From 31b0589e02fce02788e01607ad9b95fa28312fb1 Mon Sep 17 00:00:00 2001
From: Malcolm Stewart <63060860+Malcolm-Stewart@users.noreply.github.com>
Date: Wed, 4 Dec 2024 18:13:17 -0500
Subject: [PATCH] SQLCheck Account Fixes

Fixed SPN lookups with UPN-style account names by converting them all the NT Account-style names.
---
 .../SQLCheck/v15/Server/sqlite3/storage.ide   | Bin 733184 -> 733184 bytes
 SQLCheck/SQLCheck/Collectors.cs               |  76 ++++++++++++------
 SQLCheck/SQLCheck/Properties/AssemblyInfo.cs  |   4 +-
 SQLCheck/SQLCheck/Storage.cs                  |   5 +-
 SQLCheck/SQLCheck/TextReport.cs               |   2 +
 SQLCheck/SQLCheck/Utility.cs                  |  39 +++++++++
 6 files changed, 97 insertions(+), 29 deletions(-)

diff --git a/SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide b/SQLCheck/.vs/SQLCheck/v15/Server/sqlite3/storage.ide
index 8c024cb983992bc7b358819faa8d518c7d60d162..7a0a4a8706ed03df34769c606b0b8f43a63a45c1 100644
GIT binary patch
delta 15497
zcmeHuXFwELw{3S5yT~~y0wN+o1QC%Wk_ANsR1Az{0g*;T1p`f%oV8Gi0+PWn(2f{T
zz(5ck71N+7iaB8x!`-{>n&F%G?tTB>uY0DKwbnlS?6Xg(>Z)ocZdfmFST9$Fd7DO~
z9R<|oX`0h-ANFaOPj5IXY8@fL>|6=vlK5`r#N;Krl9$i{3;-X1pOd^q;6t*Y-~L$s
z_?_g^4}2Qr-8g=6&Y|l9KN$?a;$4St3IGHFLY%`lg<~FzbP2|HOAE%k#HY9x&{rrE
z2SOmUK>YkJje@+DDr8g#({4)8Wg+t!iyP7g*Qk`7WLei8-c%|rm>}h`bdhavp#OUE
z`vs;WIc1DcBV}8erljCI;*g3fD{_NxSje_OSI-6h{;bX6QMRn`ErF1GGiSkBX7>hR
z22CPg?6n|+BR-256JY18%L&XXkBf^l=BJgp)-weehDIH!N4F~U3Kr#79}}vV*|S}8
zMy#74-H0XzVfOIRXx>k@WbeLV?;q7YDkJQ<Oh{^_(cQJ556*pcqSk@4ldulmYg6kG
z;J;nRFiyxfr)cwfCHmbJrAcE6VYf`;7?Y<o)d%ccc*=3BDzSs@xnSdo)r$|F$Stap
z=_;C4{$h{LmmSY-STSy+ZZqcoDP`Z&eZkGH&pxd&)&HuO_Hi59gXO;4P85t~>oL_1
z?^x@$U{AaF-o8(7w06A`Upaf#&ic$RCgt;_tOvbW%8Qq;`f-72;@oZf*7MbrpryjJ
z%*qUd9eQ1{J?e*kuAer1m2IK9HGUd@#-}{{!G+bG3d)AVC$yG)*T1o^FHn>y^}A=a
zW6fZv%X^vJ`$6=2h1FLTj^-IH`|IK8<@XO=%=;7GKJL6}UtMQC%du$eN{6hDXyufO
zE7_NS2v3(Ss~q1{sJ;70yL5qtO_TYeotAvj(V5Ms|7vwwXOa3zY;ULiqeeFW=79tI
z%3i#fnmXwSztr}ocRoqOb%zEsB6hBLYrd`~X#3Ib$Be=0gEmbc51SZPkvWbHrN;d?
zZ^r5Go?mHsLZ;?sHeW^PoZ|G6rY+^ubHrEc*qMfm()NvtMm#o5b@Cj`T{U0+^&Z7e
zhvenC&18Nk;q`pyNwekCm}+Yu@x5bPF-4Ov*4U2^DLjnc5iIKDmcFy(X6oMEBHz|s
zna6iY-OPAdw1LoG*6s7s1rAw@to}G#tm_%kvRth=ahi6H`DyDj%H{LR?!EZI{_UM+
z{_B$c({lC-SKiqux6EK>W4_xmuYO}$_i_~nNo%rx{!ntdUd6gkT_z4T%}>>0=>_iW
zo~2{&HGQ|&-6IMe>sGu!er=nU?eP)afk}K~A#uTde2U`D#p&Lidpip{d!CqADaxJ8
zYzp{dB;8%*U0rWvd~Ty-<#iX)pBtL<eSCs%6AE!R7G<A2Rgs%Cexhxw_vvwyU8{EI
zH^kKMyxncJ#-}oOvHp;G(^q=R({b`-bNL<ijI+~Lb);u@T|Gk&P8+b#&J7Qg@1EMx
zw$l2RRJvkG4@WQW<Z++aLxlU;AP1YQJn==l#clI$8O^vT?KiAy;b5-iIP~<;G<I5?
zz*wNF$(Jc|B5fx_B`;<DSe<)D?$W->>Ti9a!!Il5)t*^Bv%sxUj{N<%h-Dtvjj|VS
z3Qlrfy8q{+j}@2N>#GC)bo$|A@!EubYv^{t+&4v`BlWf>BQ%$I=XrPLJd8Z^Q0aEs
z)!*OFjnJ-}HBekqI)10OUgwd~d8vU{&ofS)2+lUWm9KoWQ<Kv(kLY1Aq^!ux5`-qb
zm~6Kov<1>4Xf&yUjA%86MRY+^v<~A~Zo#eSX^bE3q_-tu#NgZ{^DGH>M&uCZktLyG
zqX4HmRhoeu0yNC;7ANVgL;^j5B-KQ8=;mZgD-lT-Am^xy%qDJLSN_6ByindZOs;Js
z>LqlwyT3l>uL*R!86&zt;wh=fA-d>A<Pe8YrY|7HD+yn^Dj88p$kCsX5yyyWZWl~t
zl{p#4z23<dHWItH4r$5C+3UB2WS*C3EOq{1VYNY{$tbzy$LOmn{jQ^Kh2O(gZt3+)
zIHgw|kZoBk(YE{R`JhF$k9BLMx35yIH=J{U9Iqs%PH9TtT>jf5oAc2d%e1WTR?Ru<
zY~^w3d)(-zQHk;x*ErI$icoT3rlhz^7M}jL{tw&uxl+}$&s&ynZVo#AaUog$O~l+w
zjqbXTv>#c0PHfEg<*lW4<u-?}yDZuBIO6-ulGeXY-i#bxKl=$ejV!Jr>gfb&cpN6)
zkqoOQT<C7(v1(#I|JGBtYRU0xn5}nY_(4LM=_q+xWw~&L@MSU&B)yz$JV*?R7}3^z
z6!JQBQ1+t}nN>q1$cB2_x&3^2yX%U@3&BKh=9afxz88{HYheu<$%D0o9epL|c`dPs
z!7%?$&TAlM3WTZ9X^LdrH>Mq*sTQ5wUdo)tSYt@uZXjj|m>JV)GUVHD%&81nGg7~i
z&}CRylB@8TmPzhvB-9yXDOul0Ok+H$A+IzNS`2Lt`K1x|&(~{onl$;fl&Q|={FqLv
zmNB*XJop%-V;OTE!+I9k+(c;esaP?{rZT1@qkTT9(G0Bz-AU(WLYuK}IT_VVxG^#|
zkms5S6UMz(@<%h_z>w}C9a@Nm4Bv-jUJEgYA@Pp9&_d`bt{rF4<aygqOw@xWz&D%5
z?=RZU5zQq+_+@K-PoFzqmf5;nbHpa|G~G*g!0S3Et&q6O$C$$+LyDlM)hx2Th)`v0
zVUc%=h)L%8EE-LS7g3OZVR#UWCd?Ej@Qbk#s`#lYq2+;*eymM_f7f=h$hXr7IVR6}
zh()^XB^(*j5#-*zkg@tk^739{7UO6nnWIH0OqCI42n()b&}be}G#bH+Dl8`~OW8{|
zlZU~P_}lRd>AjCoV3<Xdr|OwbjI0>4V;|urDZYI|dnG|5QmUS*M9$j}YxE|TWKAa&
zME(x3JAusm4}(!6S&p6qiR76ErY$2pi4-m-)EK(Sq)st0S@K-+KeHkBjuuSLEg%B;
z)@5~&8<mLl<ct!chhHL}wu;;q%Ur>6EhUc7Me)m@A@YeP_Eh8(IsBHGPi7uv){#%f
z2vySKJaa4QdWQL$bi2TmCl7oe;{UlPG5&AvNg|^bvHX3*c(*B@EIZZ)-;i*g<g~pb
zyy?GgaW1?eVo8lLVlumqH=%g=31vSVnSfltT3B9OVO>DEz%P3Ra4SI?O$Lt0V|hNA
zz@35PvZKEq5MelG09e3r;gFvJAjkOk`DtwKro=#JVTG}QDgbVr{%&jm9ZQ1^eNw;&
z6GER7xN8#O@$<mZ2kji-l02RT{t`UC3G8w_&iA(un?@@JCtL|^`~tWrk6ZukM5DO@
z#}T8C{{;J8@E7OVWx!5#pbcD+Xa5X7RH8e8<LGg=Qqdp!=LYS83Rxbn15Raq3!JD9
z9s`%+`P2fZe2(#gVsg6lU-o$5YQV8$<j%lxkjTv@*x5lapBM-;ng<*^Kpp{Wj2%}1
z>R<^l5b{j0<2M=dO<>pH@fC2y4scyJ0&pqQ0rjwyxMYcd3?5Gd{wHwgm(2}CgP=-a
z#GtM8f2Qa(kDGw~;sh=N5iz;V043m<9P;}R2R^hsKnwskGA0oVMrttmJb%cYmL>%A
zk4`8`paRz(dEEr3$_b4dcuB;Ak3LL0c8tk+fj@k>J3kOchHIPwXaXR|SuqCSCM^P#
zLmX@ykL#}nfpF?DkSp{~om%!_#|?${-C)NC6@aA^5_$|A?Kt8@2uiIn2Q<}j1jNCC
zVI0#5eXRn{mgiNhg+RFW*uf_l0q$Pp7QnGFjwTv9;ARax7dW0~@qj7-b<OYse@p`X
