The latest version of ovaldi (5.10.1.7) creates an item with an empty trustee_name when the following object is collected:
<sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:nist.validation.winSid:obj:1" version="1">
<behaviors include_group="true" resolve_group="true"/>
<trustee_name operation="equals">Administrators</trustee_name>
</sid_object>
Here is the excerpt from the SC:
<sid_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="2">
<trustee_name/>
<trustee_sid>S-1-5-32</trustee_sid>
<trustee_domain>BUILTIN</trustee_domain>
</sid_item>
Fyi, I haven't been able to reproduce this with ovaldi built from tag Version5_10_1_B7. On my laptop, I get 9 items, which all seem correctly formed.
I am using the same build (5.10.1 Build: 7), but I'll see if it happens on other W7 systems. Thanks. _Dragos.