Resolve SGU staff addresses and provision local student user

scripts/Test-SguClientEnrollment.ps1

@@ -19,6 +19,7 @@ $defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
 $interactiveLogonPolicyPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
 $settingsPath = Join-Path $env:ProgramData 'SGU\CredentialProvider\settings.json'
 $issues = [Collections.Generic.List[string]]::new()
+$standardLocalUserName = 'alumno'
 
 $computer = Get-CimInstance Win32_ComputerSystem
 if ($RequireDomainJoined -and -not $computer.PartOfDomain) {
@@ -87,6 +88,41 @@ if (-not $passwordProviderPreserved) {
     $issues.Add('The built-in Microsoft password provider registration is missing.')
 }
 
+$standardLocalUser = Get-LocalUser -Name $standardLocalUserName -ErrorAction SilentlyContinue
+$standardLocalUserPresent = [bool]$standardLocalUser
+$standardLocalUserEnabled = $standardLocalUserPresent -and $standardLocalUser.Enabled
+$standardLocalUserIsAdministrator = $false
+$standardLocalUserInUsersGroup = $false
+$standardLocalUserPasswordNeverExpires =
+    $standardLocalUserPresent -and $standardLocalUser.PasswordNeverExpires
+if ($standardLocalUserPresent) {
+    $administratorsSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+    $usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
+    $administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
+    $usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
+    $administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
+    $standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
+    $standardLocalUserIsAdministrator =
+        $administratorMembers.SID.Value -contains $standardLocalUser.SID.Value
+    $standardLocalUserInUsersGroup =
+        $standardMembers.SID.Value -contains $standardLocalUser.SID.Value
+}
+if (-not $standardLocalUserPresent) {
+    $issues.Add("The required standard local user '$standardLocalUserName' is missing.")
+}
+elseif (-not $standardLocalUserEnabled) {
+    $issues.Add("The required standard local user '$standardLocalUserName' is disabled.")
+}
+elseif ($standardLocalUserIsAdministrator) {
+    $issues.Add("The required standard local user '$standardLocalUserName' belongs to the local Administrators group.")
+}
+elseif (-not $standardLocalUserInUsersGroup) {
+    $issues.Add("The required standard local user '$standardLocalUserName' does not belong to the local Users group.")
+}
+elseif (-not $standardLocalUserPasswordNeverExpires) {
+    $issues.Add("The required standard local user '$standardLocalUserName' does not retain its enrollment password.")
+}
+
 $settings = $null
 try {
     $settings = Get-Content -LiteralPath $settingsPath -Raw | ConvertFrom-Json
@@ -207,6 +243,11 @@ $result = [pscustomobject]@{
     LastSignedInUserHidden = $lastSignedInUserHidden
     LocalUserEnumerationDisabled = $localUserEnumerationDisabled
     PasswordProviderPreserved = $passwordProviderPreserved
+    StandardLocalUserPresent = $standardLocalUserPresent
+    StandardLocalUserEnabled = $standardLocalUserEnabled
+    StandardLocalUserIsAdministrator = $standardLocalUserIsAdministrator
+    StandardLocalUserInUsersGroup = $standardLocalUserInUsersGroup
+    StandardLocalUserPasswordNeverExpires = $standardLocalUserPasswordNeverExpires
     SettingsPresent = [bool]$settings
     ClientCertificatePresent = [bool]$clientCertificatePresent
     ServerCertificateTrusted = $serverCertificateTrusted