Hello all.

Many moons ago, I posted a request for help with this same type of
issue:

http://groups.google.com/group/micro...91e865aeb0bfe6

As always, I received excellent help on my previous post. Now I'm back
again with the same type of issue. I need to (do a complex) search and
replace text in a file.

I have a text file (it's the output of the Resource kit utility
secedit.exe) that looks something like this:

SeCreatePagefilePrivilege = *S-1-5-32-523
SeDebugPrivilege = *S-1-5-32-523
SeRemoteShutdownPrivilege = *S-1-5-32-523,*S-1-5-32-528
SeAuditPrivilege = *S-1-5-13,*S-1-5-19
SeIncreaseQuotaPrivilege =
SeIncreaseBasePriorityPrivilege = *S-1-5-32-523
SeLoadDriverPrivilege = *S-1-5-32-523
SeBatchLogonRight =
*S-1-5-19,*S-1-5-21-2113617034-347475637-2087665911-40777,SUPPORT_366945a0,IUSR_W815-
WEB228-A,IWAM_W815-WEB228-A,IIS_WPG,ASPNET
SeServiceLogonRight =
*S-1-5-20,*S-1-5-21-2113617034-347475637-2087665911-123821,ASPNET,*S-1-5-21-2250643452-2129950081-2393833302-1007,*S-1-5-21-2250643452-2129950081-2393833302-1009
SeInteractiveLogonRight = IUSR_W815-WEB228-
A,*S-1-5-32-523,*S-1-5-32-547,*S-1-5-32-530
SeSecurityPrivilege = *S-1-5-32-523
SeAssignPrimaryTokenPrivilege =
SeRestorePrivilege = *S-1-5-32-523,*S-1-5-32-528,*S-1-5-32-529

What I want to do is the following:

- find each SID in this text file
- turn that SID into a variable
- process that variable in a script that will resolve the SID to an
account name
- replace the SID in the original text file with that account name

I've got the script that will resolve the SID to an account name:



strSID = "S-1-5-32-523"
strComputer = "W815-WEB228-A"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root
\cimv2")
Set objAccount = objWMIService.Get("Win32_SID.SID='" & strSID & "'")
strResolvedSID = objAccount.AccountName
MsgBox strResolvedSID
Set objWMIService = nothing
Set objAccount = nothing

I just need the file parsing done to extract the SIDs.

Any help would be greatly appreciated. Thanks!

- Dave

On Jul 18, 10:28*am, "ekkehard.horner" <ekkehard.hor...@xxxxxx>
wrote:

> Highlander schrieb:
>
>
>
>
>

> > Hello all.

>

> > Many moons ago, I posted a request for help with this same type of
> > issue:

>

> >http://groups.google.com/group/micro...ng.vbscript/br...

>

> > As always, I received excellent help on my previous post. Now I'm back
> > again with the same type of issue. I need to (do a complex) search and
> > replace text in a file.

>

> > I have a text file (it's the output of the Resource kit utility
> > secedit.exe) that looks something like this:

>

> > SeCreatePagefilePrivilege = *S-1-5-32-523
> > SeDebugPrivilege = *S-1-5-32-523
> > SeRemoteShutdownPrivilege = *S-1-5-32-523,*S-1-5-32-528
> > SeAuditPrivilege = *S-1-5-13,*S-1-5-19
> > SeIncreaseQuotaPrivilege =
> > SeIncreaseBasePriorityPrivilege = *S-1-5-32-523
> > SeLoadDriverPrivilege = *S-1-5-32-523
> > SeBatchLogonRight =
> > *S-1-5-19,*S-1-5-21-2113617034-347475637-2087665911-40777,SUPPORT_366945a0,*IUSR_W815-
> > WEB228-A,IWAM_W815-WEB228-A,IIS_WPG,ASPNET
> > SeServiceLogonRight =
> > *S-1-5-20,*S-1-5-21-2113617034-347475637-2087665911-123821,ASPNET,*S-1-5-21*-2250643452-2129950081-2393833302-1007,*S-1-5-21-2250643452-2129950081-2393*833302-1009
> > SeInteractiveLogonRight = IUSR_W815-WEB228-
> > A,*S-1-5-32-523,*S-1-5-32-547,*S-1-5-32-530
> > SeSecurityPrivilege = *S-1-5-32-523
> > SeAssignPrimaryTokenPrivilege =
> > SeRestorePrivilege = *S-1-5-32-523,*S-1-5-32-528,*S-1-5-32-529

>

> > *What I want to do is the following:

>

> > - find each SID in this text file
> > - turn that SID into a variable
> > - process that variable in a script that will resolve the SID to an
> > account name
> > - replace the SID in the original text file with that account name

>

> > I've got the script that will resolve the SID to an account name:

>

> > strSID = "S-1-5-32-523"
> > strComputer = "W815-WEB228-A"
> > Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root
> > \cimv2")
> > Set objAccount = objWMIService.Get("Win32_SID.SID='" & strSID & "'")
> > strResolvedSID = objAccount.AccountName
> > MsgBox strResolvedSID
> > Set objWMIService = nothing
> > Set objAccount = nothing

>

> > I just need the file parsing done to extract the SIDs.

