Get-LocalGroupMember - Failed to compare two elements in the array.

It appears that if you have domain groups added to a local group and then move the server to a workgroup before removing them Get-LocalGroupMember no longer works and instead throws an exception 'Failed to compare two elements in the array.'.  I am seeing this on Server 2016 Core, I have not tried on any other editions.  I found this while building a server in one domain that needed to move to a different one.
Steps to reproduce

Join a Windows Server 2016 Core server to a domain.
Added 3 domain groups to the local administrators group.
Moved the server back into a workgroup.
Ran Get-LocalGroupMember -Group Administrators

I've reproduced this on two servers.
Expected behavior
It should return the group members as it would prior to moving to a workgroup and just display the unresolved SIDs for the old domain.  Then ideally allow you to reference those unresolved SIDS for Remove-LocalGroupMember.
Actual behavior
Throws an exception.

Environment data
> $PSVersionTable
PSVersion                      5.1.14393.206
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.206
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>

@ephos This is an interesting issue. Can you please provide
$Error[0] | fl * -force

as well?

@mirichmo here you go!
> $Error[0] | fl * -Force

writeErrorStream      : True
PSMessageDetails      :
Exception             : System.InvalidOperationException: Failed to compare two elements in the array. --->
                        System.NullReferenceException: Object reference not set to an instance of an object.
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.<>c.<ProcessesMembership>b_
                        _20_0(LocalPrincipal p1, LocalPrincipal p2)
                           at System.Collections.Generic.ArraySortHelper`1.SwapIfGreater(T[] keys, IComparer`1
                        comparer, Int32 a, Int32 b)
                           at System.Collections.Generic.ArraySortHelper`1.DepthLimitedQuickSort(T[] keys, Int32
                        left, Int32 right, IComparer`1 comparer, Int32 depthLimit)
                           at System.Collections.Generic.ArraySortHelper`1.Sort(T[] keys, Int32 index, Int32
                        length, IComparer`1 comparer)
                           --- End of inner exception stack trace ---
                           at System.Collections.Generic.ArraySortHelper`1.Sort(T[] keys, Int32 index, Int32
                        length, IComparer`1 comparer)
                           at System.Array.Sort[T](T[] array, Int32 index, Int32 length, IComparer`1 comparer)
                           at System.Collections.Generic.List`1.Sort(Comparison`1 comparison)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumer
                        able`1 membership)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {0, 1}

Thanks for the info

It's work well on Windows 10 :
Name                           Value
----                           -----
CLRVersion
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
GitCommitId                    v6.0.0-alpha.14-28-geef6ed0584ba62e232f95668ad25d277d2137efc-dirty
SerializationVersion           <IP_ADDRESS>
PSRemotingProtocolVersion      2.3
PSEdition                      Core
WSManStackVersion              3.0
BuildVersion                   <IP_ADDRESS>
PSVersion                      6.0.0-alpha

I am also hitting this issue, any workarounds?

@ssylvan Can you confirm that the problem is on Windows Server 2016 Core server only.

I'm seeing it on windows 10 on a surface book.
On Thu, Jan 12, 2017 at 10:46 PM, Ilya<EMAIL_ADDRESS>wrote:

@ssylvan https://github.com/ssylvan Can you confirm that the problem is
on Windows Server 2016 Core server only.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-272373455,
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABTVpweK9qalpKLeTK1yx5TwZ7csJI-Mks5rRx3ggaJpZM4LhJ0X
.

--
Sebastian Sylvan

@ssylvan Thanks for the clarification.

Hello, I'm seeing this error raised as well. Windows 10 Pro
PS C:> [System.Environment]::OSVersion.Version
Major  Minor  Build  Revision

10     0      14393  0

@itisbrendan Thanks for confirmation!

Same experience in Windows 7 Enterprise and exactly the same Error details as @ephos
Major  Minor  Build  Revision
-----  -----  -----  --------
6      1      7601   65536

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.14409.1005
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14409.1005
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>

I'm getting the same on Win10 joined to Azure AD.  This PC has never been part of a traditional Active Directory.
PS C:\Users\SteveMahoney> $PSVersionTable
Name                           Value

PSVersion                      5.1.14393.693
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.693
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>
PS C:\Users\SteveMahoney> Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember : Failed to compare two elements in the array.
At line:1 char:1

Get-LocalGroupMember -Group "Administrators"

  + CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
  + FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand

PS C:\Users\SteveMahoney> $Error[0] | fl * -force
writeErrorStream      : True
PSMessageDetails      :
Exception             : System.InvalidOperationException: Failed to compare two elements in the array. ---> System.NullReferenceException: Object reference not
set to an instance of an object.
at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.<>c.b__20_0(LocalPrincipal p1, LocalPrincipal p2)
at System.Collections.Generic.ArraySortHelper1.InsertionSort(T[] keys, Int32 lo, Int32 hi, IComparer1 comparer)
at System.Collections.Generic.ArraySortHelper1.IntrospectiveSort(T[] keys, Int32 left, Int32 length, IComparer1 comparer)
at System.Collections.Generic.ArraySortHelper1.Sort(T[] keys, Int32 index, Int32 length, IComparer1 comparer)
--- End of inner exception stack trace ---
at System.Collections.Generic.ArraySortHelper1.Sort(T[] keys, Int32 index, Int32 length, IComparer1 comparer)
at System.Array.Sort[T](T[] array, Int32 index, Int32 length, IComparer1 comparer)                            at System.Collections.Generic.List1.Sort(Comparison1 comparison)                            at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumerable1 membership)
at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at , : line 1
PipelineIterationInfo : {0, 1}

Same issue on Windows 2008 R2.

I've had a bit of a poke around and a chat and some help from faustonascimento on IRC. This code will reproduce the problem:
Import-Module Microsoft.PowerShell.LocalAccounts
Add-Type -ReferencedAssemblies ([PowerShell].Assembly.Location), ([Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand].Assembly.Location) -TypeDefinition '
using System;
using System.Collections.Generic;
using System.Security.Principal;
using Microsoft.PowerShell.Commands;

public class Test
{
    public static IEnumerable<LocalPrincipal> Get()
    {
        List<LocalPrincipal> rv = new List<LocalPrincipal>();

        LocalPrincipal principal = new LocalPrincipal(Environment.UserName);
        principal.SID = (SecurityIdentifier)(new NTAccount(Environment.UserName)).Translate(typeof(SecurityIdentifier));
        rv.Add(principal);

        // https://github.com/PowerShell/PowerShell/blob/1462ac300bc5e4a20f0360b428de1cb1de4eaba4/src/Microsoft.PowerShell.LocalAccounts/LocalAccounts/Sam.cs#L2813
        rv.Add(null);

        rv.Sort((p1, p2) => string.Compare(p1.Name, p2.Name, StringComparison.CurrentCultureIgnoreCase));
        return rv;
    }
}
'
[Test]::Get()

The problem appears to be caused by the null return from the MakeLocalPrincipalObject method:
https://github.com/PowerShell/PowerShell/blob/1462ac300bc5e4a20f0360b428de1cb1de4eaba4/src/Microsoft.PowerShell.LocalAccounts/LocalAccounts/Sam.cs#L2810
The null value is being pushed to MakeLocalPrincipalObject because an invalid SID will cause a name lookup failure from Win32.LookupAccountSid. This method explicitly returns null when the error code ERROR_NONE_MAPPED (1332) is set.
This value is not filtered out and ends up being added to the rv collection which subsequently fails on Sort.
It can be argued that this value should be filtered out, as the null value is not useful. For example, by inserting:
rv = rv.Where(x => x != null).ToList();

Returning the invalid entry might be achievable, but it is a deep(er) change to a method shared by several other commands. This would potentially be useful as it may allow these commands to fix the problem (if it is such) rather than just ignoring the condition.

