#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]
param()

$ErrorActionPreference = 'Stop'
$userName = 'alumno'
$plainTextPassword = 'ingenieria'
$description = 'Cuenta local estandar de recuperacion para equipos SGU'

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Run this script from an elevated Windows PowerShell session.'
}

if (-not $PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Create or update standard local user $userName")) {
    return
}

$securePassword = ConvertTo-SecureString $plainTextPassword -AsPlainText -Force
try {
    $user = Get-LocalUser -Name $userName -ErrorAction SilentlyContinue
    if ($user -and $user.SID.Value.EndsWith('-500', [StringComparison]::Ordinal)) {
        throw "The local account '$userName' is the built-in Administrator account and cannot be converted to a standard user."
    }

    if ($user) {
        Set-LocalUser -Name $userName `
            -Password $securePassword `
            -PasswordNeverExpires $true `
            -Description $description
        if (-not $user.Enabled) {
            Enable-LocalUser -Name $userName
        }
    }
    else {
        New-LocalUser -Name $userName `
            -Password $securePassword `
            -PasswordNeverExpires `
            -Description $description | Out-Null
    }

    $user = Get-LocalUser -Name $userName -ErrorAction Stop
    $administratorsSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
    $usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
    $administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
    $usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
    $administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
    if ($administratorMembers.SID.Value -contains $user.SID.Value) {
        Remove-LocalGroupMember -Group $administratorsGroup -Member $user -Confirm:$false
    }

    $standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
    if ($standardMembers.SID.Value -notcontains $user.SID.Value) {
        Add-LocalGroupMember -Group $usersGroup -Member $user
    }
}
finally {
    $securePassword = $null
}

$verifiedUser = Get-LocalUser -Name $userName -ErrorAction Stop
$verifiedAdministratorsGroup = Get-LocalGroup `
    -SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')) `
    -ErrorAction Stop
$verifiedUsersGroup = Get-LocalGroup `
    -SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')) `
    -ErrorAction Stop
$verifiedAdministrators = @(Get-LocalGroupMember -Group $verifiedAdministratorsGroup -ErrorAction Stop)
$verifiedUsers = @(Get-LocalGroupMember -Group $verifiedUsersGroup -ErrorAction Stop)
if (@($verifiedAdministrators).SID.Value -contains $verifiedUser.SID.Value) {
    throw "The local account '$userName' still belongs to the local Administrators group."
}
if ($verifiedUsers.SID.Value -notcontains $verifiedUser.SID.Value) {
    throw "The local account '$userName' does not belong to the local Users group."
}

[pscustomobject]@{
    UserName = $verifiedUser.Name
    Enabled = $verifiedUser.Enabled
    IsAdministrator = $false
    IsStandardUser = $true
    PasswordNeverExpires = $verifiedUser.PasswordNeverExpires
}