Regex For SDDL

Hi guys,

I have a task to edit an SDDL string.  The following is an example:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)**S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

The ** is where I need to insert an ACE, not part of the SDDL string.

I have the following POSH code to test finding the insertion position:

$sddl = 'D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)'
$pattern = '^D:(\([AD];;([A-Z][A-Z])+;;;\w+\))+'
$sddl -cmatch $pattern
$Matches

And here is the output:

Name                           Value                                                                                                                                                                  
----                           -----                                                                                                                                                                  
2                              RC                                                                                                                                                                     
1                              (A;;CCLCSWRPWPDTLOCRRC;;;PU)                                                                                                                                           
0                              D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)      

My question is, how can I adjust the regex pattern to accurately find out the insertion position (i.e. at the end of the D: part, and right before S: (if exist)).

Thanks ahead