I think in general this makes sense. The only other method that calls MakeLocalPrincipalObject checks for a null return from LookupAccountInfo and throws an exception.
I'm curious about why we would be getting an invalid SID in the first place. There are two overloads for the GetGroupMembers method---one takes a group name and the other takes a group SID. They do their queries for group membership in different ways (Net API vs. SAM API). Do we know whether the null comes from one of these or the other, or both?

I only see one overload for GetGroupMembers in the source code? There are two overloads for GetLocalGroupMembers, both call GetGroupMembers with a SID.
It seems the only way to recreate this is described in the first post. A machine must be added to the domain, a member added, then the machine removed from the domain. Using a local user is not sufficient to recreate the problem. I'm not at liberty to test such things at the moment although it will need to be tested after the code has been changed.

Oops. Sorry, you're right. I was looking at an experimental version I'd forgotten about.
After re-reading the original description and looking at things again, the whole thing makes more sense to me and I think your solution is the correct one. There would need to be an additional minor change elsewhere to get the SID to be displayed in the output in place of the name, and there would be no way (I think) to correctly determine the ObjectClass.
Sorry for the noise.
Of course, all this kinda depends on the LocalAccounts cmdlets getting back into the build once they no longer use the SAM API.

Any update?
ALL PC's at work can't use get-localgroupmembers due to being Azure-AD connected.

Create an O365/AzureAD tenant, and add a user. Can be just intune, but most commonly EMS pack... and soon EVERY customer who buys Microsoft 365 business/enterprise suite (Windows 10 Enterprise, EMS, Office 365) will be affected.
Start a NEW computer. Anything Windows 10. Otherwise just spool up a new VM with a fresh Windows 10 installation. During normal OOBE setup it will ask the user to sign into Microsoft.
Sign into the work account created in step 1.
Windows will add this user account to "Administrators" localgroup automatically due to there not being an active local administrator account set up.

Likely due to there being an AzureAD account - this powershell cmdlet always crashes
`PS C:\WINDOWS\system32> net localgroup administrators
Alias name     administrators
Comment        Administrators have complete and unrestricted access to the computer/domain
Members

Administrator
AzureAD\ChrisHerringe-RealEs
dev_admin
The command completed successfully. PS C:\WINDOWS\system32> Get-LocalGroupMember administrators
Get-LocalGroupMember : Failed to compare two elements in the array.
At line:1 char:1

Get-LocalGroupMember administrators

  + CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
  + FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand`

/cc @SteveL-MSFT Azure-AD scenario failed.

I haven't been rushing to make a PR as this will only affect PowerShell 6 builds where it's currently not operational (and I'm rather busy at the moment).
It would be rather nice to stream this out as a standalone module, but even if it is, that won't make it immediately available to anyone.

@Hicsy after we have a fix in PSCore6, we can consider backporting it to Windows PowerShell 5.1.

@SteveL-MSFT I also would like to see that fix in 5.1 since im running into the same issue.

FFS.

Are there any updates on this?

Yes, please fix this if you can.
On Wed, May 9, 2018, 1:50 PM neomancipator<EMAIL_ADDRESS>wrote:

Are there any updates on this?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-387820740,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AYSeDTlJbiLHL2YvQ5f0k4W_4pNtYqfsks5twyxhgaJpZM4LhJ0X
.

@SteveL-MSFT

after we have a fix in PSCore6, we can consider backporting it to Windows PowerShell 5.1.

Should we enable the module on Windows?

@iSazonov we can't enable the module until we have a solution that uses public apis.  Since PSCore6 ships outside of Windows, we must only use public apis.

Can we migrate to System.DirectoryServices.AccountManagement?

still seeing this issue

Can we migrate to System.DirectoryServices.AccountManagement?

@SteveL-MSFT Is this right way? We have the API in Windows Compatibility Pack.

@iSazonov I'm not knowledgeable enough about that namespace to say whether that's the right direction.  It seems that if there's leftover data from the domain which is no longer relevant to the local system, it may be ok to add the synthetic account to inform user there are accounts that cannot be resolved.

Just FYI, I had been looking into using the Net* functions from the Windows API to implement this. Presumably that would remain Windows only, right?

I was able to work around the PowerShell bug issue by fixing the root of the problem. I found that this error was raised because I had a few corrupt/unknown users in the Group I was querying. I deleted the old entries in the Local Users and Groups (lusrmgr.msc) and the command completed with success.

Confirming nuttingd discoveries. Tested on 7 serveres, version 2012, 2012R2 and 2016.
Good job!

Can confirm nuttingd's procedure resolves the issue.

Ok than this is a workaround and the cmdlet still needs to be able to handle this situation.

This will also be a problem if you have a deleted domain user or group and if you have a foreign SID from a 1-way trust.  We definitely need the cmdlet to be able to output the SID so that old principals can be cleaned up and foreign principals can be reported accurately.

This is also a big issue for the organisation that I am in and whats worse is that I am getting errors through DSC and puppet due to this cmdlet not being able to handle deleted and/or disabled users from AD.
are there any further updates on fixing this issue?

Can confirm this is definitely still an issue. No-one has posted a workaround directly here though, so here's mine.
I was zipping the results so I wanted the content basically the same whether it worked the 'easy way' or with the workaround. It's sort of nice because now there's a warning when an invalid SID is on a server.
New-Item -ItemType Directory $zipfilepath -ErrorAction SilentlyContinue -Verbose | Out-Null

$machinename = $env:COMPUTERNAME
try{
	Get-LocalGroupMember "Administrators" | ft Name,@{L='Type';E={$_.ObjectClass}}
    $Admins = Get-LocalGroupMember "Administrators"
	Write-Host "Saving Output to $zipfilepath"
    }
catch{
    Write-Warning "Invalid SID or other issue detected. Remove it!!"
    Write-Warning "Trying alternative method"

    $query="Associators of {Win32_Group.Domain='$machinename',Name='Administrators'} where Role=GroupComponent"
    $Admins = get-wmiobject -query $query -ComputerName $machinename| Select @{L='Name';E={$_.Caption}},Caption,@{L='ObjectClass';E={$_.__CLASS}}
}
$Admins | `
    Select Name,@{L='Type';E={$_.ObjectClass}} | `
    Export-Csv -Path "$zipfilepath\localadmin-$machinename.csv" -NoTypeInformation `
    -Verbose -Force

This may not be a foreign SID. If the machine is AAD joined, the AAD Global Administrators role SID and the AAD Device (company) Administrators role SIDs will appear in the local admin group.
If necessary, you can use this as a psuedo-workaround:
$adminGroup.psbase.Invoke("Members")|ForEach-Object -Process {$_.GetType().InvokeMember("Name", 'GetProperty',$null, $_, $null)}

Two years later..... Ugh.
On Thu, Aug 15, 2019, 9:35 PM Scott Kissel<EMAIL_ADDRESS>wrote:

This may not be a foreign SID. If the machine is AAD joined, the AAD
Global Administrators role SID and the AAD Device (company) Administrators
role SIDs will appear in the local admin group.
If necessary, you can use this as a psuedo-workaround:
$adminGroup.psbase.Invoke("Members")|ForEach-Object -Process
{$.GetType().InvokeMember("Name", 'GetProperty',$null, $, $null)}
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/PowerShell/PowerShell/issues/2996?email_source=notifications&email_token=AGCJ4DKQEP4UCSAZLJEES3TQEX76JA5CNFSM4C4ETUL2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD4NNPGY#issuecomment-521852827,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AGCJ4DN45UCPH34O6XOIXBDQEX76JANCNFSM4C4ETULQ
.

