Private/Resolve-LowPrivPrincipal.ps1

function Test-EscLowPrivPrincipal {
    <#
    .SYNOPSIS
        Returns $true when a SID represents a broad / low-privileged principal.
    .DESCRIPTION
        Pure function (no external calls). Evaluates a SID string against the set
        of well-known broad principals that should generally NOT hold enrollment,
        write or CA-management rights on AD CS objects:
          - Everyone S-1-1-0
          - Authenticated Users S-1-5-11
          - BUILTIN\Users S-1-5-32-545
          - Domain Users <domain>-513 (domain-relative RID)
          - Domain Computers <domain>-515 (domain-relative RID)
        A caller may pass additional SIDs (e.g. a custom broad group discovered in
        the environment) via -ExtraLowPrivSid.
    .PARAMETER Sid
        The SID string to test (e.g. 'S-1-5-21-...-513').
    .PARAMETER ExtraLowPrivSid
        Optional array of extra SID strings to treat as low-privileged.
    .OUTPUTS
        System.Boolean
    .EXAMPLE
        Test-EscLowPrivPrincipal -Sid 'S-1-5-11' # -> $true
    #>

    [CmdletBinding()]
    [OutputType([bool])]
    param(
        [Parameter(Mandatory = $true)]
        [AllowNull()]
        [AllowEmptyString()]
        [string] $Sid,

        [Parameter(Mandatory = $false)]
        [string[]] $ExtraLowPrivSid = @()
    )

    if ([string]::IsNullOrWhiteSpace($Sid)) {
        return $false
    }

    $normalized = $Sid.Trim().ToUpperInvariant()

    $fixed = @(
        'S-1-1-0',
        'S-1-5-11',
        'S-1-5-32-545'
    )
    if ($fixed -contains $normalized) {
        return $true
    }

    if ($normalized -match '^S-1-5-21-\d+-\d+-\d+-(513|515)$') {
        return $true
    }

    foreach ($extra in $ExtraLowPrivSid) {
        if (-not [string]::IsNullOrWhiteSpace($extra)) {
            if ($extra.Trim().ToUpperInvariant() -eq $normalized) {
                return $true
            }
        }
    }

    return $false
}