z4?|2Ujss{+2uGg)z}ZU2^*;|IgG9KUt$?7=h8q+&3B=;ApE?li7=!)+{_x@YUj#zU
z)*IlMPzB%-aP&uR4>8d{9`F=^c3h7408!|lD`?<EO&0+ivqPs|0A;^Ef!~|J&q8uk
z$5){(o=rH_4<>Li7$GK#_GAc-1H+^?Yw&~)h%p#Cc8sT=FFw6a`q$H|(dSV$@w^p|
z%ad0mmC1|wn$`A?{y&~xwf>uL3h1I4ADC7CeqdH7Ev^e#k!tb$0`mX2juM1PgTqWs
z4kw#%pp&yq1O&+on}x*5H*HKw+}4M2)#;-CH2BbnkfTy+qI6REFfo%|GAkP%hVg0m
zc)+ix;g5F??wjnlF7!h0Qwy(Ex&a!l3L4bY@MM^mmfADR+*c`7%O?|K$q#p_hR$sm
z?~A#h<(SyzzE`XBz^qyK?N{!||1I>G&4b!!;!DI`a#+VkYD`zxsLao}EVP?FYP>oA
z;CRNL`#*~6vrRAWYt<K&KJd0EPvue6$fWT%7n%E<RGrH^X@fiUYNr}azhYnbY@?sw
zx{77n3@t9SUm^s$d&&~@JNl|*E$h#>PWA6ATzJ-YWI?{ow#%dYOG@r7O*yl1%;0{A
zOK;$G&9o~zKc0E6I%(6D!j#F_T1u<$7m9xvz2>)*a%zSK32cu$-R)ABLld`2CT&_Z
z*5V*i#lOec)<3)OLsi1zo9`q47&clg)a*Ol^_WkfQ{8E$db_ddo}`?Pnk}P@fnl{>
zADlGS#&!SpWK2_h<c-Sc&wza0FTH1;7;Ju0FjVqIIw$DO;CQbRd;KR}i)VD}8hYl9
z;X|^OZ4uurTNc>=rpg|j^}cGVAdPR^NcEaS8`K!tYs>=8-QH9^h%u|*edEv}?aoE7
zZj2}y%0|`K8;>h%JD7fap*gvvSiP{fJI-pMwBg)W)9JxKi#YU+aZv;B6jIt%vI2@0
zuXKFHA2oiqMC`$a4lhCdV{>&y<ZitVjbjD<K0~*Dkz-dv>A@*)o;_iI-Dy^&roFz|
zYfAOqRF$S9qH^Deu60RfgHC6!TFNR<E$$Cc7!Y5ddSprF`$;3w-LA^vTk7kH+8s%f
zY8;oQG?_<c@0Sb(cO8)kIC5A2mVe=~>5KThg+ASWzNURH-`U!X<L|V;iLkug>lZAV
zlGMePYklkYlMpSjbK36WbzPsmAXxudvaxmcYNtPq?T90dpNH->uwQSt@n5ymX~W$=
zIh_mDReD0LY^7ohe~-DTf6OfD)QbDoni(PY^f~$qy5zdrJ``H#CLDg2ExmAGcvXtJ
z-&PC$thrm|Y4=|o9`ZUPZT(ildCbH7ie7~K+|N_&ZOgh_4fCvA(sZ`xn-=b47hS4e
zy3?(0Pl}9+Y`{+`^8;69`j?E%?#j?+o$dWyQ;F0}nbyuq*mX^BDENKyif6fg<Lt6G
zktOD?`>a%Jzs9wWb(;5zN!Iuzw%t4Uz9Vo?Wjx>T>D>zr?mHU|<wQ@`t$eTGw`XO9
z-ji0JdQ0usJ`Hw>4@zAPJ=A2%B_G<bk3^0diDv1^*rhzxFZM0z>FJiKh<o+me(fRO
z)bC@)XE&{H9#}s+Cpd3WU%332;sa%|XBH_<`=qsXShu3duGwSt`Pb)v^nZ$#E}WF0
zc>mp%KTnrdHz~_(I^K6V`D5?#1&PltpWJ4%U_+<k;TFFn&%3@RmGK#6>uRoDIX!v5
zr7$~PCvjf*JdU!SBt5X_QfP`5Q)c@EiC0B#E^khIc`6Fq$mL#3IJf$Ca$31*|B&@x
z&Bx}>85gj0_jlEN?CCJ|<4Mu5_;2br@+W<46~47)=NBW1XHTDM3}j?|T*z-$>1(6y
zdgM53p7E1&_f%$CtvK}dMryv+!m!_K2ZBo_=9L^_ua%Y?SzV~-Ct2~}j+5b#@t6d2
z?t39Sk^JQ6wGmT`twZPPcBG%{Y^>n)28@mC*e)nlcounI?#q|I2BelTPDobl%T%~;
zuO_+JWA&7}56YL^XJ$Op{yD8@cFCT-DJd2~UD^4pO5IC71}WJ$$Ak|zEEYRv%ep(*
zonNs(<MHGZ>=D)H*J>jKi@yl=pA9qcq0v5SE&EN_$u8H%r$fm3=z1HIq~@fV3-#vp
zCmvngb?Rh_$bNfkpQFK%x7?E)4ApF!C&?$(xEBTKx7FMb{@Pab%1er~zkB+KiZGpy
z7u}ceZNic~BOe%Wy3N+ZV$K#jd4CO+xzmSl_<dCRLyN6rpq8hu`_T2qS>t*8?XOn{
zc5RIFy<{X%)Ji;b2yb0FQg=VNf70iVF3;-{BJ$?9pAJ14l`6)TQcrQ$qzP=<z=+zE
zT9+ARww(WD(pS?powD>~oh34?or$xFvxzlFGV}yB4-N+_)yox#T~7K?VO&FdnW5*D
zIBJ>Ox@~ZVA$$1BMZ4(|Kgb>9u@c*yZ(cE(W7qCs9^>eD+423kH=_r4`D}Ato;G*q
z!hozGPy2_Gy+^V#=aljl3TsJ*?|vYZwLNw@$1Au`Ayu^R_3_tcZ9mtn@_u-u(yvRb
zRx&lsx&A@KZ)t{)Ed|8J3;H#yVrA)^wAi%N@Zjn;NvFVYf?YJYx9!!Zo~H|K-)$D}
z_mgf(8QFeGan+s9{_(IlySy2uZr1WabXPaM#@?|50(Dh<^JZk(TP%2{L)<v4`D~`(
zvJc-J<>a@O_0Y#0t>!xjI`K0!J^lN-cjnw}wEX$=;LWvR{v9)yFFijaB%|Q)#-8w%
z&+?6|)P^)ZC*F;xjj*ea6kOGGY}Rl$`c@S?GphRZI1yBHMsB|Qq&=JeI)3AfbjJ_X
zVu3%~j>S9D!)$yjE>8_9D%kh%uEcaRdQ{n>t=CjEgg)2LdiH70KHc_*6|=uhca<wO
zRO-8-p<U2S)H)n`9N4?}!0kSh+ZozP&$Gv33JO2ha*C%MZ<CVA@XTNbw?5MGx)t)~
zSkEoTk-!V~OQR|$sddJU?iCPso&L7kwpshTPjbPL9+_~XPu-qdYliQ2iViou=D*S(
z*M8YQ?DjyR*Y$FTue&$Zs+QgxoWZs|)h!-SzVt$kfq-hShyN?@$fq{9r%avnH1>^s
z#2zKli@wX--isV>4%hbkN;t~1V=AKR?pP|EX4?ndIlAG1#$f!ZTXu$rPR1A}xJvV-
z+MV0jpTDKLf9ag_l3UW(mL;fph&#70-h1cS?eRC35gvhG^UW+X1dmM8tu5N^x%kE|
zi<BeB8Edzlv(DtSOrf9ZFMOPSd+Ixjr`r!)z0f<UdhGC(SRpr7<hnm&z1Fupq_O9@
z-f*}W7qS0t+$)2#UV(G+IyP=dmxVVsJI^I2*$RC58nO6i(lSlipFWPluUR2EAKAp7
zESIQw6FEsA`+`;%`tz{PGo}0o*T9=I*AjYiXkXCX`txgjRy(e+D{yyniBEN_I(SIq
zb!5HM^Q$qB_r%AnX<NEQ)L7x;xl^H$N7!;_t}87avk<ErZ5ZAhT{OF{M(&ETZ2kep
zJ-g0jg^V_5qp<Rh>9-^mMnm0$6+<m=8cPj%-tDuyQ*-fK$5Ow^`>e9J=5IZ5cR}~N
zZO`&lb*h)UEe~Db+EknF*{^cb?v%F(dtJh4_4h&7Ww|<ozKgSj213TXZKdhzlLns3
z*Rhwa_u71Gzo$ia)P?h!#lgG%lBF`%^VgW!$?iJuENHVsHzG1Fqh)7Ft<P4KmxDj%
zekTqnrZ!~66nV*|`?Wv5EF)Df7$xF)gH&AA78c@NcDW)+G?(_NL4LQN@RuC%r*)%W
zW;v)i+!_ko@?nX6<Q-#?OKaUCnzkJ$y}vD)qrvukdN(hjk^fHHn8o#(>k}O%$CZS3
zt;pV=+ZnjJr{>}xwL#CE<BX@P>a3EE6Ef6_ep~!7!X?2zu0h+ob>qX4m9y3?xPJYj
zgzVQZn=S0y?v#nVY<m5KPwH-oK^0s9;Vv8R-f6U5(sbHu3pd&V;K~3&!j=^l7U)lI
zEoRD*c6CIKQH@fK0(CE1BSx`Hs=w|^oh~R|pK&Wc?bNwg_sJ@SfjjF)Uy$1m6AM++
zUmSdur90X5>%9j`a$9d(J8Z1oXuQzqLVwmz^4?)$3;h;n`4M6^ojyXQABEfF<K&g2
zgcY4hO8!oqpSEt;epHinP~fts*^ZkAVXqB#a7Gqx4~G<waPOJ<EouCg9HN8B;?pYf
z&CdOGuYB0yS5^l)W(o<vm?zr1;&{cujG<*eI7-LJr(J}H2N_HTkpZONuNLI0Y?53~
zwQia9tM$NJ(&zTq{iG#nPE|E;`&Bi6{?!GU>&CKm<^;67RNkmqb^B-x2Ljj9*(UI~
zVxaMd|F?}pj}uJ|RtlYMPTi}m{#tu9dZm!%<%9RqSWQwtTz0<Oynahu_=&#kqP1>D
zpQktcG+&YtXlkXZF`{bBqAl`1*JCB)HW2B4WqwD@l;)O7zTiIn>K^mN1Fp6iUQQ!R
zw38gtCh?n${rSp-KHJG@s3By-^}(;*?3~XBt_&14N{UpSyt>M*W|AsRyQEyXwlgSx
z@-mOVR_eRg+E<C?dg{k7IjC_|vzN>ixZ5r{HRxxuWR|1+^lMUD(uwn>nw@PumS~ty
zZD6Ol^;G(g$^Ixmr2CihwEZ)~fA(9)H)bv#_IaC=GUJp$Q(!^DS8KzN8$#dJRS5xG
zc2#A6tsNQp`H$USUDgcrx3z{0?6=t%9osxG=d@mj)PfC#&Tp7!*51A1alXmu>Hc@t
z3CY%m9?uTgUwtJTt|-r59k2g;wCZfrYmzs<JM;Nm(h%P4vRUDfW^3z>z?%5kGoRit
z_$D@77+dB(ixJE>t^Ha_>moPP&P{`S^TSO?kFZM(P12uxnk^GloP4Y;)J|xWWk0m^