I get this error anytime the SID is referred to in the Security Group.
Well known SIDs included. (i.e. Local Service, System accounts)

Looking at this many feedback I hope to continue #9926 (and create RFC)
/cc @SteveL-MSFT for information

None of the machines I have encountered this on were ever joined to a domain, and do not have any orphaned SIDs in local groups. The latest was a VM I built from scratch using a Win10 1903 iso.

Happening for me as well.  Group 'Users' has an unassociated SID. Attempting Get-LocalGroupMember on this group returns:
Get-LocalGroupMember : Failed to compare two elements in the array.
At line:4 char:5
+     Get-LocalGroupMember -Group $LocalGroup
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~`~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
+ FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand

Blocking an urgent audit. WMI workaround has its own quirks but is apparently the best we can do until this is fixed.
$Error[0] | fl * -force` returns:
writeErrorStream      : True
PSMessageDetails      :
Exception             : System.InvalidOperationException: Failed to compare two elements in the array. ---> System.NullReferenceException: Object reference not set to an instance of
                        an object.
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.<>c.<ProcessesMembership>b__20_0(LocalPrincipal p1, LocalPrincipal p2)
                           at System.Collections.Generic.ArraySortHelper`1.InsertionSort(T[] keys, Int32 lo, Int32 hi, IComparer`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.IntrospectiveSort(T[] keys, Int32 left, Int32 length, IComparer`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.Sort(T[] keys, Int32 index, Int32 length, IComparer`1 comparer)
                           --- End of inner exception stack trace ---
                           at System.Collections.Generic.ArraySortHelper`1.Sort(T[] keys, Int32 index, Int32 length, IComparer`1 comparer)
                           at System.Array.Sort[T](T[] array, Int32 index, Int32 length, IComparer`1 comparer)
                           at System.Collections.Generic.List`1.Sort(Comparison`1 comparison)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumerable`1 membership)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 4
PipelineIterationInfo : {0, 1}

[System.Environment]::OSVersion.Version returns:
Major  Minor  Build  Revision
-----  -----  -----  --------
10     0      16299  0

$PSVersionTable returns:
Name                           Value
----                           -----
PSVersion                      5.1.16299.1146
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.16299.1146
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           <IP_ADDRESS>

This is also a big issue for the organisation that I am in and whats worse is that I am getting errors through DSC and puppet due to this cmdlet not being able to handle deleted and/or disabled users from AD.
are there any further updates on fixing this issue?

I created a Puppet Task to remove the unresolvable sid issue I was having.
https://github.com/ffalor/ffalor-resolve_sid
Will be putting it on the forge in a little bit once I go through and make it a little cleaner. We had hundreds of servers failing in Puppet due to the SID issue, and I was able to fix them all in a few seconds with this task.

I know it's not quite the same, but you can parse text out of the following command to get local group membership in place of this command.
net localgroup administrators
Windows just can't seem to kill their old console =/

I'd just like to confirm that I'm running into this problem when I try to use Get-LocalGroupMember and my target group has unresolved SIDs in them. Most likely the AD objects no longer exist.

I think this is the best workaround to being able to enumerate all members of a group even if there are unresolved SIDs.
foreach ($group in Get-LocalGroup ) {
$group = [ADSI]"WinNT://$env:COMPUTERNAME/$group"
$group_members = @($group.Invoke('Members') | % {([adsi]$_).path})
$group_members
}

Issue from january 2017, still not resolved in Windows 10 20H1 (19041.172).
GG Microsoft.
Thanks for the code @passbt

@o-l-a-v The code is not in the repo. It is Windows component. But Windows PowerShell is frozen - only PowerShell Core can progress. So it is zugzwang :-(
We could migrate to new module but it is a breaking change.

@o-l-a-v The code is not in the repo. It is Windows component. But Windows PowerShell is frozen - only PowerShell Core can progress. So it is zugzwang :-(
We could migrate to new module but it is a breaking change.

Roger that, makes sense. But unless PS Core becomes default for Windows very soon, this is a very basic PS management ability that really should work out of the box on any Windows edition and version IMHO. How Ms fixes or mitigates that functionality is not important. The only important thing is that it should work out of the box, or removed as it can cause serious issues.

Please use Windows feedback tool to vote for the fix.

Mark this issue to be re-reviewed by the committee.
Get-LocalGroupMember is not part of the PowerShell repo, but given that the Microsoft.PowerShell.LocalAccount module is marked as CompatiblePSEdition = @('Desktop', 'Core') , people will use it in PowerShell 7 and run into the same issue. So we probably should push for a fix in Windows.

My first plan was to rewrite the module from scratch but today I look the code and found that we can port it to public API (AccountManagement) with minimal breaking changes (I don't know how many breaking changes will be, while I only see exception handling).
I hope to pull a draft in hours.

That is great news Ilya!  I look forward to seeing this and will for sure test it when it hits a daily build.

For Windows PowerShell 5.1, we've started a conversation with the team that owns servicing it to see if they are willing to make the fix.

@doctordns You can test. Specially in domain environment. That would be great if you made a new test file for domain scenario.

For those who run into this problem, and just need a workaround, here is a snippet that should give you what you need:
$localAdminGroupWmi = Get-WMIObject Win32_Group -Filter "Name='Administrators'" $localAdminGroupWmi.GetRelated("Win32_UserAccount")
This will subsequently list all User Accounts that are members of the Administrators group. Please note that "Administrators" is not language agnostic. For a Windows PC with Norwegian language, it would be "Administratorer" for instance.
If you need to check if a specific account is member of the admin group, you could then do something like this:
`if($null -eq ($localAdminGroupWmi.GetRelated("Win32_UserAccount") | Where-Object -Property Caption -Like -Value "*\AdminAccount"))
{
No account with name "AdminAccount" found in the Administators group
}`

@SteveL-MSFT - any updates on this?  Our organization is seeing this same behavior after migrating to a hybrid-joined model.  PS 5.1 is still the lowest common denominator for infrastructure and InfoSec operations in many corporations.  :)

@Rusty-Shackleford The module is not in the repo, it is Windows component. So please use Windows Feedback tool and other channels to retort the issue to Windows team.

