Regular expression to remove SIDs from list

Question

Hey everyone so I have a script and in it I try to find the current user, as well as the last user. Currently I'm using a regular expression to throw the System account SIDs and other things like that out of the list. However this doesn't seem to be taking
SQL SIDs out of my list ie. ReportServer$LOCAL with the SID S-1-5-80-4264962431-3932693095-1576469926-235475122-2208986020
What's the best way to get only user SIDs?
Here's what I have so far:
$Win32User = Get-WmiObject -Class Win32_UserProfile -ComputerName $Computer
$Win32User = $Win32User | Where-Object {($_.SID -notmatch "^S-1-5-\d[18|19|20]$")}
$Win32User = $Win32User | Sort-Object -Property LastUseTime -Descending
$LastUser = $Win32User | Select-Object -First 1
When I can this it breaks since there is no actual user tied to this SID:
$UserSID = New-Object System.Security.Principal.SecurityIdentifier($LastUser.SID)
$User = $UserSID.Translate([System.Security.Principal.NTAccount])
Thanks for any help!!

Answer 1

Start cmd.exe as your domain user and run whoami /user to get your own SID. You will get something like this:
USER INFORMATION
User Name SID
========================= =============================================
DEMOSYSTEM\CustomAccount1 S-1-5-21-3419697060-3810377854-678604692-1000
The last part of the SID, in this case 1000, is called RID. When you create a new user or computer object in your domain, only the RID will be different from your own SID. The RID starts on 1000 and increments as you create new objects.
If you are only interested in user accounts from the same domain as your user, you can use a regex like this, only based on your own SID:
$_.SID -match '^S-1-5-21-3419697060-3810377854-678604692-[\d]{4,10}$'