zl8HT2;LEFr*-s~1Z9VGwa`4)b!eFsAx4q?^mVbUJqnSRk)^x33L5Ja5M+MnGPX3ft
zzEFR6NsHj@ypC^@q4t5rZgS!;cP)AS*&}~eOn`rC=Ev#k!nyrP(oQd%8c5e2@4Fut
zyOqw`7pS=6iD74^XI=c+#fs7$84mEwHT|o5c=Bzf$5xlq$FrQgg+m``E^-vJQu{{V
zn4N1Ns^@&?+v21Ja>7S;9XZ`H@uZCZlTORAu;!kWGsxa#=4ARCa`*x<i$0B%x=2_v
z4l_ve6y_w7b&+7w*<{Q`Vh(*D*>aIsMSn>WJ%kN?Cb_tW(4$w8+j<BcdI4G8L#RRP
zb3Mci`W^C34`CLPt@Z2i8cr#ip!EOw$O~_a8NveVVOPh_`1KNo>#4#0A@_fLX(}wv
zZ3%DN-sr*0F4CYE-hhW2kxP1sxr{HyWNI&A$gnmc+j|LZ@l$huJ=J4y;mPFNUP8e-
z%k&?cpuoaS3&W#?RWar|xM<Ban^4L0WZAG-VS&Ek!c!=RJ~Ps(58m#dG$-Tw2rGuJ
zCE3wO%uzmR_3Mobw<j%OA!>L^)}%x~p)PO$E`lOtkpeMQNMJp5wAPMX+fQhT=x`mu
zVBkpR_7j?n*^5Z)RHmlL-xI{=Mn38%W-t^yNy$s_E0)@3(nXO_6(OjWWn0M&m!M_9
zcCrAEYvag2E)n{Sx&-pcC1NH+J&9BtAWRu&lSuagus=#6;|B<B`aH6JfSB&Kbl0y}
zJlq8kaSV)d^4%0{%L)h-CWPk+TVS#e!3E#aQ00GIAl_T;j9vW8IC^K8QgnP@o<Zik
zA?A_sU2x$~OW|)Mx4$K-NO<YJUD7i!I?6pTf)&a8mz4QHIFa-ees5CZBOyz=CG-D!
z1J6E6^$$mUGwuy9Ch#rSK0pcYRgD4gJ&-cm8vw?<_dLi?@O<_FPX&(ee9%7}-tpku
z(cOT<!14VO@<fP_9OK`>H)HZZFwi)(#0FCUGhruEe9MGDMvw%)g+c!@NCK+3{!C~q
z!sD}nqYuWJ3LIZrA^!sY_|gjbJ&2F*9H-!$F%}5QNf<bOTcMK|aC|3-ym5lh3E=pa
z3+)3F?9RaP^()%hz<+f>qZI<j_k(B;08S<P1QH_HV8p3=KcRsMaC}RS4dj4RS=+;C
zs15>v<20g=2XK6;iCh*q<sS~5nu-0usX=N&OsXyWC9DTF$N)S5j@cm>g|)<)K>lrl
zy$bB;k4bL@jvXWC<Hf-wf?#BrXak@OmJDMePXN0DkB5L=1J@rbl%O$ohMQtGa9sOB
zKsf-{I13QZ;{|ZM0Kg=$?MDcNZ`F~v^EMhL)Xn4Ozy~I9b<mg`{7goR<7d-oDnKx6
z1AqtsD{erhFgV(NfH@?DJ0BB@nlQ4<;DG*6O*;=9eURS)j{62V_2L@&-U)3tfDbM~
z2J}yx4a3Di=72p=fg{FbYIs@WX~TjD)M+yl?6|H60Dj<)Z8HE`5C>-w<JiHh;3jPV
zxPTouBib{-j{azOgoN1CIt_uq3LLRL1f|wKW<tkXAP|lW16fVz%m=tU&%O-e;GVz^
zUIK9EBgbFRuq_V8?4P9BG<OiVGcy1|&>3~{*#`|U32aaUL8(C2yjeK_c02F~$z7V0
zFfwrCcBTX|;lqvT0zR<$xjz2jjDy6OE#NPJ=RanLKfzGbH3}RPLi-)y*Z{c@M1)w}
zpbbFKjvKZOIF1bYS>V(%^#RA^(4IBHPEOzz><Qu+I8q(of|j_$ajKt8;4(1Pm?+vi
zAt4+YgrFVe@tMHEh1)Tn1^8P7b;VQ!PAyF{)M27*92rh6PWyI19&ePm0Z&f2fD8b~
za~IE)h6(mj;JCTaz65|H#*SG4>;Sm{bWF|eDsaHQa0$|dVE%E$D850*@S&9euELOT
z^w>BLfIJJ33c$uG0Q`v#M{WS{2H;*v27H1Js2S1+AGBuxrU1vyjvRkA!&yqf_1A(Z
z=!ENpzwP3>V#ip}2@4bK(4KqBNlf5!z%dEjjM6|ra@(HfZCH#$KoCqCmkfXWpk_rG
z+d}``##1H)(wx9&OyCUQ@ZomwJ4`7C#pSC9j!7Ul17Om)lr{hy81hg6`XmG3X7%s3
z?8%TRbxoE4PF)Xbz>(^V16gBZ++54Rh#Z#;mj#o+4wirs{qZWf9Dp1<TRy=)V?xJJ
zg{446Ek;sIgpbBA5KR*n7Y`QuDi967ssu1NQ4febVFu$9N9Z~6j={GsCztz22Atqm
zL@}Mc5E|o5VlFxW4}d%XhQQqtA#lWrfG%l<fQ>wj^+o_{3&8f}{$?2uM?6u`-xN>)
zz%gK%2f*EdI|JK;X49&HU;_+*OUnV^UdC-QA8;Ok6NCxc0|o(jqM*Ms;5h*Ou@hIo
zH~?1*zMN^x0K$+7URJO}FMup)^v48O;l9-bh8rErYQS8c1En27<7#36tX~Ei6MzHv
zgb4+LXFitS012RRgji5#fu?2{H3=HqWAVp*+Xx1{Pr>33=m3o)#)5hPG$w!r^$=(b
z2nViy3<R%7SONf_K~wEf3qj^M!&p!&fyNoY8DgVh1{g3PmUV#HpfLb;fZ7H$jtF%y
zU@>T%V$`@l@TXyF#G#-AdF_F6PZ<2RrxL{aWL`bAXLB72!GI&=2doDi08Mqs0^I}}
zPcAGGfG*G)T=h$jf~M9S>)(N<Hti<R@YhV-{Q(DB6o3Ik$Nhr+)3(5Y2?lD)P%DB~
zf+LO)wIOI~hPHw>=V`1*Z9kzt8uSv-)RLk02CV`|EU2SFb7u_K9}S6Mz#R_<u1*7j
zmjo=^0r{Y*fT+tsQ&Wz*f#;7SMEyHx-1S&?0y=p9SdY3FG{(dJx&Ppwj^GI4z||wX
z2Dl^%fLEY#%CJ5K@Bs+=W56`PPo4(K{c6BR3EXs8p8-$-O(mQKS_?ER8MlA#cM?8t
zP^Td}IDn>36V$8!6(9&SH6vIb^{;w1Xy|}jus#zswS=hmfad<9j~-|^z-xeOin;}~
zJRGrP1G+&|yBPH#Xhp1qg8CI`YRXZ61x<|@wE$ef@U+7jK`jTG`D^^Y{(L|c3}R4$
z3FHEFK~o*%fwl#WBfxspi$VX|#jrm>dxFN`xJ0P&D}&loyFsr34LNa35&Y`|noVVh
zhV@{854WI>06{GYYJBFz5nw@G0D5BkQqb_>7Ob!QSA8>R>QapL$ML?AS`++Y=mH07
zM5uc~PprTGFMW@van$Jl6f`D?GgJ)t0vb<itjGHyVVDl;G%o|KAPDnMjSvkw;6P0g
z>Y1Q1Aq<Fm4ruC9S`OL~G_@yCdx55w2sJ)d;AxEQD*)?3Lr&as0RD|&g8>7g0~!)Q
z<CP9|C15YF9w_$@XBt3LUp`e}>i|v7ST$&TfTCs$^%c<608u{#O<h+|vtNRNT2nN9
z2Mr%?LCpuzsVPG({V%N!dSXBw&;sCx13-TR(736w90XW^rV;|prY-rG!y3@yT=!oM
zLP6uT918}B{Fgr)G_?t_9&U#JzV@TWzu*#tBbFLK(SK-I|57ku#t3w%1Pvc<X@r04
zK`2hpXF*dV#`<2+)Rd#X4jN-&L4BL2aYj(zo1mMZf7-(d4Vpne1q~l=LHz~<)gkIH
z|MLF<nwlZ37X(2~Icj{?p%Ox^2%3t=MuR#SsIOPlrl7^)hy}F+=!pp}20byLJ7^4u
zBSinz6Z~61`~6FY{G;V*=n%mR0F<j+$i*3iEg7gRV#=Njw%Gt&V`BhblJQ0omjvEx
za?hRwIAQ`70Nl(tdOR(0b}?~Wf9Qg{OqjR{KopPzz<P|0?R9uu502<(jel;54ebDU
zT?hbRus{F?$R&+bL=4zYK(T!|0Nt?)HRg)(%>melHvpUa18{;@1JGwL0R0yM&_4!%
zaSj5|J{5rWIRM;hW&o_;1c1KS+{wVpK28=khy-AVY5<%NHvmq^QUIRKc+Y}<xat^4
z8G!!!0GvEW04A6YK>u0*4r&Gf{R{x;Hwz$vf5+$n1RMAOFvCdz?9d2+r~66(Ubo`N
z^hqMq=Pd?`?s%($@#6s)*A{^NcmgoY1_0U@^0W*2Y?8=awgpcvha=8Q5&(z60${jR
z01S_}+n6Ta^P$}mfZ-MZu$vVCw3`BOU2Fhow+Eo#G61&E2jFzg2Y{VTa{z)BO8{8m
z1;7Mi0T^g50QXBhKo;N&KtE>yCY%Vs4Ymh>{v-hF3jr9X0e}gt17Jc`0Q7eS;KM%6
z9SAnq&o#g)21lH*U;qYO55Pb>0oZUY029gsU;>o@^p5~woE-pMuMhxkm~8-TzXpH_
zgaUA;cA>`8Dhq&t!T=0F5CA)f24IJoykjaHF`?Z6^lt)S;EezrVF6F4z>yEo48Wz^
z44?zH0I=gU0LG~UurWY60FM~}%sd-_Q(XhV9hVHigsK7Pw-0~;iU8PAF#zjJ0GRLr
z04CT7z>Z6K$1*sgy#)Z}PzcSR<l``NIPI5-Fg{YzQc!eG80<WMSmZE(Km5mn^uuA-
zMF9%{Yyf)*SpK7yoN}DGj+1eXFcs7d2d7A`TNpTQgX;@6{||TYh(J48o<pc`9^EE9
z`Pqkl<-}b<96J_VP0SYy+Hf_|hGRml1i<;hMZ+^v4}ktS7kD|C&Eq&{DgfNd$g%xY
zz<dDi9GJ^VG)*8_hPQpEeI8wysG(dsb8We4^#A^kO8@&mD*gZXAC*J{Cj5^|ZE7NC
z2;<sJx3Le4bsPIc>x(2m^@)ql36Q7$S{V1gi=j^O%izqD-Wyh25IS*2HO)Qwa=}o9
M8^>N(q@Dl20R8JNcmMzZ

