"
          $EndString = ""

          try
          {
            #Write-Host "Anwendungszugriff"
            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
            $AWNRNEW = $dnummer_array.Item($item.OldName).PadLeft(4, '0')
            if(-not $AWNRNEW)
            {
              $AWNRNEW = "9997"
            }

            #Write-Host "----: " $AWNRNEW
          }
          catch
          {
            Write-Host "Nicht gefunden: " $item.OldName
            #Write-Host "Nicht gefunden: " $item.Name
          }

          try
          {
            #Write-Host "Anwendungszugriff"
            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.OldName)).PadLeft(4, '0')
            #$AWNRNEW = $nummer_array.Item($endpunkt_array.Item($item.Name)).PadLeft(4, '0')
            $DKZ = $dkz_array.Item($item.OldName)

            if(-not $DKZ)
            {
              $DKZ = "XXXXX"
            }

            $bla = $NewFullName.Replace("-AV_", "-AZ_")
            # $NewFullName = $DKZ + $bla.Substring(7)
            $NewFullName = $bla.Substring(7)
            #Write-Host "----: " $AWNRNEW $DKZ $NewFullName
          }
          catch
          {
            Write-Host "Nicht gefunden: " $item.OldName
            writeExceptionInfo $_ -Rethrow
          }

          if ($pkey_array.ContainsKey("PAN_" + $AWNRNEW))
          {
            $pkey_array.Item("PAN_" + $AWNRNEW)++
            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNRNEW)
          }
          else
          {
            $pkey_array.Add("PAN_" + $AWNRNEW, 1)
            #Write-Host "+++ insert +++: " $pkey_array.Count
          }
                
          # Profilnummer bauen: 50<AWNummer>9nn
          $ProfilNummer = "10" + $AWNRNEW + "" + ([string]$pkey_array.Item("PAN_" + $AWNRNEW)).PadLeft(3, '0')
          #Write-Host $CntProgramm $NewFullName $item.OldName $ProfilNummer
        }
        elseif ($VerzeichnisArt -ieq "AW")
        {
          if ($avkey_array.ContainsKey("AV_" + $MYANR))
          {
            $avkey_array.Item("AV_" + $MYANR)++
            #Write-Host "+++ update +++: " $avkey_array.Item("AV_" + $MYANR)
          }
          else
          {
            $avkey_array.Add("AV_" + $MYANR, 1)
            #Write-Host "+++ insert +++: " $avkey_array.Count
          }


          $ProfilNummer = "40" + $MYANR.PadLeft(4, '0') + ([string]$avkey_array.Item("AV_" + $MYANR)).PadLeft(3, '0')
          #Write-Host $ProfilNummer
          $CntAv++

          $ProfilName = "AW_" + $NewFullName
          if ($NewFullName.EndsWith("_A"))
          {
            $ProfilName = "Zugriff auf Anwendungsverzeichnisse aendern " + $NewFullName
          }
          elseif ($NewFullName.EndsWith("_L"))
          {
            $ProfilName = "Zugriff auf Anwendungsverzeichnisse lesen " + $NewFullName
          }

        }
        else
        {
          #Write-Host "+-+-+-+-+-+-+- Unbekannte-Ablage: " $VerzeichnisArt
          try
          {
            $ProfilNummer = "97000"  + ([string]$CntElse).PadLeft(4, '0')
          }
          catch
          {
            $ProfilNummer = "97000" + ([string]$CntElse).PadLeft(4, '0')
            writeExceptionInfo $_ -Rethrow
          }
          $CntElse++
          $ProfilName = "Unbekannte-Ablage " + $NewFullName
        }   
            
        $dum = $verantwortlicher_array.Item($item.OldName)
        if ($dum)
        {
          if ( $dum.StartsWith("S" + $SPKNO))
          {
            $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
          }
        }
        else
        {
          $dum = "0570000/0012"
        }
        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("P030GGX-", "") + ";" + $ProfilName + ";" + $dum + ";" + $item.OldName | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
 
        #($ProfilNummer).ToString() + ";" + $NewFullName.Replace("Z001GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";" + $VerzeichnisArt | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 


        #Fullpath $FullPath
        # ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
        $KURSSollProfileOutLine = ($ProfilNummer).ToString() + ";" + $NewFullName.Replace($SPKID + "GGX-", "").Replace("_1552_", "_AD_") + ";" + $ProfilName.Replace("-AZ_", "-AV_") + ";" + $dum + ";" + $item.OldName + ";" + "Verzeichnispfad: " + $FullPath + ";" + $VerzeichnisArt
        $KURSSollProfileOutList.Add($KURSSollProfileOutLine)


        foreach ($item1 in $ADObjectMemberships)
        {
          if ($item1.GroupName -ieq $item.OldName)
          {
            if ($item1.MemberClass -ieq "user")
            {
              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
              $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + ""
              $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)


