Automate direct domain enrollment across Windows versions

scripts/Set-SguStandardLocalUser.ps1

@@ -15,6 +15,29 @@ function Get-LocalUserFlags {
     return [int]$directoryEntry.InvokeGet('UserFlags')
 }
 
+function Get-LocalGroupMemberSid {
+    param([Parameter(Mandatory)][string]$Name)
+
+    $group = [ADSI]("WinNT://$env:COMPUTERNAME/$Name,group")
+    foreach ($member in @($group.psbase.Invoke('Members'))) {
+        try {
+            $sidBytes = $member.GetType().InvokeMember(
+                'objectSid',
+                [Reflection.BindingFlags]::GetProperty,
+                $null,
+                $member,
+                $null)
+            if ($sidBytes) {
+                ([Security.Principal.SecurityIdentifier]::new([byte[]]$sidBytes, 0)).Value
+            }
+        }
+        catch {
+            # An orphaned domain SID can no longer resolve after a forest is
+            # rebuilt. Other members must remain inspectable and unchanged.
+        }
+    }
+}
+
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = [Security.Principal.WindowsPrincipal]::new($identity)
 if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
@@ -64,14 +87,16 @@ try {
     $usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
     $administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
     $usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
-    $administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
-    if ($administratorMembers.SID.Value -contains $user.SID.Value) {
-        Remove-LocalGroupMember -Group $administratorsGroup -Member $user -Confirm:$false
+    $administratorMembers = @(Get-LocalGroupMemberSid -Name $administratorsGroup.Name)
+    if ($administratorMembers -contains $user.SID.Value) {
+        ([ADSI]("WinNT://$env:COMPUTERNAME/$($administratorsGroup.Name),group")).Remove(
+            "WinNT://$env:COMPUTERNAME/$userName,user")
     }
 
-    $standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
-    if ($standardMembers.SID.Value -notcontains $user.SID.Value) {
-        Add-LocalGroupMember -Group $usersGroup -Member $user
+    $standardMembers = @(Get-LocalGroupMemberSid -Name $usersGroup.Name)
+    if ($standardMembers -notcontains $user.SID.Value) {
+        ([ADSI]("WinNT://$env:COMPUTERNAME/$($usersGroup.Name),group")).Add(
+            "WinNT://$env:COMPUTERNAME/$userName,user")
     }
 }
 finally {
@@ -85,12 +110,12 @@ $verifiedAdministratorsGroup = Get-LocalGroup `
 $verifiedUsersGroup = Get-LocalGroup `
     -SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')) `
     -ErrorAction Stop
-$verifiedAdministrators = @(Get-LocalGroupMember -Group $verifiedAdministratorsGroup -ErrorAction Stop)
-$verifiedUsers = @(Get-LocalGroupMember -Group $verifiedUsersGroup -ErrorAction Stop)
-if (@($verifiedAdministrators).SID.Value -contains $verifiedUser.SID.Value) {
+$verifiedAdministrators = @(Get-LocalGroupMemberSid -Name $verifiedAdministratorsGroup.Name)
+$verifiedUsers = @(Get-LocalGroupMemberSid -Name $verifiedUsersGroup.Name)
+if ($verifiedAdministrators -contains $verifiedUser.SID.Value) {
     throw "The local account '$userName' still belongs to the local Administrators group."
 }
-if ($verifiedUsers.SID.Value -notcontains $verifiedUser.SID.Value) {
+if ($verifiedUsers -notcontains $verifiedUser.SID.Value) {
     throw "The local account '$userName' does not belong to the local Users group."
 }
 $verifiedPasswordNeverExpires =