No `Unique Values` inspector for Users or Security Identifiers

In some cases you may have multiple relevance statements combined that can return user objects or sids (security identifiers), and it is useful to return only the unique set of them to then use in further relevance statements.

Example:

sids of (local users; users of (logged on users;current users) )

Not a very useful real world example, but a simple one.


Ideally, you would be able to get just the unique set of users, or the unique set of user sids from the above result.

But that doesn’t work:

Q: unique values of (local users; users of (logged on users;current users) )
E: The operator "unique values" is not defined.

Neither does this:

Q: unique values of sids of (local users; users of (logged on users;current users) )
E: The operator "unique values" is not defined.

This is an option to work around the lack of inspector:

sids of users whose(user id of it is contained by set of unique values of user ids of ( users of (logged on users;current users) ) )

This should work, but does not:

Q: (sids it) of (unique values of (it as string) of sids of (local users; users of (logged on users;current users) ))
E: The expression could not be evaluated: BAD SID - Revision: %23 SubAuthorityCount: %01 IdentifierAuthority: %00%00%00%00%0ff

( @strawgate has a solution to this particular method below )


CC: @AlanM

In the more general case, I want to be able to get unique values or a unique set of almost everything in relevance.

Still not great but this should work:

(sids it) of unique values of component strings of sids of (local users; users of (logged on users;current users) )

This is caused by sid as string returning domain\username but there is no sid creation method that takes domain\username.

So you have to print the component string (the GUID) so that you can later use sid <string> to turn it back into a SID object

1 Like

The string cast of sid was left when we added a lot more SID handling due to people potentially using it already (like you are here)

So yes there are ways around it and maybe having a creation method for SID that takes a domain\username would help. Also having unique values work on SID or USER directly would help

1 Like