              # Kurs Daten schreiben
              #Write-Host $u.MemberName $mitarbeiter_array.Item($u.MemberName)
              $dum = $mitarbeiter_array.Item($item1.MemberName)
              if (-not $dum)
              {
                $dum = $item1.MemberName
              }
              # dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
              $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "FileSystemAccess"
              $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
            }
            elseif ($item1.MemberClass -ieq "group")
            {
              # O(1) index lookup instead of a full linear scan over $ADObjectMemberships.
              # Key matches buildAllUserMembershipsCache: GroupName + "|" + MemberClass.
              #edmond
              # $userKey = $item1.MemberName + "|user"
              # $userKey = getMembershipIndexKey $item1.MemberName "user"
              # $users = $null
              # if (-not $membershipIndex.TryGetValue($userKey, [ref] $users))
              # {
              #   $users = [System.Collections.Generic.List[object]]::new()
              # }             
              $users = getUsersByMemberGroup $item1.MemberName
              foreach ($u in $users)
              {
                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
                $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("-SE_", "-VSE_") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName
                $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
              }
            }
          }
        }
            
        $i++
      }
    }
    catch
    {
      writeExceptionInfo $_ -Rethrow 
    }       

    #exit
  }


  # AppAccess ---------------------------------------------
  elseif ($roletypeTag -ieq $FI.TypeTagAppAccess)
  {
    try
    {

      $AnwendungenFilePath = $ApplicationsInFilePath
      $AnwendungenFilePathEntries = Get-Content -Path $AnwendungenFilePath | ConvertFrom-Csv -Delimiter ";" 
      $nummer_array = @{"nummer" = "nummer"}
      $verantwortlicher_array = @{"verantwortlicher" = "verantwortlicher"}
      $kz_array = @{"kz" = "kz"}
      $beschreibung_array = @{"beschreibung" = "beschreibung"}
        
      $Verantwortlicher
      $MyKey

      # Anwendungsliste einlesen
      # Nr. -> wird verwendet
      # AWK -> wird verwendet
      # FullAccount -> wird verwendet
      # Verzeichnisname
      # Endpunktname 
      # Gruppe Ändern 
      # Verantwortlicher -> wird verwendet


      foreach ($item in $AnwendungenFilePathEntries)
      {
        $Verantwortlicher = $item.'Verantwortlicher (FPV)'

        #write-host "-----------------: "  $Verantwortlicher

        if (-not $Verantwortlicher)
        {
          $Verantwortlicher = "0570000/0012"
        }
        else
        {
          if ( $Verantwortlicher.StartsWith("S" + $SPKNO))
          {
            $dum = $mitarbeiterStelle_array.Item($Verantwortlicher)
            $Verantwortlicher = $dum
          }
        }
        $MyKey = $item.FullAccount.Split('\')

        Write-Host "-----------------:" $MyKey[0] $MyKey[1]

        Write-Host "#############-------------:" $MyKey[1] $item.'Nr.' $Verantwortlicher

        if($MyKey[1])
        {
          if (-not $nummer_array.ContainsKey($MyKey[1]))
          {
            $nummer_array[$MyKey[1]] = $item.'Nr.'
            $verantwortlicher_array[$MyKey[1]] = $Verantwortlicher
            $kz_array[$MyKey[1]] = $item.'AWK'
            # $item.'Beschreibung' was changed to $item.'Beschreibung (256 Zeichen)'
            $beschreibung_array[$MyKey[1]] = $item.'Beschreibung (256 Zeichen)'

            Write-Host "+++--------------:" $item.'Nr.' $Verantwortlicher $item.'AWK'
          }
        }
      }

      #Exit

      $AppAccessEntries = Import-Csv -Path $AppAccessTmpFilePath -Delimiter ";"
      # Use a generic List instead of @() + '+=' to avoid O(n^2) array re-allocation.
      $AppAccessEntriesNew = [System.Collections.Generic.List[object]]::new()
      foreach ($item in $AppAccessEntries)
      {
            
        # Anwendungsnummer fuer Objekt suchen
        $AWNR = $nummer_array.Item($item.Name)
        Write-Host "--------: " $item.Name $AWNR
        # Wenn nicht gefunden mit '9999' besetzen
        if (-not $AWNR)
        {
          $AWNR = 9000
        }
        # Nummer 4 stellig mit fuehrenden Nullen auffuellen
        $AWNR = ([string]$AWNR).PadLeft(4, '0')
        # Shortcut setzen
        $ShortCut = "AZ_"
        # Ausnahme fuer Shortcut (z.B. VRZ) wenn 'GGF-', laut N.Z. fuer alle Kassen da von FI gesetzt
        if ($item.Name.Contains("GGF-"))
        {
          $ShortCut = "AZ_" 
        }

        $NewShortName = $ShortCut + $AWNR + "_" + $item.Name.Substring($item.Name.IndexOf('-') + 1)
        $NewFullName = $Institut + "GGX-" + $NewShortName.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")
        #Serviceportal