delta 15898
zcmeHud0b8F`}W?uL3@>wiiji?k_?q7B}!z>>>x!0krI(O>}F9S#gZ{9L*}uAgN&uf
za13$G!!ghEbiCKK?R8E+@B8_@?_cltpYQY8SL?p+=YH<zex@}%YZZUXA^w)b0t;nN
znM}45*q&wMF7LTLXk#b&hMfjp6OELI!l7P~P@<od(sy=BUpb%vv;ghml)gIeQgnk1
zW@#tP6#Ko?vKDW|Ya14CyQuSBp$MuudwZ1*pbOL}-d?2__duL(tgsc<G=x8$gic2V
zQNBqCZ1k$)s9jLS+C7F^SGvapn+4rBy_lg}S!+PQUfyFvgU1)oIwyq5wGqd*;?75u
z$0z7%%ZwJ*e4(pdY}i_Ot)sH_{d8o0@VvbE_;_b+*{U8zN?k>pwiT7`+nk+u<VUAC
z{cgAHjs1+>ZE|(xZDlp#C`U^syFBt})`roywzM3TIjYVTd0OKZ(=0a*%r7kcQtNhL
z>#9}0r+#0RKV+!OijJqo#gF^N_<PBkOu<s+QC!)t+lcw&zxCZaySdFTpG-TcOpg{>
zyexP+MON0Wp2>moq{&yxS8GT8;hI{fX-r7qp9bHTpKd1~zGV2N!RE7WH~#YY&9<&V
zv8{LKw_IVhsrlK*JMRDbcIxqUZhKm#U5IIPE&lUd`$awG2Cv+B=G)vOhaTt5UuDo?
z(BSx9vp*SYPxf3CJG!doqDD^PAthVA3+r}zcwY5=lu@tI2A|sd_+D#rFL$$}WkS$;
zuga@wOVc(Fy(_=`BKh>X!eveGEgkr=tJ@W`2VXswSFCU6)AIIr`H21>6WpDYvpxGP
zG(Y10+P7I)-~R3M!^aKX`_y&VZZlb<U)`Qtc%01$9ys{>--Xe#(kBgvjd_q!=H2Jb
z^F{Rx{&ai(dpC1cRn)Pt!(~&`hDHv5ZP$KCxPdI(?M^qB%#W8k2iR`5URQL!OInMo
z!_VHn`s(x*@k5{EJ1xh>z4i&WTkU)2&kY+J3_9*}c=gI|>Dv;YgwGw+uvcZs_K|P8
z#y@Toab(XD+o8Qz-Zkt{Fy?r7>r3^zk1kyBxqfItab{v^FEicQ1-(DjQORWYbQ?Dq
zJ#gEnN?FoK*8vWFKV8YP*<|6+I>Gq-gwba91Fx5US6*oDH^w1t^9!;6w8k6E0xvZ>
z(!cfs<07wO?W}F{7yXu1r`7)4?@PyZnB4Dm{Qiw2Mpp$LA965b(V`&NJza!Z*(a2K
z308G(-&?k6&6=Aj?Jk}7&AYs1Qos6Qxa#2)kNt&a{VNj;^5*PZ?IaIxqEs3_IyAuk
z$dT-6<reOPX1*)z*D|MF(9@T@f*khcCYW@#9=trnqeu8q)9%B9{oG7-!;8nccGXQ?
zeQw$PfZml~`!y8vTgFcDc%W-Jb=>*G!<#<oc&oJ4JL9-BdwV|*^1l%9u=7dtt~Mo8
zU*^<pt~&O9{ndw|{bKva$~-$4?b#Bl7g2s{e$z4eZx+vrh*GQ>=^6Lv^GF?+6NRn5
z^~|kUGP_j2_hsK5ca~dbUHp1kueGDah?j!xmyfo#!B2(d1*?ta-n;S+CKYtO+9rFF
zz36>#@#fTqBjQe!O!yw;|87Y|e1_PrRnCF1;Dg=|-X@&xH^t_nti@nY*AeBbT`Jap
z4Cs@(rtDaqnEns{TKh6SOZN3;_;>fNwtDjlzLht1Ey!Ls-7etx)5PvaYx~VVK59gZ
zMngxv8F{mBv))g%WHWs8(k+e^mv<1#6^bMe@vM<xBR3THcNCiGe2J3DjI-0HSt+)}
zW^bNmuLzr;ePx=hV$(h`z(Z)O2)!(3c?kU#R@aK}dk7X?47k!21`T9}h6W9ax7E}?
zC6|k$pQ)m$N{JjfU<}j)OaKK?8*l(>06gKC0!|uP4@Yyr6`;)WRzN2}0Ca)IfS-oz
z;Mf!x0Mr5KpT2QIRjD0N;Rr+nbjS)@191QYVR8o20S3fGz7Q}1SONKJpca60nydq`
z9bnVRI|2s*1Az50*mBe_GlakjI|EgKJ|G9W0(Swnh!yw(&j9uW9q>vaham%C>J8Ka
zr#%ySeN8_7kvE4R`R@bntb(E@1RC@OI%^Cd%KU*|;8F$T!@)UJOym*ZQUl1RYs%vw
z8wjL8sEZ@{AYeHJ*2f+h45&6hA&ucLP;3Wh7qf-KfZsG6qHF|k2wVz?yb_%A1_yQi
z0|-(N1VHyn!<kS1rCR<-j=v6SVhfm{kePt9i<rnQ!8xHAF}V#mCoR(`pk=l4<nGnV
zllyAyaZua$g}^z$6wL7-t|>r+U?2>F6i_I53^-fF0LW))>^Wz~0&~FGW6X~L7HI5o
zkVOGYH5{UPf){{uQllee(Wqax2MVdhlfVyybBvhCE5W%eS%CaDxEYR2lY#fu%9G0x
ziPQjcBXG$-d3|unzlw^cP)K7&-UeLiB61H+0R}+c1DxxaJO&5?=cME+nF2(E^ZdXx
z9hd_y`6FKht_et`Hpqjb7OjzJunk-qWAeS=(kdZ80WMWA1N;U!8^D0bAA(EgiC@8A
zfTNStLqz@x{KuR^|8odFK*8~3N(8=uOI=2;i%hnTiCiDtM9qG1OK>)T0WjYYTq>Ug
z-l1A~a!)Crl~dsd1-nS0;e)`XAxVKQ5L{{zdDu_+6My2<HJtuvpA0Vb@NDoLa4ut>
ze`HkTYZMS=X}}I}sfFan!SPck@{=G8h~>%8f=ef+IpDX!r6D1I0?r|&{aoNJIC_-r
z|8ZXb1clVXbSjZ6^#Hj5E(Jv15L}ug<aXdv3(4DobBvkDJAz9mF7lpgj`|r96~myA
z9A<zAgX5>pCm#zUEt`4ZQ^2Kw$kTqxUj!~KL+0m$>*2^mzLEAn+W$lG8x;EL>>vE7
zrT_zEfeLV`MVa8|e&UzG@l%8O*FdBm%?7^<F0C5!FW~CyKV%sd+VC!QIk_P?9Ws%d
zXgC8RH?PKXz#CSxUj%LqE(Ji|99-&Q^0vA>|3hG+!W9Nm7m;@YugOd#@?PN8?fd=Y
za2PnRc1*O72A76_Tm@b|pj6$!|LHJY<B%<6ft+du7K1PQiLd#IZ_t#7sf_lE#gxy2
zw~8y9ad7?-Y!fd5Trg$;Zz-$*j(%f+Cs#XwWqbkJMgZ(QE;i0{`egYj0NaF`)qT?h
zNA_WRfHqUvB{bm3(gB}2YgT*a98mVW-$i-uN!>Or--Xt>Ht+4=VDJC!nUhg(I}({t
zVxXJQGa=bBTRx<**zux{r)ZU+tyAa!<fD(C*lN4drg-5N!B>v*TWT5%km+bS$+UxO
zz9}|XAcSk1j>-8@{Og(dE#h~1mQNg7dGG4(xlfAc<Onyk6uyyS_!7Zi5fLfwUm{p4
zW=D#DE)g2I=STiKhPv8*kzr9XJ*A!yiU1EF3uh5^(ycK#bkgXk$)W$`UWgQ5*$QS#
zjq&qH(LYz{rf3o+=H?16inbHQv$;ZR#j$8{zMW9FiHV*<Pj?K?pCOa~T@`v}dZv<o
zYmB%ZhQdFFf*7z=sH^B1D;_LTc2}&NCYCG}{A)GB6-!!Gdi8YMipE9CdSZuVLSuz|
zmKfDksH^{vi?s=2*8fm=CyIHryp<>(-l+6esFFmz<${%>W3p(!TxeM9a`L~uVYE<o
zNp#H?&Wp`g2<2J>=9P$z?+ZhUd#@CB%Cr2nRj)_i@ryS%zMp?Hp-=6p6G!cTXl<Wg
zCpqQQ$dubX{<i4aW%Apl&wOqEUeV@V;iJRRiu0{oHBj0%Ioqo8>wrgA*7G*aE^gbn
z(aFvcW=*xe6=$0ds{7h<+M5wgH+YOb65?$#W!Jk4>vf9mpRLjCtATZDM&G+y%CDz}
zq$hj`+SvF(*M%yhCvhWfJbdrwhQtLnjsIiB`Dt@*?~gxc-S)Q-$E#I?dL||8NPk-N
z!YA9t&3NC;`u^oxcbW9>alqrdP8XdChfc;`s~mhqYg_r*D4*+j?-n)j-R;x3*23s7
z?|hpzSakH_q=GZ2UcBC1;?b#KZBp@&u~Q6(FL`vmUd}UzyYgA*R}8wTI``h~LXJ=4
z6Q;gp7Z%oD_Dh`;CC67>nb-HWNpjM=EG^qVT#ogww2J&~P`#bD+CxqZY0}%Ee?`q1
zPb=Qpw`zBOS;En)8*jRvJpSdjSLTgHB}V$ScjaCf((c0E*~7YSzth?2ec$Dw`9b-s
zy#_ptcJATade!nquEUf6HviBpd4c2OV|7$-=I`}=>bUx#{-_pqd86g$+LTO?r#`u3
zIQ`FV<4PTBz3Vwuf7_DWp)m%sXea0QI+L6)DukA2+Xscj%<wsTF?fegy~K?(+f3=#
zrA3bx4t6&pdS1xLIZ$YkXLIOU$^BzvdwDPLzdX;!UFY6>#oDR6Tu%=4-Df?_`R$e1
zY@@d4wx3lQZqnJ`rtU1o=Opjz9iok@#MLfNMSD&+j8i_gI2u3o&#rk(-shIBI$B4O
zGP767st>z%EeNb=`=_JU4q<8Am|GF{?_*c3xEURvH{0cFvGe5Tr^W_^R+M?j#!cTL
z2F}UI?BSRdF#h2PpOd|}lsO%a-fOd>;nm-4JiOdyd<f_>wyDbZ<(>N9uYP<U+rq%X
zt%c|P)?0!r4|HfY{ALrIY30)tuibp#%8d{0Zg_g)d4uJFyOe_p^5<IRPChast8mzo
zTlYIIugtgER%5;I(!;Bb-_&=g9h=dstFN2y>+U`M+jjJ+VKe5u%}Kldeivqie!sUS
z*;_v4gp*?<ms;N*9ZcHzFkGkB&NBP2dU83>zJKE~;wKs=38Ul<#ED6Qnf$Yunk3lz
zpK5Pfzc}5wA|Rz>7o$b7*X>NrI=9>!o>6MFX=RUh9X%&lZ*H5i_3snU3tArA>7Vm0
z;+LrvqZ1E06ozDaEH~V<=yPdUuk{aFtgk&|m}OBLmo)K9lF+2l*11#iM&9pIIxTvY
zo!5;5mm^&~2ULEG|7-GJMtO04l0}bXp`P!Y)YLw;at?hRzt=m#)ws~9)T3a^mas$b
z{lvVl`tC!m<bC{Bb-g?MM9tTuo}KKsA+O8!i+%epzCZEXvlY9q9jKagYrNA#u~1x|
zEELK0#cnCsFX$^qqzFCb6UE<BgihMg2d_L7zoZD0<X^<dRH44ox7Hzx!FsFp{KYI#
z`D$@fs&Glawrs@v8bi0OHGN+u&YLYHnob|+<Ny8M)nn&6KGjWXsGRz0>bGRENt%!-
zFA&$J2|n_;;wNcBFNMPVtJoo3aMba`bFaA=|5fRuWo9cEXRK7(Dmt_luciylb?Q3F
zWhUaQugWHhSM9}?8A1z1y^i8A9>dbb*%>(5#jFsEG6Y-2@wMW)48cyJvq$`tfo+e=
zf5>IE#m_61jkTKoB^NDMDeV---^JVClx_;$X5yB4LNl!-7lpWal@jN5SJ65Xg*|(S
zJu-!6iZi{%m`q$x-h_xJGKF@EZkxrwGX-D8^uwa>e8Eo<@~4<JAJ>7}kHxb2f<t}h
zR|@rYm{$|d7`Z`^3_qC=zSG#sKrYtbE;u@QN!zHQE9^2?G|9xiD>q*EX*OOP9uGMk
zTw3vJSmVgc28%nG=-uhIT%7Z};AfHebnWwbEgH7}eDh8{v)HR%zR~NWo&DODot}47
zeD=FARerrV<bdELmmd|E9K`k0O}u$f@WilM9ui9JAKdEtmrc}KowEboeywU1@uJnQ
z#drN?MBbYIP4@9Gza;DWD;)##+E43r+(4`wFC-Q(w$h&<7j+YbdPc399sm45dtIo1
zRh&U*qm!azqHwH1n$qjh2amYp@7FIjEQ#y6>%WWS|FTF*RqISL*VU57yVB;zM!VsH
zT019|#(1t@Z4hk}@!&$@dLt)khK$7xTHNIm5xK!t7LO*qmo+F4@3}85z|P@C`#bL1
zE0Y@!uI2K_1iO0+g%H~-g@+~-WNx~)!`sFBe#E$)cP3kUUCmy-eXM2Ges}wQ9p4tH
z7SDL@b-7~3Ed7*Z;bLIstcb2EMUBQ0bEEHA-5lWBv8C_het9i>jemVWe$cmH=lCrP
zbc*NO+2`3<_y@^ti)s|i@OnP&c#98vt-pmG&YpGHBK}<yW0{qSMU~aiin4{Hmbe<v
zJ9RSU+@mdR?;M`*+OLsvv5m#vxsEGaUdrwI(I7`PYDoBu^X*Fw>v|2oTi)?;AHRo3
