PowerShell脚本添加本地用户至管理员组报错求助

我需要编写一个PowerShell脚本满足以下需求：

• 检查账户是否存在，不存在则创建
• 检查账户是否属于本地管理员组，不属于则添加
• 生成随机密码并为账户设置

但执行时遇到报错：

The 'Administrators' group members are null.
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException

现有脚本如下：

try {
    # Check if the account exists
    $username = "chappie"
    $user = Get-LocalUser -Name $username
    # If not, create an account
    if (!$user) {
        New-LocalUser -Name $username -NoPassword -FullName "Chappie User" -Description "Chappie user account"
        $user = Get-LocalUser -Name $username
    }
}
catch {
    if ($_) {
        Write-Error "Error creating user account: $_"
    }
    return
}

try {
    # Check if an account is part of local admins
    $adminGroup = Get-LocalGroup -Name "Administrators"
    if (!$adminGroup) {
        Write-Error "The 'Administrators' group object is null."
        return
    }
    if ($adminGroup.Members -eq $null) {
        Write-Error "The 'Administrators' group members are null."
        return
    }
    $admin = $adminGroup.Members | Where-Object { $_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null) -eq "Chappie" }
    # If not, add to the local admins group
    if (!$admin) {
        $user = Get-LocalUser -Name "Chappie"
        if (!$user) {
            Write-Error "The 'Chappie' user object is not found."
            return
        }
        $userPrincipal = $user.SID
        if (!$userPrincipal) {
            Write-Error "The 'Chappie' user principal is null."
            return
        }
        $adminGroup.Invoke("Add", $userPrincipal.Value)
    }
}
catch {
    if ($_) {
        Write-Error "Error adding user to local administrators group: $_"
    }
    return
}

已确认用户能成功创建，管理员组也存在，但仍触发成员为空的报错。

问题根源 #

1. Get-LocalGroup返回的对象不会自动加载Members属性，直接访问会返回$null，这是报错的核心原因。
2. 手动调用GetType().InvokeMember获取成员名称的方式复杂且易出错，PowerShell有更简洁的原生方法处理本地组成员。
3. 原脚本缺少随机密码生成与设置的逻辑，未完成全部需求。

修复后的完整脚本 #

$username = "chappie"

# 1. 检查并创建用户（含随机密码设置）
try {
    $user = Get-LocalUser -Name $username -ErrorAction SilentlyContinue
    if (-not $user) {
        # 生成12位随机密码：包含大小写字母、数字、特殊字符
        $passwordChars = ((65..90) + (97..122) + (48..57) + (33,35,36,37,64)) | Get-Random -Count 12
        $password = -join ($passwordChars | ForEach-Object {[char]$_})
        $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
        
        $user = New-LocalUser -Name $username `
                              -Password $securePassword `
                              -FullName "Chappie User" `
                              -Description "Chappie user account" `
                              -AccountNeverExpires `
                              -ErrorAction Stop
        Write-Host "用户 $username 已创建，密码：$password"
    } else {
        Write-Host "用户 $username 已存在"
    }
} catch {
    Write-Error "创建用户失败：$_"
    exit 1
}

# 2. 检查并添加至本地管理员组
try {
    # 直接用Get-LocalGroupMember获取管理员组成员，避免属性未加载问题
    $isInAdminGroup = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop | 
                      Where-Object { $_.Name -eq $username -or $_.SID -eq $user.SID }
    
    if (-not $isInAdminGroup) {
        Add-LocalGroupMember -Group "Administrators" -Member $user -ErrorAction Stop
        Write-Host "用户 $username 已添加至本地管理员组"
    } else {
        Write-Host "用户 $username 已属于本地管理员组"
    }
} catch {
    Write-Error "管理员组操作失败：$_"
    exit 1
}

关键改进点 #

• 使用Get-LocalUser -ErrorAction SilentlyContinue替代原逻辑，更简洁判断用户是否存在
• 新增符合安全要求的随机密码生成逻辑，完成全部需求
• 用PowerShell原生的Get-LocalGroupMember和Add-LocalGroupMember替代复杂的COM对象调用，彻底解决成员属性为空的问题
• 通过成员的Name或SID双重验证用户组归属，逻辑更可靠
• 统一添加-ErrorAction Stop确保异常能被正确捕获处理

内容的提问来源于stack exchange，提问作者Chappie