/// <summary> /// Process record. /// </summary> protected override void ProcessRecord() { IEnumerable <Sid> sids; switch (ParameterSetName) { case "sddl": sids = Sddl.Select(s => new Sid(s)); break; case "name": sids = Name.Select(s => NtSecurity.LookupAccountName(s)); break; case "service": sids = ServiceName.Select(s => NtSecurity.GetServiceSid(s)); break; case "il": sids = IntegrityLevel.Select(s => NtSecurity.GetIntegritySid(s)); break; case "il_raw": sids = IntegrityLevelRaw.Select(s => NtSecurity.GetIntegritySidRaw(s)); break; case "package": sids = PackageName.Select(s => TokenUtils.DerivePackageSidFromName(s)); if (RestrictedPackageName != null) { sids = sids.Select(s => TokenUtils.DeriveRestrictedPackageSidFromSid(s, RestrictedPackageName)); } if (AsCapability) { sids = sids.Select(s => NtSecurity.PackageSidToCapability(s)); } break; case "known": sids = KnownSid.Select(s => KnownSids.GetKnownSid(s)); break; case "token": using (NtToken token = NtToken.OpenProcessToken()) { Sid temp = null; if (PrimaryGroup) { temp = token.PrimaryGroup; } else if (Owner) { temp = token.Owner; } else if (LogonGroup) { temp = token.LogonSid.Sid; } else if (AppContainer) { temp = token.AppContainerSid; } else if (Label) { temp = token.IntegrityLevelSid.Sid; } else { temp = token.User.Sid; } sids = new[] { temp }; } break; case "cap": sids = CapabilityName.Select(s => CapabilityGroup ? NtSecurity.GetCapabilityGroupSid(s) : NtSecurity.GetCapabilitySid(s)); break; case "sid": sids = new[] { new Sid(SecurityAuthority, RelativeIdentifier ?? new uint[0]) }; break; case "rawsa": sids = new[] { new Sid(new SidIdentifierAuthority(SecurityAuthorityByte), RelativeIdentifier) }; break; case "logon": sids = new[] { NtSecurity.GetLogonSessionSid() }; break; case "trust": sids = new[] { NtSecurity.GetTrustLevelSid(TrustType, TrustLevel) }; break; case "ace": sids = AccessControlEntry.Select(a => a.Sid); break; case "relsid": sids = new[] { Sibling?BaseSid.CreateSibling(RelativeIdentifier) : BaseSid.CreateRelative(RelativeIdentifier) }; break; case "bytes": sids = new[] { new Sid(Byte) }; break; default: throw new ArgumentException("No SID type specified"); } if (AsSddl) { WriteObject(sids.Select(s => s.ToString()), true); } else if (AsName) { WriteObject(sids.Select(s => s.Name), true); } else { WriteObject(sids, true); } }