zcl~a$%U<v<tax_s$g-LTw+m;|Kesa7*KAJn9or@c1`M~XC~{AWd!F)U$F&Z3+OG_4
zGo$hR#G#9gv)|1A_IKZ#cbwlRKS&4-sQIkRr1oi(CxtXvJo9a4T03iF$MNUvt-frZ
zTC7~Zr+?zB+DSFeslsP<usglk=ic((nT_YZp6g;}`1^aa_`Pw%{q?f9R@%wSzoZL&
z(tdZ4NA#`O=@finm*Kk|VV`asKDvKp%{Ps7rmQ)V8*1x!`=ynM_VwW}YU#R~7!JRF
zZJhApyy3&TJ8Xs)rrx$#d3}~k@)*~r3d`LNzx!_-WLw{FLr%%UhcljOsVYKdwiWVX
zi~~#GM134Se)!y{QzP1c+x6$!n)@CPKmAcQy2sI%E1$3a@FHvc-eF?G;x|`Q=la);
z92aIX>DZhdHQ&!P{c7o)>iwbLw%z(#3oibdIAZ+~>qb=*O+Q+ihjovZ<r=Noy?<w3
z`;CE_sW(fm*81ym&#Hwh(>Djax{^EB`Iu_ig($0o0SVb!5%S?nmp?mq!F`;vT~rh6
zHE%Y~x!inT(%ac)qdtDRW4^OtC%b{cO;anzo_`=4XuE8{ycuCjuC`D9_40hx7^Tm!
zrPFrz6c=^*wB*obxqi*DM&?ibOsp#m0u_$tPPR|BpO~b4zc6D}#-TrSiYDh6l<vKE
zabZO1!0xJ`w+dU&Wf59o?Th>jX4tjLz5S%0&-L_{iw4|UUR-ak_JY=}>jbVpXcwTh
zJ*VFR*{g|H3vO(f=VqF<H!t;I|C)QQoY6O4b8);P>0bY|sUbDD_3mCS|GYV|QIJnT
z_NE<Lb03vGJnFL}DlVx<#imV`(>fgs_!QkF`qATQT}vkQ+*#_JII*{*`C4(Q%k5|O
zH&@zRoe-UG(tC|tXZs3=r|!+|J%0=Cn^VT;sEz8AxAsw)_R(UYM3|>le8oZEL2kF$
zC3C@#v-PIPAFH?5tMLmSKThbnqG<lURZU-CTH|#qS3Gc37*M?Dm@r7LGR4Ed`-Nv}
zwTVA%xzX;gWdn9iFVqfPIdSA?&xNjoeeCw?bUQhu!|xf|{lmU#U$6S?)pBM`w28a?
zZpp%MFQ3?_RUMVyFRjm}EScc9-goELgR({y!LbH0v-f}fG<x8RKlW^{x6UlJ(a|F}
z7Vj@=;n(ic)icvmCuH>f*y?bN_whbvs!xLz_Y37kUS`v0d0c;7W5e1p55@Gvmf3pt
zLnh?dTqv@bynA7T(GPza=Ing?;8$Cj-pH)LBdc78)UtbN^z8WRn||h1e(yRJ{^j5F
z)VpJ`zCEi7hMAU(xRT%Y?f~;>$E;Tun;lEnZEkXP>9Z5B;(l9d@u`#P&F7)ldd-dT
z7AEx{s5<RZcw+j{>sDP2U5gXfPRhuc;_4WEAWJ+xI5VzA*rkjb-QH|lTe>j6cb^_T
zo-SJuX1_B1m+OXeJ_q-id^D%3S3!qwuAg*=UN%S@_QW^n{we>$u(WQACmik>(0url
zi0<hjB^6#;rxXUaeDX}Uw1|jUbJT2ec!R&nn!j&XporWsNR{=nWApM$WwMFCG)sH#
zt~1oUKw;6KV)R*e>#%i8mHN-Np0nTM_h(m|E??$Mlbfg7dz$CgZ9lfIdrFe9L8r#4
zR!c^hZJqeRG~cH4r5(=`lj^RF7&K;mYOHnb9Or<Me*`YF^uH?TMZU>QZL%&&yWyCD
zYr7d9IXrLmSGy0tnC}}s(#3e)qE%D8PMI#7bGw;R*J$9GjRs?GdImiSnH8tR6_a}g
zge>8_TsFU>m->Z5Q*mUO&`^F&{IyJIEjJc7mkD0-72@+U!A?G2JZUDh*3}u0QmNv1
zGhvXJcT&)iUlG@y6uQXki;qqU4)O(JopQlmt`a+!3s&$jx?E^3FBLP&1vj1P*d#C!
zTUFrk*rB=Dw?c4L6t@u5DugzQza7N=6+$z^UmgG5;n1@XUsVWoy?VC#SEsAvH`y;T
zMy~-LYjwsTl6S4EWhw_ob%~0K2ptuv*HAK;+eYku3O7(Q+KTa~1W&~yC$Z#|;8K5v
z%fGujdNz7BXg?lH=5jmH=(NySCkQ(d`r?whLX#TmCO32!15XQf`pwjasQH<PxZt#4
zqj=Rt^h#6O=$lC%4*QDtPYcZz7kh}cD)D;j#(1%(xnQX;NF@Uz#R-)tX+25I=CNU{
zxVKVhsTdO{KCBcR6*s4g=4XWVhVj@OmUh5&&Bee%!CYUar=_PAgkj5{DJGl|n#o<o
zqBBBMC!<;a?zZXbcMFZ_K5Ft<@2HSaJweY^&y9n&1}4&m9USZs4^OFKCcfOGT(f(z
zeuS22y-yiZT%@hvUbk3RUw^8$Y74BGxD8{XmVU_6o)mT5+hIQZt8Mslg?jGfa-YZn
zpglJ_cz$!z$lUX(4^)3CXARy7;PwM<KZeS<Ipn8Na3ifbFaV$<R)EREw{riy5yD*f
z=cOF;+W>L6AJ*5BY3o?Z^b8Hh>R9Sb!yR#mqB!P`kfo>43N5bjM0leR^BxG1#bcif
z%jKefnKE6B`a|d-o+%V&iM8_u7cu;TP#{_!R$7VuE(xWg<z``<*!QSXzu4id&|fYt
zxhQlORhxuvV&)nlK}<NNG!qZ}A#74@M+j2-j#P!tV1F$Eh9XAx4d%D31=>gb2H+%Q
z_95k1jSV*}y&<z7Y43%C?89sz2{QYP^4}Vn{`0i4VadLtBMTH}fkr?dK$5#xbMyt?
zxp_x>9+9QCm)--i>;Q~3^C){m<^-V3fj82~-*MzdVIyvs&xarxHG|9x91BbXxZ_9p
z6d>7LgUr@b|Du|H9Ara{eie>CDv-%`LFOu<J+_zBQ=BpzD5&s<U1y3&r2>P=0UF^X
z@K4mCu#qZAhRiOd&1A^jx}@w3S!!h_WT_|iLzWug13Rg#>N~of1?B*6A#(vzw$%F3
z6O;`hOZq^KJ%erwnH5uRqR}%5?u0W?4wExvmZe-5i-!Bjlyfk4=xLRDqHWQP@j_(W
zfFq7;I&erMXF<-w*fUTTPKQ&DC*=(Yj;&!3J2kQ!<O9{@8>pB8@nu&Ydcp!n2KrQ2
z^&>iFM8F6?SuU^#5h!tFKuS$vb;SsXtwH^=M98$Eycja)3gtD`Y#ghVRcQj61DnQZ
z4E?yFepx>hV2fJ;aS+%VE|td`nM;K`;T+36AO?<Dn2t>0h!d7Au8G<?F&QY|ka0dy
zZv{Q=spm@!X=o<Fr-~VD@enwrBRYLst>O?kV$0~rp;~2qAam(b{}@g=4_Lt-=sDXd
z`@;{*vN64?1swvJlM!{PWVd0Y1Ys*9ATtOS=!obfNBbeOSMq>Eu)$9~H2qOAI!|3$
z3pj<Dx&bF(fH>4PE|A$s`t*T4ero%H5KOrK8R-lVMnricWU0IA!6^$MQkfkVEcFbu
z4P>^AvIk@aN4Xnh21i-1n!a{5xj{8KL4`1-ic3)$XE?j`QZ<=hsBv7W=i73&j6p?e
zWJk!y(R5bKRls+J(s0B=W^ioSMc62DoDTFtS^7|M(p|51qIdzBYn02QqMBY81*8)c
zUqDNhZHAr|u;NNhpsdUR2CR(TJ_0fuNx2SW4%0H=z5@Nv7PIgfIHH^moPf;2$v`*A
zjFf?jsF?F33Ahhg>Xl9!{T%4|ww*Jaaxu!Hx7B`Dqhglj&@_O|q0Hg<Gtr1C8KE({
zJYa4$c>!bwLH#@w#!nseK<Ldi@<&w6pgBwiFpzp>QMIy5tI4Y<v;I7wpjyUE$WjG<
zsFhAP0G%M?r<Om!hCy>Ize8rrC>J0I+9UyEs+HXVSvvI=K$gw{A$-#<RW?b})tpdG
zp`;^@*(p@OAXq^;^t9)haRDl$%*xJH)4zsKDQINLME5z`9mFkrl+DDLtwM-q%`t~*
z8?Xb|@c--miAwVV<v;cQM5TFw@}GKtqSCxT`A@w+QE6VF{HNZZs5CE7{!{Ny>S|t~
z{P+FIf8U?{zrH_FReyiNv!?p&kMpehfi(d~-W}q4t$twTNt-8TruM*6fY&>m-_^Vj
zN7}Qz8&C}J0*&*$%o8XDcrE4yzz4X*>m;xKEZ_$`0a$>Q^aj2FyaeHbp#Dx$50UWx
zh!qY2_;^Em2KWnL1A!NBreT1qCST&+z<G&cdFBt|hgA#!2laQ6;~?<D%f#;>6T#U+
zCh~dUya2NW<RUoBGmQo|ft#w?4_*S!7Beyb3^)T|B3JPqi4Jj4EBIk1Z?c$zfsf#l
z1M(UOon6dCUJsl-z#bxR4o-heVSp1j%hNx37jQO+d<^fCdqcr4reZ8GOk)61y~hx$
zaUgMiXDJ034rPiapXJGOz}Z3$={P`oY+-&Rz#BW>F)&4O{EtB)jd2u|=fHUj!UB_k
zE8v_DIH*5syrtow>aS`ZfJ;3z1v-9b$%i<WC+BySQjbgp=e@Vo<5PK`)TEk0EO<+B
zX^hC-!TDszL_Qc?niJ%sz&XQlQ0I?<z}pn2>A*yA$shSFaH+hC3f}j!09#1D5S+7|
ziQhr4)D&PoIUh|WhuGVa6@#-yILOEkYwS4$3BW0E_8{|9fIlG69{yD750$QK6ws-^
z`g;H_t^2vqeFB#vP6yY9XAT(?xiPr3?8t4vrBy-Br$&7onaF*>e>4F7PeuQq3<AKb
zS1=Bo5i`*~23+bP@_3Cs$DDi~IG-Y!G5~%yDNS1PUEu0v&he+>6cmy}@+xqB9GS@P
zf^(U12*}@nOJke~{uNwWMdV7HAf)rieDKELYybl!=e8Gzg!Ri70Bxb5bM&;DbALmc
zR6Omvfujy}T8zJ*;8K9(yrIWWoyhxuNJBzC3Y-mKB98_~d3F72#jjA{r%p6T_+ju5
z&j4o+F-Ybw0hfkk3HTatwup&*!%z7;f8qz!9QD&73zR~^2-!tT0e&aRb<KP})%~U6
z5M?WXci>VB$@S1(QV)?EfHNTaBj;z4(i~U`ZUe5~C!+xs+*IM1lCJ{znIq~@r#$@S
z&VjTl$oqiT#gX=_fly68MA;f37M!bq`Q#bkQV->WXM?MxE~H`w6jF=Gw}DHOjC?P+
zG=}6S!SPck@-raPnUI{@Q`Px1@aq2FOCNSJLKgS}18Lb6fa@V#DIjtS@ap-^z@-xr
z^V@+-kG$lbKiT&LmnJRq2iL&(OXqqjM#2Cws8b>ShWy0GfpbU*=0}0!r%pxqI~7D)
zcI27hQj5t&aH+@1SF50)GbSq5YB+m@d}B4f5qw)U`%U1x!SPck^4~$E3dxWEWY5Q3
zsfU=aIuC`^rBvMfslYw(>JFcQbJ8)<UK`$|At2|D5KPpGydJpJKypiP`eOsZyU3bW
zE3g?#$Dg>%PrReX0Ze7I-^_1kXSi@!oq#$(dw`?h0dT>@1FVyaiu0H4<w~3>dVCS;
zDqSEN0Q1CvFG8cnogktPnKz&f1OuECApp%X#T8$KR;q3g>2v}>b7qk<0Cs>Iz@SC|
zEIt}wM-2mLBLcMV3DABTKtG&@)HeaBcLq3RIsnY)EeYyst8SqdNJD@Hq5)QD1+bNU
z0k+Z~;3}Ld&ipDgGWLbYIMOugwc=)|oA=kK194<^4FHyI3vdYz1$Z)<CBFMAH0{s}
zBE7@`bdGhTuDlD5?1=#Y-9!Kks=J2w5C?q|TvhHGItWKLG7(_oA_2PNy)@ki035B!
z0QDUKy7K~9&0v6fSAd<|8KB+=pxr=#<re_#BToQ&mHNN7n9)a*F$6~jz}p)-Y6o!e
z*8{wt4g%=F4`9Fv0H<{hK>I}i^A`g2vjJcLVE_YK1JJ%VP=meI4+0D1sue%}=ZGCP
z2B5=n03FQ$Sa2l3faU`XU^PJdD1d%=-^TG83$Wa9fE9-W?4cA5PsfpGJ=u6b0fYi{
z91F0bxte1tjtnFlV1*k2I-UryWmy`Yj3cMvCV)d01IU3X04tsi(9b%6<$0x3QJ4cT
z;tYUYTnKQcB>@a5AE4b5fDRS|tccfU=JT4&fb#$bSOl=*<(ea}xzuk4yrUu_LW5&`
zM#YR8J!*2O*fLC6Q?y+p44|WJd#v;i3(l>}R4;n{eeJ<;zZ&=5KYC^FdilU!`YMa@
l^)<0y{%mwc=7<SHPIgQ7$(Z*l;X?NHiT=f1Tj=lC{$J)Ed^Z39