        $AppAccessEntriesNew.Add(@{ GUIMandator = $Institut; 'GUIADGroup.Name' = $NewFullName; 'GUIADGroup.Description' = $item.Description; GUIMandatorADGroupType = "Role"; 'GUIADGroup.DisplayName' = $NewShortName.Replace("Serviceportal", "SVP"); GUIProcessingNote = ""; OldName = $item.Name })
        # $outFileEntry = $Institut + ";" + $NewFullName + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
        # $outFileEntry | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
        $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-SE_", "-VSE_") + ";" + $item.Description + ";" + 'Role' + ";" + $NewShortName + ";;" + $item.Name
        $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
      }

      $i = 1
      $ProfilNummerAZ = 1
      $ProfilNummerAV = 1

      foreach ($item in $AppAccessEntriesNew)
      {
        # Write-Host "processing entry #"$i.ToString()
	    
        $roleType = "unknown"
        $relevantRoleTypes = $SPK.GroupManagementMappings | Where-Object { $_.OU -ieq $FI.TypeTagAppAccess } | Sort-Object { [int]$_.Order } # BUGFIX 2026-07-02: scriptblock sort works on PS 5.1 + 7 (see getRoleType)
        foreach ($relevantRoleType in $relevantRoleTypes)
        {
          if ($item.OldName -cmatch $relevantRoleType.TagRegExp)
          {
            $roleType = $relevantRoleType.TypeName 
            # Write-Host "found TypeName" $roleType "for entry" $adObjectEntry.Oldname "using regular expression" $relevantRoleType.TagRegExp
            break
          }
        }

        if($item.OldName -like "*GGT-0-*")
        {
          $roleType = "ApplicationSIA"
          Write-Host "---------------:" $roleType $item.OldName
        }
	    	    
        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
        # $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
        $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $item.OldName + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
        $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)

        $ProfilNummer = ""

        $NeueBeschreibung = ""

        # Muell
        if ($item.'GUIADGroup.Name' -like "*GGX-A_*")
        {
          $PnrStr = ([string]$ProfilNummerAZ).PadLeft(3, '0')
          $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')
          $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
          $dum = $verantwortlicher_array.Item($item.OldName)
                
          $kz = $kz_array.Item($item.OldName)
          $NeueBeschreibung = $beschreibung_array.Item($item.OldName)

          $aname = $item.'GUIADGroup.Name'.Substring(15)

          Write-Host "++++++++++: " $aname $item.'GUIADGroup.Name'

          if ($dum)
          {
            if ($dum.StartsWith("S" + SPKNO))
            {
              $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
            }
          }
          else
          {
            $dum = "0570000/0012"
          }

          if ($pkey_array.ContainsKey("PAZ_" + $AWNR))
          {
            $pkey_array.Item("PAZ_" + $AWNR)++
            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
          }
          else
          {
            $pkey_array.Add("PAZ_" + $AWNR, 1000)
            #Write-Host "+++ insert +++: " $pkey_array.Count
          }

          #$PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
    
          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
          if ($AWNR -ieq "0000")
          {
            $AWNR = "9000"
          }

          $ProfilNummerAZ++
          Write-Host "-+++++: " $ProfilNummerAZ
          Write-Host "++++++: " $PnrStr

          ##"4" + $AWNR + "" + ($PnrStr).ToString() + ";" + $kz + "-" + $aname + ";" + $ProfilName.Replace("P030GGX-", "") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
          $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + "AZ_" + $AWNR + "_" + $aname + ";" + $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + $dum + ";" + $item.OldName + ";" + $item.'GUIADGroup.Description' + ";Mist"
          $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
          $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
          #Write-Host "---: " $item.'GUIADGroup.Name'
          $ProfilNummerAZ++
        }
        # Anwendungszugriff
        else
        {
          $AWK = "1"
          $PnrStr = ([string]$ProfilNummerAV).PadLeft(3, '0')
          $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(4, '0')

          $AWK = ([string]$kz_array.Item($item.OldName)).PadLeft(5, '0')

          #$kz_array.Add($MyKey[1], $item.'AWK')

          #$ProfilName = "Anwendungsverzeichnis " + $item.'GUIADGroup.Name'
          $dum = $verantwortlicher_array.Item($item.OldName)

          $kz = $kz_array.Item($item.OldName)
          $NeueBeschreibung = $beschreibung_array.Item($item.OldName)

          $aname = $item.'GUIADGroup.Name'.Substring(15)

          if (-not $NeueBeschreibung)
          {
            $ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'
          }
          else
          {
            $ProfilName = $NeueBeschreibung
          }

          Write-Host "+++ neue Beschreibung +++: " $ProfilName
          #$ProfilName = "Anwendungszugriff " + $item.'GUIADGroup.Name'

          Write-Host "########: " $aname $item.'GUIADGroup.Name' $AWK

          if ($dum)
          {
            if ($dum.StartsWith("S" + SPKNO))
            {
              $dum = $mitarbeiterStelle_array.Item($verantwortlicher_array.Item($item.OldName))
            }
          }
          else
          {
            $dum = "0570000/0012"
          }

          if (-not $kz)
          {
            $kz = "XXXXX"
          }
    
          if ($pkey_array.ContainsKey("PAZ_" + $AWNR))
          {
            $pkey_array.Item("PAZ_" + $AWNR)++
            #Write-Host "+++ update +++: " $pkey_array.Item("PA_" + $AWNR)
          }
          else
          {
            #$pkey_array.Add("PA_" + $AWNR, 500)
            $pkey_array.Add("PAZ_" + $AWNR, 100)
            #Write-Host "+++ insert +++: " $pkey_array.Count
          }

