(imported topic written by Nem0)
Hello all, Can anyone help with this issue?
I have the below relevance query which I have working with SIDs starting and ending with but now I have an issue where I have multiple SIDs but all having a similar name ending with “TestGroup”. Rather than using many many SIDs, I wanted to use the name that ends with “TestGroup” rather than SID ending with “-1234”. I have tried a few ways but it doesnt seam to work for me, probably a very silly mistake. Any assistance would be greatly appreciated.
not exists 1 whose (((item 0 of it = item 1 of it) of (it, set of (if length of it > 0 then it as lowercase else nothing) of (if it contains “*” then parenthesized part 1 of match (regex “*(.+)”) of it else it) of (it as trimmed string) of substrings separated by “,” of “*S-1-5-32-544,*S-1-5domain-1234”)) of set of (if it ends with “-1234” and it starts with “s-1-5” then concatenation of characters (0;1;2;3;4) of it & “domain-1234” else it) of (it as lowercase) of sids of accounts with privilege “SeDenyRemoteInteractiveLogonRight”