diff --git a/SQLCheck/SQLCheck/Collectors.cs b/SQLCheck/SQLCheck/Collectors.cs
index f78413b..cb06cc4 100644
--- a/SQLCheck/SQLCheck/Collectors.cs
+++ b/SQLCheck/SQLCheck/Collectors.cs
@@ -2190,6 +2190,7 @@ public static void CollectService(DataSet ds)  // collects select services we ar
             ManagementObjectSearcher searcher = null;
 
             DataRow Computer = ds.Tables["Computer"].Rows[0];
+            DataRow Domain = ds.Tables["Domain"].Rows[0];
             DataRow Service = null;
 
             //
@@ -2229,7 +2230,12 @@ public static void CollectService(DataSet ds)  // collects select services we ar
                                 Service["Description"] = description;
                                 Service["Path"] = mo.GetPropertyValue("PathName").ToString();
                                 Service["ServiceAccount"] = mo.GetPropertyValue("StartName").ToString();
-                                Service["DomainAccount"] = Utility.TranslateServiceAccount(Service["ServiceAccount"].ToString(), Computer["NETBIOSName"].ToString());
+
+                                // better method of converting
+                                // Service["DomainAccount"] = Utility.TranslateServiceAccount(Service["ServiceAccount"].ToString(), Computer["NETBIOSName"].ToString());
+                                string NTAccountName = Utility.NormalizeNTAccount(Service["ServiceAccount"].ToString(), "");
+                                Service["DomainAccount"] = Utility.ConvertLocalAccountToDomainAccount(NTAccountName, Computer.GetString("NETBIOSName"), Domain.GetString("DomainShortName"));
+
                                 string startMode = mo.GetPropertyValue("StartMode").ToString();
                                 Service["StartMode"] = startMode;
                                 bool started = mo.GetPropertyValue("Started").ToBoolean();
@@ -2288,7 +2294,12 @@ public static void CollectService(DataSet ds)  // collects select services we ar
                     Service["Path"] = mo.GetPropertyValue("ExecutablePath").ToString();
                     mo.InvokeMethod("GetOwner", owner);
                     Service["ServiceAccount"] = $@"{owner[1]}\{owner[0]}";
-                    Service["DomainAccount"] = Utility.TranslateServiceAccount(Service["ServiceAccount"].ToString(), Computer["NETBIOSName"].ToString());
+
+                    // better method of converting
+                    // Service["DomainAccount"] = Utility.TranslateServiceAccount(Service["ServiceAccount"].ToString(), Computer["NETBIOSName"].ToString());
+                    string NTAccountName = Utility.NormalizeNTAccount(Service["ServiceAccount"].ToString(), "");
+                    Service["DomainAccount"] = Utility.ConvertLocalAccountToDomainAccount(NTAccountName, Computer.GetString("NETBIOSName"), Domain.GetString("DomainShortName"));
+
                     Service["StartMode"] = "Manual";
                     Service["Started"] = true;  // boolean
                     Service["Status"] = "Running";
@@ -2365,9 +2376,10 @@ public static void CollectSPNAccount(DataSet ds)
 