          $PnrStr = ([string]$pkey_array.Item("PAZ_" + $AWNR)).PadLeft(3, '0')
          #"50" + $AWNR + "9" + ($PnrStr).ToString() + ";" + $item.'GUIADGroup.Name' + ";" + $ProfilName + ";" + $dum + ";" + "" | out-file $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
          ##$NNNAME = $kz + "-" + $aname
                
          #Anwendungsnummer im Namen
          $NNNAME = "AZ_" + $AWNR + $aname

          #Anwendungskuerzel im Namen
          #$NNNAME = "AZ_" + $AWK + $aname

            
          if ($AWNR -ieq "0000")
          {
            $AWNR = "9998"
          }
          Write-Host "-+++++: " $ProfilNummerAV
          Write-Host "++++++: " $PnrStr

          $MYDESC007 = $ProfilName.Replace($SPKID + "GGX-", "").Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte")

          # "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"| Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
          $KURSSollProfileOutLine = "40" + $AWNR + "" + ($PnrStr).ToString() + ";" + $NNNAME.Replace("-_", "-") + ";" + $MYDESC007 + ";" + $dum + ";" + $item.OldName + ";" + $MYDESC007 + ". AD Beschreibung:" + $item.'GUIADGroup.Description' + ";AppAccess"
          $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
          $ProfilNummer = "10" + $AWNR + "" + ($PnrStr).ToString()
          $ProfilNummerAV++
        }
        #            foreach ($userMemberShip in $userMemberShips) {


        foreach ($item1 in $ADObjectMemberships)
        {

          if ($item1.GroupName -ieq $item.OldName)
          {   
            #Write-Host $item1.MemberClass ": " $item.OldName
            if ($item1.MemberClass -ieq "user")
            {
              #Write-Host "User"
              # Write-Host "writing direct membership entry #"$i.ToString() ", user" $u.MemberName
              #$Institut + ";" + "RoleRalph" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
              # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
              $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $item1.MemberName + ";" + "" + ";" + "" + ";" + "user" + ";" + $item.OldName
              $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
    
              # Kurs Daten schreiben
              $dum = $mitarbeiter_array.Item($item1.MemberName)
              if (-not $dum)
              {
                $dum = $item1.MemberName
              }
              # $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append                        
              $KURSIstMitarbeiterProfileOutLine = $dum + ";" + $item.OldName + ";" + ($ProfilNummer).ToString() + ";" + "AppAccess"
              $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
            }
            elseif ($item1.MemberClass -ieq "group")
            {
              # BUGFIX 2026-07-05 (ported from R125): without this assignment $users is
              # empty/stale here and the foreach below never emits the indirect
              # (group-inherited) AZ_* membership rows.
              $users = getUsersByMemberGroup $item1.MemberName
              foreach ($u in $users)
              {
                # Write-Host "writing indirect membership entry #"$i.ToString() ", user" $u.MemberName "from group" $item1.MemberName
                #$Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name' + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item1.MemberName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
                # $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
                $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $item.'GUIADGroup.Name'.Replace("Serviceportal", "SVP").Replace("Anforderungsmanagementberichte", "Anforderungsmgtberichte") + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $u.MemberName + ";" + "" + ";" + "" + ";" + "group" + ";" + $item.OldName
                $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
              }
            }
          }
        }

        $i++
      }
    }
    catch
    {
      writeExceptionInfo $_ -Rethrow
    }       
  }
  # AppConfiguration ---------------------------------------
  elseif ($roletypeTag -ieq $FI.TypeTagAppConfiguration)
  {
    foreach ($adObjectEntry in $adObjectEntries)
    {

 
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName

      Write-Host $DisplayName

      $NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")

      if ($NewFullName.Contains("IntExK"))
      {
        continue
      }

      if ($DisplayName -eq "AK_WEB_SSKMG-STD")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
      }
      if ($DisplayName -eq "AK_IEK_Admins")
      {
        $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
      }
      if ($DisplayName -eq "AK_OFK_Office_Default")
      {
        $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
      }
      if ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
      }
      if ($DisplayName -eq "AK_WEB_OhneIntranet")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
      }
    
      #Write-Host $NewFullName
      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")
      #Write-Host $NewFullName

      $adObjectEntry.OldName = $adObjectEntry.ObjectName
      $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
      $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
      # $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
      $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE") + ";" + "" + ";" + $adObjectEntry.ObjectName
      $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
    }