 ^|FINDSTR /x /i /v /c:"%LAD%"') DO NET LOCALGROUP "%LAG%" /DELETE "%%s"
deactivate all local users
FOR /F "tokens=1 skip=1" %%i IN ('WMIC USERACCOUNT WHERE "LocalAccount='TRUE' AND Disabled='FALSE'" GET NAME') DO NET USER "%%i" /ACTIVE:NO
due the FOR Loop, the last loop gives an error - i ignore that

I think this is the best workaround to being able to enumerate all members of a group even if there are unresolved SIDs. foreach ($group in Get-LocalGroup ) { $group = [ADSI]"WinNT://$env:COMPUTERNAME/$group" $group_members = @($group.Invoke('Members') | % {([adsi]$_).path}) $group_members }

Best answer. works like a charm to display members from AAD who are showing as SIDS

This really needs to be opened. The issue may be caused by orphaned SIDs, but the orphaned SIDs on my device are AzureAD SIDs. I don't want to resort to the ADSI interface because while I understand it, my colleagues probably wouldn't. We use Powershell to use its native modules and cmdlets...

It also still does not seem to be resolved on the lastest as of the time of writing Powershell Core 7.2.2.

It also still does not seem to be resolved on the lastest as of the time of writing Powershell Core 7.2.2.

Can confirm, also facing this error
Thanks for the workaround

Yup. PowerShell 7.2.3 also exhibits the same behavior:
PS ❯ Get-LocalGroupMember -Group "Administrators"
Get-LocalGroupMember: Failed to compare two elements in the array.

PS ❯ $Error[0] | Format-List * -Force

PSMessageDetails      :
Exception             : System.InvalidOperationException: Failed to compare two elements in the array.
                         ---> System.NullReferenceException: Object reference not set to an instance of an object.
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.<>c.<ProcessesMembership>b__20_0(LocalPrincipal p1, LocalPrincipal p2)
                           at System.Collections.Generic.ArraySortHelper`1.InsertionSort(Span`1 keys, Comparison`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.IntroSort(Span`1 keys, Int32 depthLimit, Comparison`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.IntrospectiveSort(Span`1 keys, Comparison`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.Sort(Span`1 keys, Comparison`1 comparer)
                           --- End of inner exception stack trace ---
                           at System.Collections.Generic.ArraySortHelper`1.Sort(Span`1 keys, Comparison`1 comparer)
                           at System.Collections.Generic.List`1.Sort(Comparison`1 comparison)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumerable`1 membership)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessGroup(LocalGroup group)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {0, 1}

Hi, For me, the problem was solved when deleting orphaned SID in the local group of the remote computer. Just need to find a way to automatically do it on all machines...

Thank's

This is still happening, also in Windows 11 ...

Bag i back again

yep experiencing the same issue

I would say you’re barking up the wrong tree.  It was made clear a while ago that the pride is not in this repo, and that it would have to be addressed by the Windows team.
https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-716957100

I have same problems in 21H2(OS build 19044.1706) in Powershell 7.2.4. Get-LocalGroupMember -Group "Guests" works fine, but Get-LocalGroupMember -Group "Administrators" raise Error: Get-LocalGroupMember: Failed to compare two elements in the array.
Who has some information about this in newest?

@Jangab-water and others waiting for a fix: I'd just consider this issue as not going to be fixed any time soon.
But workarounds exists, like:

https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-604146661

Example of use:
#Requires -RunAsAdministrator
<#
    .SYNOPSIS
        Example of how to get group members without using Get-LocalGroupMember which is broken on AAD devices.

    .NOTES
        # Script info
        Author:   Olav Rønnestad Birkeland | github.com/o-l-a-v
        Created:  220609
        Modified: 220609

        # Resources
        * https://github.com/PowerShell/PowerShell/issues/2996
          * https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-604146661
#>

# Get all groups with all members
## Get
$LocalGroups = [PSCustomObject[]](
    $([array](Get-LocalGroup)).ForEach{
        $null = Add-Member -InputObject $_ -MemberType 'NoteProperty' -Force -Name 'Members' -Value (
            [string[]](
                $(
                    [adsi](
                        'WinNT://{0}/{1}' -f $env:COMPUTERNAME, $_.'Name'
                    )
                ).Invoke(
                    'Members'
                ).ForEach{
                    $([adsi]($_)).'path'.Split('/')[-1]
                }
            )
        )
        $_
    } | Sort-Object -Property 'Name'
)

## View some info
$LocalGroups | Format-Table -AutoSize -Property 'Name','SID',@{'Name'='Members';'Expression'={[uint16]$_.'Members'.'Count'}}

# Get members of specific group
## Get Administrators group
$Administrators = Get-LocalGroup -SID 'S-1-5-32-544'

## Get group members
$null = Add-Member -InputObject $Administrators -MemberType 'NoteProperty' -Force -Name 'Members' -Value (
    [string[]](
        $(
            [adsi](
                'WinNT://{0}/{1}' -f $env:COMPUTERNAME, $Administrators.'Name'
            )
        ).Invoke(
            'Members'
        ).ForEach{
            $([adsi]($_)).'path'.Split('/')[-1]
        }
    )
)

## Output members
$Administrators.'Members'

Yeah, we certainly wouldn't want two teams in the same company to like, you know, have to TALK and collaborate with one another to solve a problem. That would just be CRAZY.
Fix your ****, Microsoft.

So key is just ask them weekly on every channel available so they don‘t have time to collaborate… or was it the other way around?
@mirichmo: What are this „other channels“ where we public and transparent can open a bug/ticket/report in the right place?

Yes, please let us know. This bug has been an issue since 2017 - some traction would be greatly appreciated. It's a useful commodity via PowerShell, if it worked.

What are this „other channels“ where we public

Please use Windows Feedback tool.

lol

What are this „other channels“ where we public

Please use Windows Feedback tool.

lol

Information about the "feedback hub app" can be found at https://github.com/PowerShell/PowerShell#windows-powershell-vs-powershell-core.
We opened a bug about this to the internal team that owns the Microsoft.PowerShell.LocalAccounts module on 6/9/2022. The last time I checked, there was no progress on the fix yet. However, the bug is still active, and that means it's likely to be fixed at some point depending on the priorities of that team.

Information about the "feedback hub app" can be found at https://github.com/PowerShell/PowerShell#windows-powershell-vs-powershell-core.
We opened a bug about this to the internal team that owns the Microsoft.PowerShell.LocalAccounts module on 6/9/2022. The last time I checked, there was no progress on the fix yet. However, the bug is still active, and that means it's likely to be fixed at some point depending on the priorities of that team.

 GitHub**GitHub - PowerShell/PowerShell: PowerShell for every system!**PowerShell for every system! Contribute to PowerShell/PowerShell development by creating an account on GitHub.

That's a way better answer, thanks.

So... ran into this when deploying a custom policy to add Localusers in Azure Joined devices.
The policy failed on some devices with error 65000.
Running this Get-LocalGroupMembers for administrator failed with this same results from the OP.
Getting the members of the Group from the GUID, you will most likely find a couple of SIDs that may either be obsolete or
Resolution:
Delete the two GUIDs
The powershell command should work.
My policies started also coming down.
I suspect the GUIDs are created in the Azure Active Directory portal under
https://portal.azure.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId~/null
Select "Manage Additional local administrators on all Azure AD joined devices"
You can also access the Group role under AD role management:
https://portal.azure.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles/resourceId//resourceType/tenant/provider/aadroles/defaultId/roles
Look for Azure AD Joined Device Local Administrator.
Delete the members since they can be added via MDM policy anyway. (only if managed via MDM of course).
Hope that helps.

