Exclude account or accounts from fixlet relevance

Content Authoring
1

I need to exclude one or more accounts from the following relevance in a fixlet associated with the PCI 2016 compliance checklist. It’s a local account. I tried adding it after “NT AUTHORITY\NETWORK SERVICE” but that didn’t work. Any help would be greatly appreciated.

not exists 1 whose(exists(concatenation ", " of(it as string)of(exist privileges whose(it as lowercase =(it as lowercase)of “secreatetokenprivilege”)of it =(it != 0)of 0)of(security accounts(names of local users); local groups; security accounts(“Everyone”; “LOCAL”; “CREATOR OWNER”; “CREATOR GROUP”; “CREATOR OWNER SERVER”; “CREATOR GROUP SERVER”; “NT Pseudo Domain\NT Pseudo Domain”; “NT AUTHORITY\DIALUP”; “NT AUTHORITY\NETWORK”; “NT AUTHORITY\BATCH”; “NT AUTHORITY\INTERACTIVE”; “NT AUTHORITY\SERVICE”; “NT AUTHORITY\ANONYMOUS LOGON”; “NT AUTHORITY\PROXY”; “NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS”; “NT AUTHORITY\SELF”; “NT AUTHORITY\Authenticated Users”; “NT AUTHORITY\RESTRICTED”; “NT AUTHORITY\TERMINAL SERVER USER”; “NT AUTHORITY\REMOTE INTERACTIVE LOGON”; “NT AUTHORITY\SYSTEM”; “NT AUTHORITY\LOCAL SERVICE”; “NT AUTHORITY\NETWORK SERVICE”))whose(True))whose(number of substrings separated by ", " whose(it is not “”)of it > 0 and number of substrings separated by ", " whose(it is not “”)whose(it as boolean is False)of it = 0))

2

I believe I figured it out. I added an account name in parentheses after names of local users and the non-compliant servers dropped off the repot. (security accounts(names of local users(added account name here))

The next question is, how would I add more than one account name? Just separate them with a comma?

3

Semicolon separates plural objects ;