4

Following commands run on a Windows 10 VM that's joined to AzureAD:

PS C:\Windows\system32> Get-LocalGroupMember -Group Administrators
Get-LocalGroupMember : Failed to compare two elements in the array. At line:1 char:1

PS C:\Windows\system32> Get-LocalGroupMember -Group Users
Group NT AUTHORITY\Authenticated Users Unknown
Group NT AUTHORITY\INTERACTIVE Unknown

PS C:\Windows\system32> net localgroup administrators
Members
Administrator AzureAD\UserName

Any idea why the PowerShell Get-LocalGroupMember command is generating an error on the Administrators group whereas net localgroup works as does Get-LocalGroupMember for the Users group?

2
  • Hrm, no repro on my win10 computers.
    – Zoredache
    Oct 5, 2016 at 22:07
  • It works fine on my dev PC, just not this trial Windows 10 VM. Hmm... Oct 6, 2016 at 10:28

5 Answers 5

5

This has been referenced as an official bug:

https://github.com/PowerShell/PowerShell/issues/2996

Here is workaround:

http://jdhitsolutions.com/blog/scripting/2342/query-local-administrators-with-cim/

UPDATE:

I had some issues with CIM and WMI.

Here is another workaround which worked everywhere for me.

https://p0w3rsh3ll.wordpress.com/2016/06/14/any-documented-adsi-changes-in-powershell-5-0/

1
  • 1
    Man, it's 8/23/2018 and this bug is still not fixed Aug 23, 2018 at 16:43
1

This is caused by empty sids in the Administrators Group. Open the Administrators group and remove the empty sids left behind from domain join/leave. Before and After cleaning up the administrators group

PS C:\WINDOWS\system32> Get-LocalGroupMember -Group "Administrators" Get-LocalGroupMember : Failed to compare two elements in the array. At line:1 char:1

  • Get-LocalGroupMember -Group "Administrators"
  •   + CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
      + FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
    
    
    

PS C:\WINDOWS\system32> Get-LocalGroupMember -Group "Administrators"

ObjectClass Name PrincipalSource


User MyMachine\Administrator Local
User NA\otheradmin AzureAD

you are welcome, working on a way cleaning up all empty sids from groups now.

0

This will clean up the broken administrators. I think they were created during the update process:

(powershell script)

$administrators = @(
([ADSI]"WinNT://./Administrators").psbase.Invoke('Members') |
% { 
 $_.GetType().InvokeMember('AdsPath','GetProperty',$null,$($_),$null) 
}
) -match '^WinNT';

$administrators = $administrators -replace "WinNT://",""

$administrators

foreach ($administrator in $administrators)
{

if ($administrator -like "$env:COMPUTERNAME/*" -or $administrator -like "AzureAd/*")
{
    continue;
}

Remove-LocalGroupMember -group "administrators" -member $administrator
}
0

Modified the above script to remove empty SIDs and report anyone else. Local users that are AzureAD Joined (onprem) using ADFS could be removed (set in azure ad / endpoint manager )

$administrators = @(
([ADSI]"WinNT://./Administrators").psbase.Invoke('Members') |
% { 
 $_.GetType().InvokeMember('AdsPath','GetProperty',$null,$($_),$null) 
}
) -match '^WinNT';

$administrators = $administrators -replace "WinNT://",""

#$administrators

foreach ($administrator in $administrators)
{
#write-host $administrator "got here"
if ($administrator -like "$env:COMPUTERNAME/*" -or $administrator -like "AzureAd/*")
{
    continue;
}
elseif ($administrator -match "S-1") #checking for empty/orphaned SIDs only
{
write-host $administrator
Remove-LocalGroupMember -group "administrators" -member $administrator
}
write-host $administrator "check this users permissions if set in endpoint manager"
}
-1

The problem is empty SIDs in the Administrators Group caused by domain joins/leave/join etc.

Remove the empty sids and the command works just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.