This is absolutely INSANE this has taken this long to fix. This is still impacting ps 5.1 after 5 years? We cant properly extract local admin users via this cmdlet if the machine is Azure bound? And we see no problem with that?
Ill also add that CMPivot in SCCM also fails (see below), presumably for the exact same reason the cmdlet is failing. This really needs to be fixed, cannot gather proper data on this, and to have this disparity between legacy on prem machines and azure joined machines is just pure silliness.

I couldn't find any exsiting feedback in the Feedback Hub.  I've created an issue - perhaps if everybody adds their comments to this feedback item (I understand - the feedback hub is ridiculously painful -- the fact that I can't access it from anything other than an app on a windows box is insane).  Here's a link to the feedback, please upvote it and comment on it.
https://aka.ms/AAhw50v

Just a quick update, we worked with the owner team of Windows PowerShell on a fix to this bug. The fix was checked in the Windows branch, and will be available to Win11 and win10 gradually with the new update releases.
With the fix, the cmdlet Get-LocalGroupMember will behave as shown below in the currently failing scenario:

As for those 2 SIDs, they are added by Azure AD:

Every Azure AD joined device contains two SIDs (the Global administrator role and the Device administrator role) that are by default part of the local administrators group.

They don't have account name and other information stored locally (hence the error because the Win32 API LookupAccountSid cannot find them locally), and you have to query Azure AD to get corresponding display name and description for them. Here is an article for how to do that FYI: https://oliverkieselbach.com/2020/05/13/powershell-helpers-to-convert-azure-ad-object-ids-and-sids/

Just a quick update, we worked with the owner team of Windows PowerShell on a fix to this bug. The fix was checked in the Windows branch, and will be available to Win11 and win10 gradually with the new update releases.
With the fix, the cmdlet Get-LocalGroupMember will behave as shown below in the currently failing scenario:

As for those 2 SIDs, they are added by Azure AD:

Every Azure AD joined device contains two SIDs (the Global administrator role and the Device administrator role) that are by default part of the local administrators group.

They don't have account name and other information stored locally (hence the error because the Win32 API LookupAccountSid cannot find them locally), and you have to query Azure AD to get corresponding display name and description for them. Here is an article for how to do that FYI: https://oliverkieselbach.com/2020/05/13/powershell-helpers-to-convert-azure-ad-object-ids-and-sids/

This is good news, and we would expect this to work on ps 5.1 and sccm, etc etc. Imagine it will fine since this is a windows issue, not PS.
Also, sidebar... The account sids there on azure machines arent really very user friendly. Neither is having to add admin accounts via 'net localgroup administrators AzureAD\upn /add'. I understand the technical reasons and how the guid is converted to sid, but its no where near as simple as adding accounts\groups as it is on an on prem bound machine.
So if that is the underlying problem that should likely be looked at and hopefully will be something thats made a bit more robust down the line.

Hi @daxian-dbw
Thanks for the effort, do I see that right you give out the unknown SID as a String instead of an Object in the list?
Would it not be better to give out the SID as an Object in the List, even if the display-name is not there.
It would be simpler to build a workaround later on and request the display-name if needed, not?

Great news. Looking forward to this hitting Windows 10 boxes in my fleet.

Wonderful news!!!!  Thanks to all that got this pushed through and working without barfing all over the place.  Personally think this will make a lot of sys admins happy since we will be able to audit and dump contents of the local groups of machines that are Azure joined now.

@daxian-dbw Any update on that issue? already some months passed ;-)

Why is this closed? It seems to still be an issue

This is a problem caused by orphaned SIDs. If you delete an object that is a group member, the command can't properly retrieve the data, causing the crash.

kind of... it also is broken on Azure machines, its really any GUID not just broken ones for traditional on prem bound machines or orphaned account guids.

It really shouldnt have taken this long to fix this, perhaps they arent rolling out the fix to ps 5.x and only on newer versions of windows/server? They never specified what version of PS and OS would get the fix.

This is a problem caused by orphaned SIDs. If you delete an object that is a group member, the command can't properly retrieve the data, causing the crash.

kind of... it also is broken on Azure machines, its really any GUID not just broken ones for traditional on prem bound machines or orphaned account guids.

Did you try to add a new group member and then delete it from its source (AAD or localmachine) in the affected Azure machines?

This is a problem caused by orphaned SIDs. If you delete an object that is a group member, the command can't properly retrieve the data, causing the crash.

kind of... it also is broken on Azure machines, its really any GUID not just broken ones for traditional on prem bound machines or orphaned account guids.

Did you try to add a new group member and then delete it from its source (AAD or localmachine) in the affected Azure machines?

Local admin groups on azure machines "look like" broken sids.. Even though they really arent, this is another annoyance with how azure joining works. These are not really broken sids they are the built in admin groups that are assigned to all Azure joined work stations.

2023, I still experience this bug. Here's something quick to use the old net localgroup command and convert the output into a PowerShell array:
`#use the old net localgroup command to get members of the local Administrators group, then parse the text output, excluding the built-in Administrator user and Domain Admins group
$LocalAdmins = net localgroup administrators| where {$_ -and $_ -notmatch "command completed successfully" -and $_ -notmatch '^Administrator$' -and $_ -notmatch 'Domain Admins'} | select -skip 4
#Convert the text to an array
$LocalAdmins = $LocalAdmins.Split([Environment]::NewLine) | ? { $_ -ne "" }
#Example of looping through the array
foreach ($user in $LocalAdmins) {
Write-Host "$user is a local admin"
}`

5 years later and this is still an issue, only to find this closed 😅. This effects Azure joined machines due to the SIDs that gets put into local users for managing local admins through Intune.

We are also still having this issue crop up on several of our workstations. I would expect PowerShell to be able to handle it more gracefully.

Yeah i think we have all given up hope of this getting resolved at this point. We ended up coding around the issue.
`$group = [ADSI]"WinNT://$env:COMPUTERNAME/Administrators"
$admins = $group.Invoke('Members') | % {
$path = ([adsi]$_).path
[pscustomobject]@{
Computer = $env:COMPUTERNAME
Domain = $(Split-Path (Split-Path $path) -Leaf)
User = $(Split-Path $path -Leaf)
}
foreach($admin in $admins){
$admin
}
}`

The above will pull all the admins, and they are also iterable. So you can loop over them.

$admins = $group.Invoke('Members') | % {
    $path = ([adsi]$_).path
    [pscustomobject]@{
        Computer = $env:COMPUTERNAME
        Domain = $(Split-Path (Split-Path $path) -Leaf)
        User = $(Split-Path $path -Leaf)
    }

$LocalAdmins = net localgroup administrators| where {$_ -and $_ -notmatch "command completed successfully" -and $_ -notmatch '^Administrator$' -and $_ -notmatch 'Domain Admins'} | select -skip 4
#Convert the text to an array
$LocalAdmins = $LocalAdmins.Split([Environment]::NewLine) | ? { $_ -ne "" }
#Example of looping through the array
foreach ($user in $LocalAdmins) {
Write-Host "$user is a local admin"
}

This is a neat little hack for this, and a bit more succinct than some of the other solutions. There are many work arounds, but no actual fix lol.