    #Exit

    $i = 1
    $PNR = 1000000
    $DUMPNR = 410000000

    $MPNR = 0

    foreach ($adObjectEntry in $adObjectEntries)
    {
      Write-Host "processing entry #" $i.ToString()
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
      #$NewFullName = $Institut + "GGX-" + $DisplayName.Replace("OFK", "OFFK").Replace("IEK", "IntExK").Replace("WEB_EDGE", "WEB_MEDGE")

      #450000000	AKO_OFFK_Office_Default
      #460000000	AKE_IntExK_Admins
      #480000000	AKW_WEB_SSKMG-STD
      #480000001	AKW_WEB_IE_ALT_Videoueberwachung
      #480000002	AKW_WEB_OhneIntranet

      $NewFullName = $Institut + $DisplayName
      if ($DisplayName -eq "AK_WEB_SSKMG-STD")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_SSKMG-STD"
        $MPNR = 500000001
      }
      elseif ($DisplayName -eq "AK_IEK_Admins")
      {
        $NewFullName = $Institut + "GGX-AKE_IntExK_Admins"
        $MPNR = 500000002
      }
      elseif ($DisplayName -eq "AK_OFK_Office_Default")
      {
        $NewFullName = $Institut + "GGX-AKO_OFFK_Office_Default"
        $MPNR = 500000003
      }
      elseif ($DisplayName -eq "AK_WEB_IE_ALT_Videoueberwachung")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_IE_ALT_Videoueberwachung"
        $MPNR = 500000004
      }
      elseif ($DisplayName -eq "AK_WEB_OhneIntranet")
      {
        $NewFullName = $Institut + "GGX-AKW_WEB_OhneIntranet"
        $MPNR = 500000005
      }
      else
      {
        $NewFullName = $DisplayName
        $MPNR = $DUMPNR
        #$DUMPNR++;
      }

    
      $roleType = getRoleType $adObjectEntry $roletypeTag
      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append 
      $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
      $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
      $userMemberShips = @(getAllUserMemberships $adObjectEntry)

      $NewFullName1 = $NewFullName
      #$StelleVerant = "9999999/9999"
      #$StelleVerant = "3410200/0015"

      ## Richtige Stelle

      $StelleVerant = "0570000/0012" #auch fuer SEC, WEBBROWSER

      Write-Host 1
      Write-Host $MPNR
      Write-Host $NewFullName1
      Write-Host $StelleVerant
      Write-Host $adObjectEntry.OldName
      Write-Host 6

      # "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
      $KURSSollProfileOutLine = "" + $MPNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwendungskonfiguration " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AK"
      $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
      $PNR++
      $DUMPNR++

      foreach ($userMemberShip in $userMemberShips)
      {
        # Fehler
        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" +  "" + ";" +  "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
        $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
        $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)

        #Write-Host "## o: " $userMemberShip.Origin

        $persnr = "0000000000"
        #$ProfilNR = "4000007000"
        $ProfilNR = "" + $DUMPNR

        if ($userMemberShip.Origin -ieq "user")
        {
          #Write-Host "##: " + $userMemberShip.MemberName
          try
          {
            $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
            $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
            if (-not $dum)
            {
              $dum = $userMemberShip.MemberName
            }
            $persnr = $dum
          }
          catch
          {
            outLog "User nicht gefunden: " $u.MemberName
            writeExceptionInfo $_ -Rethrow 
          }
          #Write-Host "PN: " + $persnr
          # Kurs Daten schreiben
          # persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"| Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
          $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "AppConfiguration"
          $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
        }

      }
      $i++
    }
  }
  # AppOrganisation ---------------------------------------
  elseif ($roletypeTag -ieq $FI.TypeTagOrganisation)
  {
    $i = 1
    $ProfilNummer = 1
    $ProfilNR = 440000000
    foreach ($adObjectEntry in $adObjectEntries)
    {
                
      # DAWGruppenAnlegenOutArray füllen
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
    
      $NewFullName = $Institut + "GGX-" + $DisplayName 
      $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG")
      #$DisplayName1 = $DisplayName.Replace("O_G_", "OG_G_")
      $DisplayName1 = $DisplayName.Replace("O_", "OG_")
    
      $adObjectEntry.OldName = $adObjectEntry.ObjectName
      $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
      $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
      $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName1 + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $DisplayName1 + ";" + "" + ";" + $adObjectEntry.ObjectName
      $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)

      # Write-Host "processing entry #"$i.ToString()
      # not used here, see above 
      # $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      # $TempString = $adObjectEntry.ObjectName.Split('-')
      # $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
      # $NewFullName = $Institut + "GGX-" + $DisplayName 
      # $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-O", $SPKID + "GGX-OG") 
    