>

> > Any help would be greatly appreciated. Thanks!

>

> > - Dave

>
> Assuming that "*S" starts a SID and that resolving is a costly process
> that should be done only once for each SID:
>
> * *Dim oFS * * : Set oFS * * = CreateObject( "Scripting.FileSystemObject" )
> * *Dim sFSpec *: sFSpec * * *= ".\sids.txt"
> * *Dim oRE * * : Set oRE * * = New RegExp
> * *oRE.Global *= True
> * *oRE.Pattern = "\*S(-\d+)+"
> * *Dim sAll * *: sAll * * * *= oFS.OpenTextFile( sFSpec).ReadAll
> * *Dim dicSids : Set dicSids = CreateObject( "Scripting.Dictionary")
> * *Dim oMTS * *: Set oMTS * *= oRE.Execute( sAll )
> * *WScript.Echo oMTS.Count, "SIDs *found."
> * *Dim oMT
> * *For Each oMT In oMTS
> * * * *WScript.Echo oMT.Value
> * * * *dicSids( oMT.Value ) = dicSids( oMT.Value ) + 1
> * *Next
> * *WScript.Echo dicSids.Count, "unique SIDs *found."
> * *Dim sSID
> * *For Each sSID In dicSids.Keys
> * * * *WScript.Echo sSID, dicSids( sSID )
> * *Next- Hide quoted text -
>
> - Show quoted text -

Thanks ekkehard - that worked great!

Question abourt this line:
oRE.Pattern = "\*S(-\d+)+"

Can you explain the details on how this pattern works in it's search?

Thanks again!

- Dave

Highlander schrieb:

> On Jul 18, 10:28 am, "ekkehard.horner" <ekkehard.hor...@xxxxxx>
> wrote:

>> Highlander schrieb:

[...]
[Sample Data]

>>> SeCreatePagefilePrivilege = *S-1-5-32-523
>>> SeDebugPrivilege = *S-1-5-32-523
>>> SeRemoteShutdownPrivilege = *S-1-5-32-523,*S-1-5-32-528

[...]

>> Assuming that "*S" starts a SID and that resolving is a costly process
>> that should be done only once for each SID:

[...]

> oRE.Pattern = "\*S(-\d+)+"
> Can you explain the details on how this pattern works in it's search?

The pattern matches:

\* a literal * (must be escaped, because * has a meaning in RegExp patterns)
S a literal S
( start of group
- literal -
\d digit
+ one or more (digit)
) end of group
+ one or more (occurence(s) of the group)

So "*S-1-5-32-523" will be found because it starts with "*S" and
after that contains 4 sequences of "-" followed by digits

On Jul 22, 1:24*pm, "ekkehard.horner" <ekkehard.hor...@xxxxxx>
wrote:

> Highlander schrieb:> On Jul 18, 10:28 am, "ekkehard.horner" <ekkehard.hor....@xxxxxx>

> > wrote:

> >> Highlander schrieb:

>
> [...]
> [Sample Data]
>

> >>> SeCreatePagefilePrivilege = *S-1-5-32-523
> >>> SeDebugPrivilege = *S-1-5-32-523
> >>> SeRemoteShutdownPrivilege = *S-1-5-32-523,*S-1-5-32-528

> [...]

> >> Assuming that "*S" starts a SID and that resolving is a costly process
> >> that should be done only once for each SID:

> [...]

> > oRE.Pattern = "\*S(-\d+)+"
> > Can you explain the details on how this pattern works in it's search?

>
> The pattern matches:
>
> * *\* * *a literal * (must be escaped, because * has a meaning inRegExp patterns)
> * *S * * a literal S
> * *( * * start of group
> * * - * *literal -
> * * \d * digit
> * * + * *one or more (digit)
> * *) * * end of group
> * *+ * * one or more (occurence(s) of the group)
>
> So "*S-1-5-32-523" will be found because it starts with "*S" and
> after that contains 4 sequences of "-" followed by digits

Ekkehard - I appreciate the RegEx explanation.

Thanks again for your help! Dankeschön!

- Dave