             foreach (string account in serviceAccounts)
             {
-                // split the account apart
+                // split the account apart - these have all been normalized to domain\account, including UPN and local accounts
                 acct = account;
-                domain = "";
+                domain = SmartString.ChopWord(acct, ref acct, @"\");
+/*
                 if (acct.Contains(@"\"))
                 {
                     domain = SmartString.ChopWord(acct, ref acct, @"\");
@@ -2381,24 +2393,29 @@ public static void CollectSPNAccount(DataSet ds)
                     // domain = Computer["ExpandedName"].ToString();
                     domain = Domain["DomainName"].ToString();
                 }
+*/          
 
                 try
                 {
-                    // treat the account as a user account first
-                    tempAccount = acct;
-                    searcher = new DirectorySearcher(new DirectoryEntry($@"LDAP://{domain}"), $"samAccountName={tempAccount}", new string[] { "AdsPath", "cn" }, SearchScope.Subtree);
+                    // treat the account as a user account first - we are no longer repressing the trailing $ so no need to test both ways
+                    // tempAccount = acct;
+                    // searcher = new DirectorySearcher(new DirectoryEntry($@"LDAP://{domain}"), $"samAccountName={tempAccount}", new string[] { "AdsPath", "cn" }, SearchScope.Subtree);
+                    searcher = new DirectorySearcher(new DirectoryEntry($@"LDAP://{domain}"), $"samAccountName={acct}", new string[] { "AdsPath", "cn" }, SearchScope.Subtree);
                     results = searcher.FindAll();
-                    if (results.Count == 0)  // treat the account as the machine account if user account search fails
-                    {
-                        results = null;
-                        searcher.Dispose();
-                        tempAccount += "$";  // machine accounts have $ suffix for searching
-                        searcher = new DirectorySearcher(new DirectoryEntry($@"LDAP://{domain}"), $"samAccountName={tempAccount}", new string[] { "AdsPath", "cn" }, SearchScope.Subtree);
-                        results = searcher.FindAll();
-                    }
+                    /*
+                                        if (results.Count == 0)  // treat the account as the machine account if user account search fails
+                                        {
+                                            results = null;
+                                            searcher.Dispose();
+                                            tempAccount += "$";  // machine accounts have $ suffix for searching
+                                            searcher = new DirectorySearcher(new DirectoryEntry($@"LDAP://{domain}"), $"samAccountName={tempAccount}", new string[] { "AdsPath", "cn" }, SearchScope.Subtree);
+                                            results = searcher.FindAll();
+                                        }
+                    */
 
                     // if not found log a message and continue around the loop - the foreach won't do anything in that case
-                    if (results.Count == 0) Computer.LogCritical($"No accounts in domain '{domain}' have the samAccountName of '{acct}' or '{acct}$'.");
+                    // if (results.Count == 0) Computer.LogCritical($"No accounts in domain '{domain}' have the samAccountName of '{acct}' or '{acct}$'.");
+                    if (results.Count == 0) Computer.LogCritical($"No accounts in domain '{domain}' have the samAccountName of '{acct}'.");
 