      #$roleType = getRoleType $adObjectEntry $roletypeTag
      $roleType = "Organisation"
      $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
      $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
      $PnrStr = ([string]$ProfilNummer).PadLeft(2, '0')
      # $AWNR = ([string]$nummer_array.Item($item.OldName)).PadLeft(3, '0')
      $AWNR = "xxxx"
      $ProfilName = "Organisatorische Gruppe " + $NewFullName1
      $ProfilNR++
      #$ProfilNR = "48" + $AWNR + "7" + ($PnrStr).ToString()
      $KURSSollProfileOutLine = [string]$ProfilNR + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + $ProfilName.Replace($SPKID + "GGX-OG_", "") + ";" + "0570000/0012" + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";OG"
      $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
      $ProfilNummer++
      $userMemberShips = @(getAllUserMemberships $adObjectEntry)
      foreach ($userMemberShip in $userMemberShips)
      {
        # Fehler laut Norbert
        #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
        $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
        $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass
        #$Institut + ";" + "Role" + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName  | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append
        #Write-Host "TypeTagOrganisation: " $userMemberShip.MemberClass

        #$userMemberShip | Out-String

        $persnr = "0000000000"

        if ($userMemberShip.Origin -ieq "user")
        {
          try
          {
            $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
            $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
            if (-not $dum)
            {
              $dum = $userMemberShip.MemberName
            }
            $persnr = $dum
          }
          catch
          {
            Write-Host "User nicht gefunden: " $u.MemberName
            writeExceptionInfo $_ -Rethrow 
          }

          # Kurs Daten schreiben
          $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $ProfilNR + ";" + "Organisation"
          $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
        }

      }
      $i++
    }
  }

  # Security ------------------------------------------
  elseif ($roletypeTag -ieq $FI.TypeTagSecurity)
  {

    $SicherheitseinstellungenFilePath = $SecurityInFilePath
    $SicherheitseinstellungenFilePathEntries = Get-Content -Path $SicherheitseinstellungenFilePath | ConvertFrom-Csv -Delimiter ";" 
    $sec_array = @{"nummer" = "nummer"}
    foreach ($item in $SicherheitseinstellungenFilePathEntries)
    {
      #write-host $item.Name $item.Verantwortlicher
      $sec_array[$item.Name] = $item.Verantwortlicher
    }

    #exit

    foreach ($adObjectEntry in $adObjectEntries)
    {
      $adObjectEntry.OldName = $adObjectEntry.ObjectName
      Write-Host "--++ OLDNAME: " $adObjectEntry.OldName
      if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
      {
        continue
      }
                
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
    
      $NewFullName = $Institut + "GGX-" + $DisplayName 

      Write-Host "Sicherheit: " + $NewFullName + $DisplayName + $NewFullName.Replace($SPKID + "GGX-S_", "SE_")
    
      $adObjectEntry.OldName = $adObjectEntry.ObjectName
      $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
      $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
      # $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | Out-File $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
      $DAWGruppenAnlegenOutLine = $Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace($SPKID + "GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName
      $DAWGruppenAnlegenOutList.Add($DAWGruppenAnlegenOutLine)
      Write-Host "--++ OLDNAME: Ende"
    }
    # --- once, before the loop -------------------------------------------------
    # Parametrised PN prefixes:
    #   $pnPrefix1 = two-digit numeric string  (e.g. "43")
    #   $pnPrefix2 = four-digit numeric string (e.g. "9000")
    # Final PN = prefix1 + prefix2 + three-digit suffix from the CSV.
    $pnPrefix1 = "43"
    $pnPrefix2 = "9000"
    # Load the ordered rule list. Order in the file = match priority (most specific
    # first), exactly like the original if/elseif cascade.
    $pnRules = [System.Collections.Generic.List[object]]::new()
    foreach ($row in (Import-Csv -Path $KURSProfileNumberMapping -Delimiter ";"))
    {
      $pnRules.Add([pscustomobject]@{
          Pattern = $row.Pattern
          PN      = $pnPrefix1 + $pnPrefix2 + $row.Suffix   # e.g. "43" + "9000" + "017"
        })
    }

    $iSonstiges = 0
    $ProfilNummerSonstigesStartWert = 430000000
    $PN = ""
    $StelleVerant = "0570000/0012"

    foreach ($adObjectEntry in $adObjectEntries)
    {
      #Write-Host "processing entry #"$i.ToString()

      Write-Host "OLDNAME: " $adObjectEntry.OldName

      if ( $adObjectEntry.OldName.Contains($SPKID + "GDT"))
      {
        continue
      }


      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
      $NewFullName = $Institut + "GGX-" + $DisplayName 

      #Write-Host "----------------------------------------------" $DisplayName $NewFullName
    
      $roleType = getRoleType $adObjectEntry $roletypeTag
      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
      # $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | Out-File $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
      $DAWGruppenverwaltungOutLine = $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + ""
      $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)

      $PN = $null
      foreach ($rule in $pnRules)
      {
        if ($DisplayName.Contains($rule.Pattern))
        {
          $PN = $rule.PN
          break                      # first match wins, just like elseif
        }
      }
      if ($null -eq $PN)
      {
        # the original 'else' branch
        $PN = ($ProfilNummerSonstigesStartWert + $iSonstiges).ToString()
        $iSonstiges++    
      }

      #############################################

      $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")

      Write-Host $NewFullName1

      $StelleVerant = $sec_array.Item($adObjectEntry.OldName)

