I wish it were that easy. Data extraction and comparison isn't really the hard part. Even after automating that part, what do you do with the results? What's the method of separating into something you can use and operate on in PW Admin? Or are you just stuck fixing every account listed in the results, one at a time? With the automation capabilities of ProjectWise, does it really make any sense to be left having to do this task using a manual, hunt and peck approach? Especially when you are talking about thousands upon thousands of user accounts, I don't think that's a realistic approach.
The SQL query it takes to figure out whether a PW user account is "windows - synchronized" involves 3 tables, not just the user table. The user table has an o_flags column, but all that is currently used for is indicating whether the account is enabled or disabled. Which is too bad, because I think if they did use the field as a bit mask to also indicate that it is a synchronized account, it would make it easier to query.
If we were to start doing some custom SQL to update information about the SID and its mapping in the appropriate PW tables, we'd have to obtain the SID for the account from the domain. That is a whole other process that you can't do *easily* with SQL when you are running Oracle, but I digress. For the sake of the discussion, let's just assume we've gotten past that hurdle.
The problem now is that we run afoul of the "thou shalt not write directly to PW tables" rule for being able to get support from Bentley (not to mention the risk posed to the system and data integrity if something goes wrong or we didn't quite get the relationships exactly right). The only alternative is to build something custom using the SDK. Really shouldn't have to do that since this is functionality Bentley (IMHO) should provide out of the box. What's provided now is fine when no errors are encountered in the process, but it all falls apart quickly when there is one.
As it is now, the way this is currently handled in PW Admin is that when you grab a bunch of user accounts and change them from "windows" to "windows - synchronized", the process does not have robust error handling or reporting. It will throw an error when it tries to process an account that doesn't have a match in the domain, but it doesn't tell you which account threw the error, and then aborts the process. So for example, if you had selected 1000 accounts to change to "windows synchronized", and it ran into a problem on the the 100th account, the first 99 will have been changed, but 100 - 1000 will not have been, because the entire process aborts upon encountering any error, such as did in this scenario at the 100th account. It should at least have an option to not abort the entire process when an account match isn't found, and instead, output at least a log file or something showing where errors were. That would be a huge improvement.
But since that's not the way it works currently, the fun doesn't stop there. You have NO idea which accounts accounts got changed because the only way to see whether the account is "windows" or "windows - synchronized" is to look at the properties of each account individually, because there is no column in PW Admin when looking at users that would show you the difference and at least allow you to sort the list based on that difference.
Long story longer, yes, this issue bugs me. A lot.
Please note that I post here on a voluntary basis and am not a Bentley employee.