Thinking I opened this bug report in 2017, jeez it's been a while. Microsoft isn't paying any attention to this issue. Real bummer. Probably an easy fix too. Love seeing all the workarounds tho. Some creative individuals out there 😁

From: LB @.>
Sent: Friday, March 10, 2023 3:20:38 PM
To: PowerShell/PowerShell @.>
Cc: itisbrendan @.>; Mention @.>
Subject: Re: [PowerShell/PowerShell] Get-LocalGroupMember - Failed to compare two elements in the array. (#2996)
@daxian-dbwhttps://github.com/daxian-dbw can you perhaps comment on when this is expected? I was under the impression this would have been roled into Windows 10/11 in one of the "half" release cycles, should have made its way into 22h2, or perhaps 23h1?
—
Reply to this email directly, view it on GitHubhttps://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1464372057, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGCJ4DNO4KEZ3FUBBSEK2B3W3OEJNANCNFSM4C4ETULQ.
You are receiving this because you were mentioned.Message ID: @.***>

Hey @mgreenegit, have you got any updates from the Windows Servicing Engineering team?

checking

lol , I was shocked to read how old this bug is.... and I'm  still face the same issue

Confirmed the fix has been released. @Iddorot can you share what version of Windows and whether all updates are applied?

@mgreenegit win11 PRO version 10.0.22621 Azure, yes all updates are applied my device is AAD joined device

Epic! Thank you ❤🍀

From: Michael Greene @.>
Sent: Friday, March 17, 2023 8:30:25 AM
To: PowerShell/PowerShell @.>
Cc: itisbrendan @.>; Mention @.>
Subject: Re: [PowerShell/PowerShell] Get-LocalGroupMember - Failed to compare two elements in the array. (#2996)
Confirmed the fix has been released. @Iddorothttps://github.com/Iddorot can you share what version of Windows and whether all updates are applied?
—
Reply to this email directly, view it on GitHubhttps://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1473759892, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGCJ4DIP2QBJ5RGY5ZBU3N3W4RKODANCNFSM4C4ETULQ.
You are receiving this because you were mentioned.Message ID: @.***>

PS C:\WINDOWS\system32> $Error[0] | fl * -force
writeErrorStream      : True
PSMessageDetails      :
Exception             : Microsoft.PowerShell.Commands.Win32InternalException: An unspecified error occurred: error
code = 1789
at
System.Management.Automation.SecurityAccountsManager.Sam.LookupAccountInfo(SecurityIdentifier
sid)
at
System.Management.Automation.SecurityAccountsManager.Sam.d__82.MoveNext()
at System.Collections.Generic.List1..ctor(IEnumerable1 collection)
at
Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumerable`1
membership)
at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          : Users
CategoryInfo          : NotSpecified: (Users:LocalGroup) [Get-LocalGroupMember], Win32InternalException
FullyQualifiedErrorId : Win32Internal,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at , : line 1
PipelineIterationInfo : {20, 20}

Eh, that would have been fixed long ago in #12242. Too bad it was rejected by the MSFT team. Not only would we have fixed the old bugs by now, but we would have rather found a way to port this module to Unix-s.

issue is closed, but i still see this on Microsoft Windows [Version 10.0.22621.1702] in wich build should this be fixed ?

@ConfigMgrRSC it is closed but there is no plans to fix it on the PowerShell end, read the thread.

Adding my voice in case they decide to fix this. I experienced this issue today. Would be great if this would be fixed at some point.

Likely not ever going to be fixed at this point. Some good, creative workarounds from the community tho. 😄

From: Brandon Hurler @.>
Sent: Tuesday, June 13, 2023 9:27:45 AM
To: PowerShell/PowerShell @.>
Cc: itisbrendan @.>; Mention @.>
Subject: Re: [PowerShell/PowerShell] Get-LocalGroupMember - Failed to compare two elements in the array. (#2996)
Adding my voice in case they decide to fix this. I experienced this issue today. Would be great if this would be fixed at some point.
—
Reply to this email directly, view it on GitHubhttps://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1589318590, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AGCJ4DNI3VW3KJVGNAUJWOTXLBTFDANCNFSM4C4ETULQ.
You are receiving this because you were mentioned.Message ID: @.***>

I've read the comments and want to say thanks to the community for workarounds.
I also want to express my frustration with MSFT at their absurd - if predictable - combination of unwillingness to fix a widespread issue, and complete silence on why.
I recommended Office365 and a "cloud-only" approach, and one huge reason was PowerShell.
With bugs like this, and the crude mess that is the Microsoft.Graph PowerShell modules, I will not make that recommendation again.
Too often we cannot deploy scripts which conform to PowerShell coding practices via Intune: it targets Windows PowerShell, the native feature does not support parameters, the Mg cmdlets do not support pipeline.
Rant over.
Based on code from ganlbarone above I've created this function, which I'm sharing here
`
function Get-LocalAdmins {
<#
    .SYNOPSIS
    Compensate for a known, widespread - but inexplicably unfixed - issue in Get-LocalGroupMember.
    Issue here: https://github.com/PowerShell/PowerShell/issues/2996

    .DESCRIPTION
    The script uses ADSI to fetch all members of the local Administrators group.
    MSFT are aware of this issue, but have closed it without a fix, citing no reason.
    It will output the SID of AzureAD objects such as roles, groups and users,
    and any others which cnanot be resolved.
    the AAD principals' SIDS need to be mapped to identities using MS Graph.

    Designed to run from the Intune MDM and thus accepts no parameters.

    .EXAMPLE
    $results = Get-localAdmins
    $results

    The above will store the output of the function in the $results variable, and
    output the results to console

    .OUTPUTS
    System.Management.Automation.PSCustomObject
    Name        MemberType   Definition
    ----        ----------   ----------
    Equals      Method       bool Equals(System.Object obj)
    GetHashCode Method       int GetHashCode()
    GetType     Method       type GetType()
    ToString    Method       string ToString()
    Computer    NoteProperty string Computer=Workstation1
    Domain      NoteProperty System.String Domain=Contoso
    User        NoteProperty System.String User=Administrator
#>

[CmdletBinding()]

$group = [ADSI]"WinNT://$env:COMPUTERNAME/Administrators"
    $admins = $group.Invoke('Members') | ForEach-Object {
        $path = ([adsi]$_).path
        [pscustomobject]@{
            Computer = $env:COMPUTERNAME
            Domain = $(Split-Path (Split-Path $path) -Leaf)
            User = $(Split-Path $path -Leaf)
        }
    }
return $admins

}`

@StevieLamb i like your solution, i just updated your code to consider region specific names if OS is not installed en ;)
`
function Get-LocalAdmins {
<#
.SYNOPSIS
Compensate for a known, widespread - but inexplicably unfixed - issue in Get-LocalGroupMember.
Issue here: https://github.com/PowerShell/PowerShell/issues/2996
    .DESCRIPTION
    The script uses ADSI to fetch all members of the local Administrators group.
    MSFT are aware of this issue, but have closed it without a fix, citing no reason.
    It will output the SID of AzureAD objects such as roles, groups and users,
    and any others which cnanot be resolved.
    the AAD principals' SIDS need to be mapped to identities using MS Graph.