      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append 
      $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Sicherheitseinstellung " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";SE"
      $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
      $userMemberShips = @(getAllUserMemberships $adObjectEntry)

      foreach ($userMemberShip in $userMemberShips)
      {
        $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
        $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)


        $persnr = "0000000000"

        if ($userMemberShip.Origin -ieq "user")
        {
          try
          {
            $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
            $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
            if (-not $dum)
            {
              $dum = $userMemberShip.MemberName
            }
            $persnr = $dum
          }
          catch
          {
            Write-Host "User nicht gefunden: " $u.MemberName
            writeExceptionInfo $_ -Rethrow 
          }

          # Kurs Daten schreiben
          # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
          $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "Security"
          $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
        }
      }

    }
  }

  # Anwenderrollen ------------------------------------------
  elseif ($roletypeTag -ieq $FI.TypeTagRole)
  {
    foreach ($adObjectEntry in $adObjectEntries)
    {
                
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
    
      $NewFullName = $SPKID + "GGX-" + $DisplayName 

      Write-Host "Rolle: " + $NewFullName + $DisplayName + $NewFullName 
    
      $adObjectEntry.OldName = $adObjectEntry.ObjectName
      $adObjectEntry.GUIADGroupName = $adObjectEntry.ObjectName  
      $adObjectEntry.GUIADGroupDisplayName = $DisplayName  
      #$Institut + ";" + $NewFullName.Replace("-S_", "-SE_") + ";" + $adObjectEntry.Description + ";" + 'Role' + ";" + $NewFullName.Replace("P030GGX-S_", "SE_") + ";;" + $adObjectEntry.ObjectName | out-file $DAWGruppenAnlegenOutFilePath  -Encoding "utf8NoBom" -Append
    }
    # BUGFIX 2026-07-02: re-enabled - with this commented out, the allowlist filter
    # below never ran and entries the original cascade skipped were processed.
    $prefixMatcher = buildPrefixMatcher $KURSProfilePrefixes

    $ProfilNummer = 470000000
    $ProfilNummerLM = 471000000
    $iSonstiges = 0
    $PN = ""
    $StelleVerant = "0570000/0012"

    foreach ($adObjectEntry in $adObjectEntries)
    {
      # Write-Host "processing entry #"$i.ToString()
      $DisplayName = $adObjectEntry.ShortCut + $adObjectEntry.ObjectName.Substring($adObjectEntry.ObjectName.IndexOf('-') + 1) 
      $TempString = $adObjectEntry.ObjectName.Split('-')
      $adObjectEntry.GroupName = $TempString[0] + '-' + $DisplayName
      $NewFullName = $Institut + "GGX-" + $DisplayName 
      #Write-Host "--##++ So sollte der Name lauten: "  $adObjectEntry.OldName

      # ===== This single check REPLACES the entire 1000-branch if/elseif cascade =====
      # Original behaviour: known prefix -> continue processing; unknown -> 'continue'.
      # BUGFIX 2026-07-02: re-enabled. Note: the original cascade's FIRST branch is
      #   if ($OldName.StartsWith($SPKID + "GUX")) { }   <- empty body, NO 'continue'
      # i.e. GUX entries fall through and ARE processed. The explicit check below
      # preserves that regardless of whether $SPKID + "GUX" is listed in the prefix CSV.
      if (-not ($adObjectEntry.OldName.StartsWith($SPKID + "GUX")) -and
        -not (testKnownPrefixes $adObjectEntry.OldName $prefixMatcher))
      {
        continue 
      }
      #R125GGX-Energieberater
      $roleType = getRoleType $adObjectEntry $roletypeTag
      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
      # Soll raus $Institut + ";" + $roleType + ";" + $adObjectEntry.OldName + ";" + $NewFullName + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" + ";" + "" | out-file $DAWGruppenverwaltungNeuOutFilePath  -Encoding "utf8NoBom" -Append             
      if ($NewFullName.Contains("R_LM_"))
      { 
        $PN = ($ProfilNummerLM).ToString()
        $ProfilNummerLM++
        $NewFullName = $NewFullName.Replace("AR_LM_","LM_")
      }
      else
      {
        $PN = ($ProfilNummer + $iSonstiges).ToString()
        $iSonstiges++
      }
      #Write-Host $PN
      #Write-Host $NewFullName

      $NewFullName1 = $NewFullName.Replace($SPKID + "GGX-S_", $SPKID + "GGX-SE_")

