Automate direct domain enrollment across Windows versions

scripts/Enable-SguClientMonitoring.ps1

@@ -3,6 +3,22 @@ param()
 
 $ErrorActionPreference = 'Stop'
 
+function Get-LocalGroupMemberSid {
+    param([Parameter(Mandatory)][string]$Name)
+
+    $group = [ADSI]("WinNT://$env:COMPUTERNAME/$Name,group")
+    foreach ($member in @($group.psbase.Invoke('Members'))) {
+        try {
+            $sidBytes = $member.GetType().InvokeMember('objectSid',
+                [Reflection.BindingFlags]::GetProperty, $null, $member, $null)
+            if ($sidBytes) {
+                ([Security.Principal.SecurityIdentifier]::new([byte[]]$sidBytes, 0)).Value
+            }
+        }
+        catch { }
+    }
+}
+
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = [Security.Principal.WindowsPrincipal]::new($identity)
 if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
@@ -30,11 +46,12 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable SGU session auditing and
     # NETWORK SERVICE. Resolve both principals by SID for localized Windows.
     $eventLogReadersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-573')
     $networkServiceSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-20')
-    $members = @(Get-LocalGroupMember -SID $eventLogReadersSid -ErrorAction SilentlyContinue)
+    $eventLogReadersGroup = ($eventLogReadersSid.Translate(
+            [Security.Principal.NTAccount]).Value -split '\\', 2)[1]
+    $members = @(Get-LocalGroupMemberSid -Name $eventLogReadersGroup)
     $eventLogReaderMembershipChanged = $false
-    if ($members.SID.Value -notcontains $networkServiceSid.Value) {
-        $networkServiceAccount = $networkServiceSid.Translate([Security.Principal.NTAccount]).Value
-        Add-LocalGroupMember -SID $eventLogReadersSid -Member $networkServiceAccount
+    if ($members -notcontains $networkServiceSid.Value) {
+        Add-LocalGroupMember -SID $eventLogReadersSid -Member $networkServiceSid.Value
         $eventLogReaderMembershipChanged = $true
     }