    Designed to run from the Intune MDM and thus accepts no parameters.

    .EXAMPLE
    $results = Get-localAdmins
    $results

    The above will store the output of the function in the $results variable, and
    output the results to console

    .OUTPUTS
    System.Management.Automation.PSCustomObject
    Name        MemberType   Definition
    ----        ----------   ----------
    Equals      Method       bool Equals(System.Object obj)
    GetHashCode Method       int GetHashCode()
    GetType     Method       type GetType()
    ToString    Method       string ToString()
    Computer    NoteProperty string Computer=Workstation1
    Domain      NoteProperty System.String Domain=Contoso
    User        NoteProperty System.String User=Administrator
#>

[CmdletBinding()]

$GroupSID='S-1-5-32-544'
[string]$Groupname = (get-localgroup -SID $GroupSID)[0].Name

#$group = [ADSI]"WinNT://$env:COMPUTERNAME/Administrators"
$group = [ADSI]"WinNT://$env:COMPUTERNAME/$Groupname"
    $admins = $group.Invoke('Members') | ForEach-Object {
        $path = ([adsi]$_).path
        [pscustomobject]@{
            Computer = $env:COMPUTERNAME
            Domain = $(Split-Path (Split-Path $path) -Leaf)
            User = $(Split-Path $path -Leaf)
        }
    }
return $admins

}
`

@ConfigMgrRSC an excellent addition IMHO, much appreciated

@StevieLamb  Appreciate the candid feedback.  I was the person that started the Microsoft Graph PowerShell effort a number of years ago.  A number of unfortunate circumstances have prevented us from enabling pipelining in cmdlets without an intermediate steps, for far too long.  However, we believe we have removed those blocking issues and pipelining is something that we are going to try and improve this semester.
If there are specific pipelining scenarios that you wish were supported that would be valuable feedback for us.

@StevieLamb Appreciate the candid feedback. I was the person that started the Microsoft Graph PowerShell effort a number of years ago. A number of unfortunate circumstances have prevented us from enabling pipelining in cmdlets without an intermediate steps, for far too long. However, we believe we have removed those blocking issues and pipelining is something that we are going to try and improve this semester.
If there are specific pipelining scenarios that you wish were supported that would be valuable feedback for us.

Firstly, you do your company great credit by owning this issue, my sincere thanks.
Secondly, that is great news regarding pipelining.
For my part?
Get-MgUser and Get-MgDevice should accept pipeline input for their UserId and DeviceId parameters, to support the classic scenarios where the person running the script has created a Collection/array of such objects. The goal would be to adequately support a pipeline where we say
$collection | ForEach-Object {
    Get-MgUser
    # do subsequent work
    }

I think the objects returned by Get-MgUser and Get-MgDevice should be accepted as an input object by cmdlets which get specific information about such objects.
For example
Get-MgUser -UserId<EMAIL_ADDRESS>| GetMgUserManager
This would allow us to neatly expand on the original example:
$collection | ForEach-Object {
    Get-MgUser
    $UserUPN = $_.userPrincipalName
    # this line may need correction, didn't have time to verify syntax right now, sorry
    $UserManagerUPN = Get-MgUserManager | select-object -expandproperty userPrincipalName
    $userData = [pscustomobject]@{
                    Username = $UserUPN
                    Department = $_.department
                    Manager = $UserManagerUPN
                }
    $allUserData += $userData
}

I wonder if you would consider enacting a poll on a suitable platform (TBD by MSFT) - to allow you to shortlist some initial proposals based on community feedback?
If so, you might also wish to consider publicising it via forums such as the r/PowerShell subreddit.
I look forward to enjoying the fruits of your labour :)

Just running across this and ended up here.  Not fantastic at PS, is there a way to pipe these results straight into something like remove-localgroupmember (even if it's an azure/domain/whatever user) so the group ends up empty?

Just running across this and ended up here. Not fantastic at PS, is there a way to pipe these results straight into something like remove-localgroupmember (even if it's an azure/domain/whatever user) so the group ends up empty?

#use the old net localgroup command to get members of the local Administrators group, then parse the text output, excluding the built-in Administrator user and Domain Admins group
$LocalAdmins = net localgroup administrators| where {$_ -and $_ -notmatch "command completed successfully" -and $_ -notmatch '^Administrator$' -and $_ -notmatch 'Domain Admins'} | select -skip 4

I'll give this a run. I do want to remove the built in admin (or disable it but that's easy) and the domain admins group if it exists, a full nuke, so i'll try different variations.  Can i ask what the -skip 4 does?

Just running across this and ended up here. Not fantastic at PS, is there a way to pipe these results straight into something like remove-localgroupmember (even if it's an azure/domain/whatever user) so the group ends up empty?

I'd recommend against scripting that element, because better options exist, it'll only work that way as long as nothing else gets broken by incomplete regression testing, and (this one personal) I don't like scripts which mix PowerShell and batch programming.
Use Group Policy's Restricted Groups feature if you're in an AD DS environment (a.k.a. "on-premise AD"):
https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/description-of-group-policy-restricted-groups
If using Intune to manage devices in a pure Azure AD directory environment (no on-premise AD), instead use the option under Endpoint security >> Account protection which does the same thing as the Restricted Groups.
https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207

I'd recommend against scripting that element, because better options exist, it'll only work that way as long as nothing else gets broken by incomplete regression testing, and (this one personal) I don't like scripts which mix PowerShell and batch programming.
Use Group Policy's Restricted Groups feature if you're in an AD DS environment (a.k.a. "on-premise AD"): https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/description-of-group-policy-restricted-groups
If using Intune to manage devices in a pure Azure AD directory environment (no on-premise AD), instead use the option under Endpoint security >> Account protection which does the same thing as the Restricted Groups. https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207

**Description of group policy restricted groups - Windows Server**This article gives a description of group policy restricted groups.

<img alt="" width="48"

Understood but i'm looking for a nuke and pave solution for multiple environments where there may or may not be a local domain, azure/intune in place. Users in the group may be local, domain, azure, or groups and any or all may or may not still exist (and be orphaned with just SIDs).  So, looking to make something heavy handed we can deploy to be sure there are no local admins and then we can organize and bring them up to a baseline if required.

WTF Microsoft. Can you please fix this blatant issue? It has been so long already

Just running across this and ended up here. Not fantastic at PS, is there a way to pipe these results straight into something like remove-localgroupmember (even if it's an azure/domain/whatever user) so the group ends up empty?

