Exchange Server Membership - Health Checker

[trudolf-msft]

Provide Version Number
Exchange Health Checker version 25.08.07.1430

Describe the issue
When built-in Administrators contains orphaned SIDs this test fails with incorrect message.
Exchange Server Membership: Failed
Unable to determine Local System Membership as the results were blank.
More Information: https://aka.ms/HC-ServerMembership

Expected behavior
Exchange Server Membership: Failed
Local System Membership contain orphaned SIDs
More Information: https://aka.ms/HC-ServerMembership

Repro steps
Add user/group "delete1 to built-in Administrators group.

Delete user/group from AD (and as result this entry stays as orphaned SID)

Run the Healthchecker and you see the error above

[dpaulson45]

I thought I had something that would address this, which it does work when we are running outside of a job, but not inside which is never going to work by the looks of it beside running locally.

            try {
                $localGroupMember = Get-LocalGroupMember -SID "S-1-5-32-544" -ErrorAction Stop
            } catch {
                Write-Verbose "Failed to run Get-LocalGroupMember. Inner Exception: $_"
                Invoke-CatchActions

                try {
                    # We need to attempt to collect the Local Group Member information. This is common when there is an unknown SID within the group. So we need to manually get all this information.
                    $localGroupMember = New-Object System.Collections.Generic.List[object]
                    Get-CimInstance -ClassName Win32_Group | Where-Object { $_.SID -eq "S-1-5-32-544" } |
                        Get-CimAssociatedInstance -Association Win32_GroupUser |
                        ForEach-Object { $localGroupMember.Add(
                                [PSCustomObject]@{
                                    Name = $_.Caption
                                    SID  = $_.SID
                                })
                        }
                } catch {
                    Invoke-CatchActions
                }
            }
        }

[dpaulson45]

This issue is only a problem when the older OS version. Just tried these steps on Windows Server 2025 and this is no longer a problem. @lusassl-msft do you think this is worth our time to possibly address if it is even possible for the older versions of Windows?