Health Checker: Improve error message for orphaned SIDs in local Administrators group

When Get-LocalGroupMember fails due to orphaned SIDs in the built-in
Administrators group (InvalidOperationException on Server 2019/2022),
display a helpful message indicating orphaned SIDs may be the cause
instead of the misleading 'results were blank' message.

Server 2025 handles orphaned SIDs natively so this check is only
applied on older OS versions (build < 10.0.26100).

Fixes #2381

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dpaulson45

Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerExchangeInformation.ps1

@@ -335,7 +335,13 @@ function Invoke-AnalyzerExchangeInformation {
                     }
                 }
             } else {
-                $displayMissingGroups.Add("Unable to determine Local System Membership as the results were blank.")
+                if ($null -ne $exchangeInformation.ADComputerObject.LocalGroupMemberException -and
+                    $exchangeInformation.ADComputerObject.LocalGroupMemberException.Exception -is [System.InvalidOperationException] -and
+                    $HealthServerObject.OSInformation.BuildInformation.BuildVersion -lt [System.Version]"10.0.26100") {
+                    $displayMissingGroups.Add("Unable to determine Local System Membership. This can occur when orphaned SIDs exist in the local Administrators group.")
+                } else {
+                    $displayMissingGroups.Add("Unable to determine Local System Membership as the results were blank.")
+                }
             }
 
             if ($null -ne $exchangeInformation.ADComputerObject.ADGroupMembership -and

Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Invoke-JobExchangeInformationLocal.ps1

@@ -124,6 +124,7 @@ function Invoke-JobExchangeInformationLocal {
                 $localGroupMember = Get-LocalGroupMember -SID "S-1-5-32-544" -ErrorAction Stop
             } catch {
                 Write-Verbose "Failed to run Get-LocalGroupMember. Inner Exception: $_"
+                $localGroupMemberException = $_
                 Invoke-CatchActions
             }
         }
@@ -210,6 +211,7 @@ function Invoke-JobExchangeInformationLocal {
             IanaTimeZoneMappingsRaw                  = $ianaTimeZoneMappingContent
             FileContentInformation                   = $fileContentInformation
             LocalGroupMember                         = $localGroupMember
+            LocalGroupMemberException                = $localGroupMemberException
             RemoteJob                                = $true -eq $PSSenderInfo
             JobHandledErrors                         = $jobHandledErrors
             AllErrors                                = $Error

Diagnostics/HealthChecker/Features/Get-HealthCheckerDataObject.ps1

@@ -127,9 +127,10 @@ function Get-HealthCheckerDataObject {
                 VirtualDirectories                       = $ExchangeCmdletResult.VirtualDirectories
                 ExchangeCertificateInformation           = $exchangeCertificateInformation
                 ADComputerObject                         = [PSCustomObject]@{
-                    ADObject          = $ExchangeCmdletResult.ADObject.ComputerObject
-                    ADGroupMembership = $ExchangeCmdletResult.ADObject.GroupMembership
-                    LocalGroupMember  = $ExchangeLocalResult.LocalGroupMember
+                    ADObject                  = $ExchangeCmdletResult.ADObject.ComputerObject
+                    ADGroupMembership         = $ExchangeCmdletResult.ADObject.GroupMembership
+                    LocalGroupMember          = $ExchangeLocalResult.LocalGroupMember
+                    LocalGroupMemberException = $ExchangeLocalResult.LocalGroupMemberException
                 }
                 AES256CBCInformation                     = $ExchangeLocalResult.AES256CBCInformation
                 ApplicationConfigFileStatus              = $ExchangeLocalResult.ApplicationConfigFileStatus