{
  "_comment": "Reviewed data: for each gMSA and dMSA, the principals allowed to retrieve its managed password (PrincipalsAllowedToRetrieveManagedPassword, which sets msDS-GroupMSAMembership), as distinguished names. Change it in a reviewed pull request; the run records this file's SHA-256. Learn recommends a security group of the hosts that run the service.",
  "accounts": {
    "dmsa-hrsync$": ["CN=HR01,OU=Servers,DC=corp,DC=contoso,DC=example"],
    "gmsa-web$": ["CN=WEB01,OU=Servers,DC=corp,DC=contoso,DC=example", "CN=WEB02,OU=Servers,DC=corp,DC=contoso,DC=example", "CN=WEB03,OU=Servers,DC=corp,DC=contoso,DC=example"],
    "gmsa-ops$": ["CN=OPS01,OU=Servers,DC=corp,DC=contoso,DC=example"],
    "gmsa-intranet$": ["CN=GG-gMSA-Intranet-Hosts,OU=Groups,DC=corp,DC=contoso,DC=example"],
    "gmsa-print$": ["CN=PRINT01,OU=Servers,DC=corp,DC=contoso,DC=example"]
  }
}
