脚本中Add-LocalGroupMember失效，手动执行正常的技术求助

问题场景 #

我编写了PowerShell脚本，用于在Windows 10/11设备上对指定本地用户执行以下操作：

• 检查用户是否存在
• 若用户存在且属于Administrators组，先将其从组中移除
• 设置用户的UserMayChangePassword属性为$False
• 重新将用户添加回Administrators组

但遇到异常：在管理员权限PowerShell窗口中运行脚本时，添加用户回组的操作失效，但手动执行相同的Add-LocalGroupMember命令却能正常完成。脚本未返回任何错误提示，且内置的成员检测逻辑也未触发错误，通过计算机管理和手动执行Get-LocalGroupMember可确认用户并未被添加回组。

我还尝试了两种替代添加方法，结果完全一致：脚本中失效，手动执行正常：

# 方法1：使用ADSI
$group = [ADSI]("WinNT://$env:ComputerName/administrators,group")
$group.add("WinNT://$username,user")

# 方法2：使用net命令
net localgroup Administrators "$userName" /add

脚本代码（已脱敏） #

$users = "adm01", "adm02", "adm03"

Foreach($userName in $users) {
   $testUserExistence = Get-LocalUser -Name "$userName"
   
   If (! ($testUserExistence) ) {
   
      $exitCodestr = "1: $userName doesn't exist"
      $EXITCODE = 1
      Continue
      
   }   #END ifUserDoesn'tExist()
   
   $testGroupMemberShip = Get-LocalGroupMember -Group "Administrators" -Member "$userName"
   
   IF (! ($testGroupMembership) ) {

      $EXITCODE = 2
      $exitCodeStr = "2: User wasn't originally an administrator"
      Continue

   }   #END testGroupMembership()
   
   Remove-LocalGroupMember -Group "Administrators" -Member "$userName"
   
   $testRemoval = Get-LocalGroupMember -Group "Administrators" -Member "$userName"
   
   If ($testRemoval) {
      $extiCodeStr = "3: User wasn't removed from administrators"
      $EXITCODE = 3
      #Send notification to me - function removed for posting
      Break
   }
   
   $setCannotChange = Set-LocalUser -Name "$userName" -UserMayChangePassword $False
   
   If (! ($setCannotChange) ) {
      $exitCodeStr = "4: Cannot set user property"
      $EXITCODE = 4
      Continue
   }

   #begin section in my code that appears to not work when deployed via script.

   Add-LocalGroupMember -Group "Administrators" -Member "$userName"

   $addGroupMember = Get-LocalGroupMember -Group "Administrators" -Member "$userName"
   
   If (! ($addGroupMember) ) {
      $exitCodeStr = "5: Could not add [$userName] to Administrators"
      $EXITCODE = 5
      #Send notification to me - function removed for posting
      Break
   }

   #end section that appears to be not working

   $successfulChange = (Get-LocalUser $userName).UserMayChangePassword
   If ($successfulChange) {

      $exitCodeStr = "6: User is still allowed to change password after attempted change."
      $EXITCODE = 6
      Continue

   }
}

Exit $EXITCODE

可能的解决思路 #

• 添加延迟同步：系统对本地用户/组的变更可能存在缓存延迟，在移除用户后、设置属性后、添加用户前加入短暂延迟：

  # 移除用户后延迟1秒
  Start-Sleep -Seconds 1
  # 设置属性后再延迟1秒
  Start-Sleep -Seconds 1
  

• 改用WMI验证成员身份：避免Get-LocalGroupMember的缓存问题，用WMI查询确认用户是否成功加入：

  $isMember = Get-WmiObject -Class Win32_GroupUser -Filter "GroupComponent='WinNT://$env:COMPUTERNAME/Administrators' and PartComponent='WinNT://$env:COMPUTERNAME/$userName'"
  if (-not $isMember) {
      # 处理添加失败逻辑
  }
  

• 捕获隐藏错误：在添加操作中启用错误捕获，查看是否有未显示的错误信息：

  try {
      Add-LocalGroupMember -Group "Administrators" -Member $userName -ErrorAction Stop
  } catch {
      Write-Host "添加用户[$userName]失败：$($_.Exception.Message)"
      $EXITCODE = 5
      break
  }
  

• 修正变量拼写问题：原脚本中$testGroupMemberShip与$testGroupMembership存在大小写差异（PowerShell不区分大小写，但可能导致逻辑误判），建议统一变量名。

内容的提问来源于stack exchange，提问作者user30658636