Automate direct domain enrollment across Windows versions

scripts/Enable-LabRemoteAccess.ps1

@@ -18,6 +18,24 @@ if (-not $computer.PartOfDomain) {
 
 $remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-555')
 $remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]
+$remoteDesktopPrincipalSid = ([Security.Principal.NTAccount]::new($RemoteDesktopPrincipal)).Translate(
+    [Security.Principal.SecurityIdentifier])
+
+function Get-LocalGroupMemberSid {
+    param([Parameter(Mandatory)][string]$Name)
+
+    $group = [ADSI]("WinNT://$env:COMPUTERNAME/$Name,group")
+    foreach ($member in @($group.psbase.Invoke('Members'))) {
+        try {
+            $sidBytes = $member.GetType().InvokeMember('objectSid',
+                [Reflection.BindingFlags]::GetProperty, $null, $member, $null)
+            if ($sidBytes) {
+                ([Security.Principal.SecurityIdentifier]::new([byte[]]$sidBytes, 0)).Value
+            }
+        }
+        catch { }
+    }
+}
 
 if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
     function Invoke-PowerCfgBestEffort {
@@ -57,9 +75,9 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesk
         -ErrorAction SilentlyContinue |
         Set-NetFirewallRule -Enabled True -Profile Domain
 
-    $existingMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
-    if ($existingMembers.Name -notcontains $RemoteDesktopPrincipal) {
-        Add-LocalGroupMember -Group $remoteDesktopUsersGroup -Member $RemoteDesktopPrincipal
+    $existingMembers = @(Get-LocalGroupMemberSid -Name $remoteDesktopUsersGroup)
+    if ($existingMembers -notcontains $remoteDesktopPrincipalSid.Value) {
+        Add-LocalGroupMember -Group $remoteDesktopUsersGroup -Member $remoteDesktopPrincipalSid.Value
     }
 
     # Use Windows PowerShell so both the inbox and compatible remoting endpoints
@@ -97,7 +115,7 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesk
     }
 }
 
-$rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
+$rdpMembers = @(Get-LocalGroupMemberSid -Name $remoteDesktopUsersGroup)
 [pscustomobject]@{
     ComputerName = $env:COMPUTERNAME
     Domain = $computer.Domain
@@ -108,7 +126,7 @@ $rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorActio
         'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
         -Name UserAuthentication) -eq 1
     RemoteDesktopPrincipal = $RemoteDesktopPrincipal
-    PrincipalIsAuthorized = $rdpMembers.Name -contains $RemoteDesktopPrincipal
+    PrincipalIsAuthorized = $rdpMembers -contains $remoteDesktopPrincipalSid.Value
     TermService = (Get-Service TermService).Status
     WinRM = (Get-Service WinRM).Status
     FirewallProfile = 'Domain'