      Write-Host $NewFullName1

      # $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR" | Out-File $KURSSollProfileOutFilePath  -Encoding "utf8NoBom" -Append
      $KURSSollProfileOutLine = $PN + ";" + $NewFullName1.Replace($SPKID + "GGX-", "") + ";" + "Anwenderrolle " + $NewFullName1 + ";" + $StelleVerant + ";" + $adObjectEntry.OldName + ";" + $item.'GUIADGroup.Description' + ";AR"
      $KURSSollProfileOutList.Add($KURSSollProfileOutLine)
      $userMemberShips = @(getAllUserMemberships $adObjectEntry)

      if(1 -lt 2)
      {
        foreach ($userMemberShip in $userMemberShips)
        {
          # Fehler
          #$Institut + ";" + "Role" + ";" + $adObjectEntry.GUIADGroupName + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | out-file $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append     
          # $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName | Out-File $DAWGruppenverwaltungOutFilePath  -Encoding "utf8NoBom" -Append 
          $DAWGruppenverwaltungOutLine = $Institut + ";" + "Role" + ";" + $NewFullName1 + ";" + "" + ";" + "" + ";" + $SPK.'RootDomainName' + "\" + $userMemberShip.MemberName + ";" + "" + ";" + "" + ";" + $userMemberShip.Origin + ";" + $userMemberShip.OriginName
          $DAWGruppenverwaltungOutList.Add($DAWGruppenverwaltungOutLine)
          #Write-Host "TypeTagSecurity: " $userMemberShip.MemberClass
          #$userMemberShip | Out-String


          $persnr = "0000000000"

          if ($userMemberShip.Origin -ieq "user")
          {
            try
            {
              $persnr = $mitarbeiter_array.Item($userMemberShip.MemberName)
              $dum = $mitarbeiter_array.Item($userMemberShip.MemberName)
              if (-not $dum)
              {
                $dum = $userMemberShip.MemberName
              }
              $persnr = $dum
            }
            catch
            {
              Write-Host "User nicht gefunden: " $u.MemberName
              writeExceptionInfo $_ -Rethrow
            }

            # Kurs Daten schreiben
            # $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW" | Out-File $KURSIstMitarbeiterProfileOutFilePath  -Encoding "utf8NoBom" -Append
            $KURSIstMitarbeiterProfileOutLine = $persnr + ";" + $adObjectEntry.OldName + ";" + $PN + ";" + "AW"
            $KURSIstMitarbeiterProfileOutList.Add($KURSIstMitarbeiterProfileOutLine)
          }
        }
      }

    }
  }


  # ===== Post-processing of output collections (2026-07-05) =====================
  # 1) All collections are sorted ONCE before writing (deterministic, culture-
  #    independent ordinal order). Inline writes stay unsorted and cheap.
  # 2) The 'Neu' Gruppenverwaltung variant is no longer produced along the way;
  #    it is DERIVED from the sorted Out list: rows assigning an account to a
  #    target group (Accounts.Add non-empty) are grouped by GUIADGroup.LDAP.
  #    The first row of each group keeps all columns; subsequent rows carry only
  #    the Accounts.Add column. Rows without an account assignment (e.g. group
  #    creation rows) pass through unchanged.
  $ordinalComparer = [System.StringComparer]::Ordinal
  $DAWGruppenAnlegenOutList.Sort($ordinalComparer)
  $DAWGruppenverwaltungOutList.Sort($ordinalComparer)
  $KURSSollProfileOutList.Sort($ordinalComparer)
  $KURSIstMitarbeiterProfileOutList.Sort($ordinalComparer)

  $DAWGruppenverwaltungNeuOutList.Clear()
  $lastLdap = $null
  foreach ($outLine in $DAWGruppenverwaltungOutList)
  {
    $cols = $outLine.Split(";")
    if ([string]::IsNullOrEmpty($cols[5]))
    {
      # no account assignment -> pass through unchanged
      $DAWGruppenverwaltungNeuOutList.Add($outLine)
      $lastLdap = $null
      continue
    }
    if ($cols[2] -cne $lastLdap)
    {
      # first row of a GUIADGroup.LDAP block -> all columns
      $DAWGruppenverwaltungNeuOutList.Add($outLine)
      $lastLdap = $cols[2]
    }
    else
    {
      # subsequent row of the same block -> only GUIADGroup.Accounts.Add.LDAPs
      $DAWGruppenverwaltungNeuOutList.Add(";;;;;" + $cols[5] + ";;;;")
    }
  }

  $DAWGruppenAnlegenOutList | Out-File $DAWGruppenAnlegenOutFilePath -Encoding "utf8NoBom" -Append
  $DAWGruppenverwaltungOutList | Out-File $DAWGruppenverwaltungOutFilePath -Encoding "utf8NoBom" -Append
  $DAWGruppenverwaltungNeuOutList | Out-File $DAWGruppenverwaltungNeuOutFilePath -Encoding "utf8NoBom" -Append
  $KURSSollProfileOutList | Out-File $KURSSollProfileOutFilePath -Encoding "utf8NoBom" -Append
  $KURSIstMitarbeiterProfileOutList | Out-File $KURSIstMitarbeiterProfileOutFilePath -Encoding "utf8NoBom" -Append
  $DAWGruppenAnlegenOutList.Clear()
  $DAWGruppenverwaltungOutList.Clear()
  $DAWGruppenverwaltungNeuOutList.Clear()
  $KURSSollProfileOutList.Clear()
  $KURSIstMitarbeiterProfileOutList.Clear()
  $end = Get-Date
  outLog "finished: " $MyInvocation.MyCommand " on type " $roletypeTag.PadRight(30, " ") ", used " ($end - $begin)
}