Automate direct domain enrollment across Windows versions

scripts/Test-SguClientEnrollment.ps1

@@ -22,6 +22,28 @@ $issues = [Collections.Generic.List[string]]::new()
 $standardLocalUserName = 'alumno'
 $passwordNeverExpiresFlag = 0x10000
 
+function Get-LocalGroupMemberSid {
+    param([Parameter(Mandatory)][string]$Name)
+
+    $group = [ADSI]("WinNT://$env:COMPUTERNAME/$Name,group")
+    foreach ($member in @($group.psbase.Invoke('Members'))) {
+        try {
+            $sidBytes = $member.GetType().InvokeMember(
+                'objectSid',
+                [Reflection.BindingFlags]::GetProperty,
+                $null,
+                $member,
+                $null)
+            if ($sidBytes) {
+                ([Security.Principal.SecurityIdentifier]::new([byte[]]$sidBytes, 0)).Value
+            }
+        }
+        catch {
+            # Keep validating known members when an old forest SID no longer resolves.
+        }
+    }
+}
+
 $computer = Get-CimInstance Win32_ComputerSystem
 if ($RequireDomainJoined -and -not $computer.PartOfDomain) {
     $issues.Add('The computer is not joined to a domain.')
@@ -100,12 +122,12 @@ if ($standardLocalUserPresent) {
     $usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
     $administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
     $usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
-    $administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
-    $standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
+    $administratorMembers = @(Get-LocalGroupMemberSid -Name $administratorsGroup.Name)
+    $standardMembers = @(Get-LocalGroupMemberSid -Name $usersGroup.Name)
     $standardLocalUserIsAdministrator =
-        $administratorMembers.SID.Value -contains $standardLocalUser.SID.Value
+        $administratorMembers -contains $standardLocalUser.SID.Value
     $standardLocalUserInUsersGroup =
-        $standardMembers.SID.Value -contains $standardLocalUser.SID.Value
+        $standardMembers -contains $standardLocalUser.SID.Value
     try {
         $directoryEntry = [ADSI]("WinNT://$env:COMPUTERNAME/$standardLocalUserName,user")
         $userFlags = [int]$directoryEntry.InvokeGet('UserFlags')
@@ -195,12 +217,18 @@ $remoteAccessReady = $null
 if ($RequireRemoteAccess) {
     $remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-555')
     $remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]
-    $rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
+    $rdpMembers = @(Get-LocalGroupMemberSid -Name $remoteDesktopUsersGroup)
+    $remoteDesktopPrincipalSid = $null
+    try {
+        $remoteDesktopPrincipalSid = ([Security.Principal.NTAccount]::new($RemoteDesktopPrincipal)).Translate(
+            [Security.Principal.SecurityIdentifier]).Value
+    }
+    catch { }
     $remoteAccessReady =
         (Get-Service TermService).Status -eq 'Running' -and
         (Get-Service WinRM).Status -eq 'Running' -and
         (Get-ItemPropertyValue 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections) -eq 0 -and
-        $rdpMembers.Name -contains $RemoteDesktopPrincipal
+        $remoteDesktopPrincipalSid -and $rdpMembers -contains $remoteDesktopPrincipalSid
     if (-not $remoteAccessReady) {
         $issues.Add('RDP/WinRM or the authorized domain group is not fully configured.')
     }