                     // process results
                     foreach (SearchResult result in results)
@@ -2408,8 +2425,12 @@ public static void CollectSPNAccount(DataSet ds)
                             SPNAccount = ds.Tables["SPNAccount"].NewRow();
                             ds.Tables["SPNAccount"].Rows.Add(SPNAccount);
                             entry = result.GetDirectoryEntry();
-                            SPNAccount["Account"] = tempAccount;
-                            SPNAccount["Domain"] = Domain["DomainShortName"].ToString();
+                            // SPNAccount["Account"] = tempAccount;
+                            SPNAccount["Account"] = acct;                                           // split from DomainAccount
+                            // SPNAccount["Domain"] = Domain["DomainShortName"].ToString();
+                            SPNAccount["Domain"] = domain;
+                            // split from DomainAccount
+                            SPNAccount["DomainAccount"] = account;
                             SPNAccount["DistinguishedName"] = entry.Path;
                             UAC = entry.Properties["UserAccountControl"][0].ToInt();
                             SPNAccount["UserAccountControl"] = $"{UAC} (0x{UAC.ToString("X")})";
@@ -2514,7 +2535,7 @@ public static void CollectSPN(DataSet ds, DataRow SPNAccount, string Distinguish
 
             try
             {
-                entry = new DirectoryEntry(DistinguishedName);
+                entry = new DirectoryEntry(DistinguishedName);  // this is the AD "Entry.PAth" for the service account; used to get the account entry, again
                 pvc = entry.Properties["servicePrincipalName"];
                 if (pvc.Count == 0)
                 {
@@ -3237,9 +3258,11 @@ public static void ProcessSQLPathAndSPNs(DataSet ds, DataRow SQLInstance, DataRo
                 if (Computer.GetBoolean("JoinedToDomain") == true)
                 {
                     account = dr.GetString("DomainAccount");
-                    if (account.EndsWith("$")) account = account.Substring(0, account.Length - 1);
+                    // no longer remove trailing $
+                    // if (account.EndsWith("$")) account = account.Substring(0, account.Length - 1);
                     SQLServer["SPNServiceAccount"] = account;
                     SPNServiceAccount = account;
+
                     spnPrefixF = $"MSSQLSvc/{Computer.GetString("FQDN")}";
                     spnPrefixN = $"MSSQLSvc/{Computer.GetString("NETBIOSName")}";
                     // SPNs for TCP/IP
@@ -3269,7 +3292,7 @@ public static void ProcessSQLPathAndSPNs(DataSet ds, DataRow SQLInstance, DataRo
                                 }
                             }
                         }
-                        else  // don't suggest any for individual IP addresses
+                        else  // don't suggest any for individual IP addresses - TODO add this capability for FCI clusters
                         {
                             SQLServer.LogInfo("SQL Server is not listening on all IP addresses. Suggested SPNs not listed.");
                         }
@@ -3315,7 +3338,7 @@ public static void ProcessSQLPathAndSPNs(DataSet ds, DataRow SQLInstance, DataRo
             }
         } // end ProcessSQLPathAndSPNs
 
-        public static void CheckSPN(DataSet ds, DataRow SQLServer, DataRow SuggestedSPN, string SPNName, string accountName)  // check that the SPN is on the SQL account name and no other
+        public static void CheckSPN(DataSet ds, DataRow SQLServer, DataRow SuggestedSPN, string SPNName, string accountName)  // check that the SPN is on the SQL account name and no other; Contoso]sqlprod01$
         {
             DataRow Computer = ds.Tables["Computer"].Rows[0];
             DirectoryEntry dupRoot = null, entry = null;
@@ -3346,7 +3369,7 @@ public static void CheckSPN(DataSet ds, DataRow SQLServer, DataRow SuggestedSPN,
                 {
                     SearchResult result = results[0];
                     entry = result.GetDirectoryEntry();
-                    if (CompareAccounts(entry.Properties["samAccountName"][0].ToString(), accountName) == true)
+                    if (CompareAccounts(entry.Properties["samAccountName"][0].ToString(), accountName) == true)  // samAccountNAme does not include the domain name
                     {
                         SuggestedSPN["Exists"] = true;
                         SuggestedSPN["Message"] = "Okay";
@@ -3416,11 +3439,12 @@ public static bool CompareAccounts(string account1, string account2)
             {
                 domain1 = SmartString.ChopWord(account1, ref account1, @"\");
             }
+/*
             else if (account1.Contains(@"@") == true)
             {
                 account1 = SmartString.ChopWord(account1, ref domain1, @"\");
             }
-
+*/        
             //
             // Split account2 into a domain and account portions
             //
@@ -3429,10 +3453,12 @@ public static bool CompareAccounts(string account1, string account2)
             {
                 domain2 = SmartString.ChopWord(account2, ref account2, @"\");
             }
+/*
             else if (account1.Contains(@"@") == true)
             {
                 account2 = SmartString.ChopWord(account2, ref domain2, @"\");
             }
+*/
 
             //
             // Compare them -  TODO - there might be a better way to match them, maybe their distinguished names???
@@ -3442,7 +3468,7 @@ public static bool CompareAccounts(string account1, string account2)
             if (account1.Equals(account2, StringComparison.CurrentCultureIgnoreCase) && domain1.Equals(domain2, StringComparison.CurrentCultureIgnoreCase)) return true;
 
             // partial match
-            if (account1.Equals(account2, StringComparison.CurrentCultureIgnoreCase) && (domain1 =="" || domain2 == "")) return true;
+            if (account1.Equals(account2, StringComparison.CurrentCultureIgnoreCase) && (domain1 == "" || domain2 == "")) return true;
 
             // no match
             return false;
diff --git a/SQLCheck/SQLCheck/Properties/AssemblyInfo.cs b/SQLCheck/SQLCheck/Properties/AssemblyInfo.cs
index d3e03d2..56a6250 100644
--- a/SQLCheck/SQLCheck/Properties/AssemblyInfo.cs
+++ b/SQLCheck/SQLCheck/Properties/AssemblyInfo.cs
@@ -32,5 +32,5 @@
 // You can specify all the values or you can default the Build and Revision Numbers
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.1439.0")]
-[assembly: AssemblyFileVersion("1.0.1439.0")]
+[assembly: AssemblyVersion("1.0.1482.0")]
+[assembly: AssemblyFileVersion("1.0.1482.0")]
diff --git a/SQLCheck/SQLCheck/Storage.cs b/SQLCheck/SQLCheck/Storage.cs
index c3c0f93..1f242fc 100644
--- a/SQLCheck/SQLCheck/Storage.cs
+++ b/SQLCheck/SQLCheck/Storage.cs
@@ -456,8 +456,9 @@ public static DataSet CreateDataSet(String ComputerName)
             dt.AddColumn("ID", "Integer");
             dt.Columns["ID"].AutoIncrement = true;
             dt.AddColumn("ParentID", "Integer");
-            dt.AddColumn("Account", "String");
-            dt.AddColumn("Domain", "String");
+            dt.AddColumn("Account", "String");         // split from Service!DomainAccount - unique combo in this table - can have trailing $ if machine account or GMSA account
+            dt.AddColumn("Domain", "String");          // split from Service!DomainAccount - unique combo in this table
+            dt.AddColumn("DomainAccount", "String");   // full account name contoso\sqlprod01$
             dt.AddColumn("DistinguishedName", "String");
             dt.AddColumn("AccountType", "String");
             dt.AddColumn("UserAccountControl", "String");
diff --git a/SQLCheck/SQLCheck/TextReport.cs b/SQLCheck/SQLCheck/TextReport.cs
index 786dfd4..9ecf29e 100644
--- a/SQLCheck/SQLCheck/TextReport.cs
+++ b/SQLCheck/SQLCheck/TextReport.cs
@@ -581,6 +581,8 @@ static void ReportService(DataSet ds, TextWriter s)  // outputs computer and dom
 
             s.WriteLine("Services of Interest:");
             s.WriteLine();
+            s.WriteLine(@"Note: UPN account names (SQLSVC@Contoso.com) are converted to NT Account format (Contoso\SQLSVC) for ease of comparison and LDAP queries.");
+            s.WriteLine();
 
             ReportFormatter rf = new ReportFormatter();
             rf.SetColumnNames("Name:L", "Instance:L", "Description:L", "PID:R", "Service Account:L", "Domain Account:L", "Start Mode:L", "Started:L", "Status:L");
diff --git a/SQLCheck/SQLCheck/Utility.cs b/SQLCheck/SQLCheck/Utility.cs
index cb9ae39..52241ef 100644
--- a/SQLCheck/SQLCheck/Utility.cs
+++ b/SQLCheck/SQLCheck/Utility.cs
@@ -8,6 +8,7 @@
 using Microsoft.Win32;
 using System.Diagnostics;
 using System.IO;
+using System.Data;
 
 namespace SQLCheck
 {
@@ -279,6 +280,44 @@ public static string GetExecutableSTDOUT(string exeName, string args)
             return result;
         }
 
+        //
+        // Service Account Name Normalization
+        //
+        // Used to make all account names, including UPN account names, into the NT Account format
+        // Convert local account names into domain account names ("domain\computer$")
+        //
+
+        public static string NormalizeNTAccount(string account, string domain = "")   // unsplit names just go in account and leave domain blank
+        {
+            try
+            {
+                System.Security.Principal.NTAccount nta = new System.Security.Principal.NTAccount(domain, account);
+                System.Security.Principal.SecurityIdentifier si = (System.Security.Principal.SecurityIdentifier)nta.Translate(typeof(System.Security.Principal.SecurityIdentifier));
+                System.Security.Principal.NTAccount ntaFull = (System.Security.Principal.NTAccount)si.Translate(typeof(System.Security.Principal.NTAccount));
+                return $"{ntaFull.Value}";
+            }
+            catch (Exception ex)
+            {
+                if (domain == "") return account;
+                return $@"{domain}\{account}";
+            }
+        }
+
+        public static string ConvertLocalAccountToDomainAccount(string account, string ComputerName, string DomainName)
+        {
+            // string ComputerName = Computer.GetString("NETBIOSName");
+            // string DomainName = Domain.GetString("DomainShortName");
+
+            if (account.StartsWith(@"NT AUTHORITY\", StringComparison.InvariantCultureIgnoreCase) ||     // local built-in accounts             NT AUTHORITY\NETWORK SERVICE
+                account.StartsWith(@"NT SERVICE\", StringComparison.InvariantCultureIgnoreCase) ||       // local virtual service accounts      NT SerVICE\MSSQLSERVICE
+                account.StartsWith($@"{ComputerName}\", StringComparison.InvariantCultureIgnoreCase) ||  // local account                       SQLProd01\Administrator
+                account.Contains(@"\") == false)
+            {
+                return $@"{DomainName}\{ComputerName}$";                                                 // output                              Contoso\SQLProd01$
+            }
+            return account;                                                                              // return domain account names unchanged
+        }
+
         //
         // Reads a file into a string
         //