#use the old net localgroup command to get members of the local Administrators group, then parse the text output, excluding the built-in Administrator user and Domain Admins group
$LocalAdmins = net localgroup administrators| where {$_ -and $_ -notmatch "command completed successfully" -and $_ -notmatch '^Administrator$' -and $_ -notmatch 'Domain Admins'} | select -skip 4

I'll give this a run. I do want to remove the built in admin (or disable it but that's easy) and the domain admins group if it exists, a full nuke, so i'll try different variations. Can i ask what the -skip 4 does?

well this one does not recognize localisation of the administrators group - personally i wrote a function to clean out all except the local admin and testet this in onprem and AAD only environment ( not hybrid) to cleanup. basically i agree, dont like to mix up several techniques and try to be powershell only, but in this case this was the only solution for me..
function clean-LocalgroupTargetSID{
<#
.SYNOPSIS
cleanout local group except localAdministrator, default group SID is S-1-5-32-544

.DESCRIPTION
use ADSI for getting group members because of bug in get-localgroupmember "get-LocalGroupMember : Failed to compare two elements in the array" if there is any kind of SID in group
# https://github.com/PowerShell/PowerShell/issues/2996

# https://www.petervanderwoude.nl/post/remediating-local-administrators-with-proactive-remediations/
# https://superuser.com/questions/1131901/get-localgroupmember-generates-error-for-administrators-group/1205981#1205981

.PARAMETER GroupSID
The local SID of Targetgroup to cleanup
#>

    param([String] $GroupSID='S-1-5-32-544')

    #https://blog.iisreset.me/identifying-well-known-security-principals-with-confidence/
    # find localized localadmin account via well knownSID
    [string]$localizedadmincaption = (Get-WmiObject -Query "SELECT * FROM Win32_UserAccount WHERE LocalAccount = 'True'"|Where-Object -Property SID -Like "S-1-5-21-*-500").caption
    Log -LogFile $LogFile "Administrator caption is $localizedadmincaption"

    #get groupname for ADSI
    [string]$Groupname = (get-localgroup -SID $GroupSID)[0].Name
    Log -LogFile $LogFile "Administratorsgroup Name is $Groupname"

    #get members of group via ADSI
    $administrators = $null
    $administrators = @(
        ([ADSI]"WinNT://./$Groupname").psbase.Invoke('Members') |ForEach-Object {
            $_.GetType().InvokeMember('AdsPath','GetProperty',$null,$($_),$null)
            }
        ) -match '^WinNT';

    # string conversions
    $administrators = $administrators -replace "WinNT://",""
    $administrators = $administrators -replace "/","\"

    Log -LogFile $LogFile "start adsi removal $($administrators.count)"
    # remove every member except local Administrator
    $administrators |ForEach-Object{

        if ($_ -ne $localizedadmincaption){

            try{
                    Remove-LocalGroupMember -SID $GroupSID -Member $_ -erroraction Stop
                    Log -LogFile $LogFile "Successfully removed $_ from $Groupname ($LocalgroupTargetSID)"
            }catch{
                    Log -LogFile $LogFile -ErrorMessage "Remove-LocalGroupMember of $_ failed $($Error[0])"
                }

        }else{
            Log -LogFile $LogFile "skip because local admin $env:COMPUTERNAME\Administrator"
        }
    }

    # should be readable now because SIDs are already cleared
    $administrators = $null
    $administrators = get-LocalGroupMember -SID $GroupSID -ErrorAction Stop

    if ($administrators.Count -gt 1){

        Log -LogFile $LogFile "start get-LocalGroupMember removal $($administrators.count)"
        $administrators |ForEach-Object{

            if ($_.Name -ne $localizedadmincaption){

                try{
                        Remove-LocalGroupMember -SID $GroupSID -Member $_ -ErrorAction Stop
                        Log -LogFile $LogFile "Successfully removed $_ from $Groupname ($LocalgroupTargetSID)"
                }catch{
                        Log -LogFile $LogFile -ErrorMessage "Remove-LocalGroupMember of $_ failed $($Error[0])"
                    }

            }else{
                Log -LogFile $LogFile "skip because local admin $env:COMPUTERNAME\Administrator"
            }
        }
    }else{
        Log -LogFile $LogFile "Local group count ($GroupSID) is $($administrators.Count)"
    }
}

Error is still present on a fresh Win11 joined to a Domain once and never revert to workgroup.
PS C:\Users\xxxxxxxxxxx> [System.Environment]::OSVersion.Version

Major  Minor  Build  Revision
-----  -----  -----  --------
10     0      22621  0

PS C:\Users\xxxxxxxxxxx> Get-LocalGroupMember -Group 'Administrators'
Get-LocalGroupMember: Failed to compare two elements in the array.
PS C:\Users\xxxxxxxxxxx> $Error[0] | fl * -force

PSMessageDetails      :
Exception             : System.InvalidOperationException: Failed to compare two elements in the array.
                         ---> System.NullReferenceException: Object reference not set to an instance of an object.
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.<>c.<ProcessesMembership>b__20_0(LocalPrincipal p1, LocalPrincipal p2)
                           at System.Collections.Generic.ArraySortHelper`1.InsertionSort(Span`1 keys, Comparison`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.IntroSort(Span`1 keys, Int32 depthLimit, Comparison`1 comparer)
                           at System.Collections.Generic.ArraySortHelper`1.Sort(Span`1 keys, Comparison`1 comparer)
                           --- End of inner exception stack trace ---
                           at System.Collections.Generic.ArraySortHelper`1.Sort(Span`1 keys, Comparison`1 comparer)
                           at System.Collections.Generic.List`1.Sort(Comparison`1 comparison)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessesMembership(IEnumerable`1 membership)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessGroup(LocalGroup group)
                           at Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand.ProcessRecord()
TargetObject          :
CategoryInfo          : NotSpecified: (:) [Get-LocalGroupMember], InvalidOperationException
FullyQualifiedErrorId : An unspecified error occurred.,Microsoft.PowerShell.Commands.GetLocalGroupMemberCommand
ErrorDetails          :
InvocationInfo        : System.Management.Automation.InvocationInfo
ScriptStackTrace      : at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo : {0, 1}

I can't believe it's been almost 7 full years since this was opened, a fix was identified and rejected, and Microsoft still can't be bothered to acknowledge it. Maybe we should start a campaign to submit this thread URL to Jeff Snover and see if he can get a set of eyes on it.

My workaround to this problem was shifting career out of the Windows ecosystem.

Snover is working for Google now.
On Tue, Nov 7, 2023, 6:57 AM GoodThings2Life @.***>
wrote:

I can't believe it's been almost 7 full years since this was opened, a fix
was identified and rejected, and Microsoft still can't be bothered to
acknowledge it. Maybe we should start a campaign to submit this thread URL
to Jeff Snover and see if he can get a set of eyes on it.
—
Reply to this email directly, view it on GitHub
https://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1798774719,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABRNERN6RRPC5PSC25KHXATYDJD4NAVCNFSM4C4ETUL2U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCNZZHA3TONBXGE4Q
.
You are receiving this because you commented.Message ID:
@.***>

This is still issue ! Scenario is little different ( domain membeserver has domain objects in local Admin group, but those domain objects are deleted, so they are not resolved and SID is dispalyed in GUI) . PS fails miserably with same error.

I think there is a growing issue with hybrid environments as well. I have cloud objects with orphaned SID owners.
Michael J. Martinez Jr.
MBA, CISSP, CEH
@.***
@.***
Cell:<PHONE_NUMBER>
http://linkedin.com/in/texasit

From: AndresPae @.>
Sent: Thursday, December 14, 2023 1:49:02 AM
To: PowerShell/PowerShell @.>
Cc: Keybonesabi @.>; Comment @.>
Subject: Re: [PowerShell/PowerShell] Get-LocalGroupMember - Failed to compare two elements in the array. (#2996)
This is still issue ! Scenario is little different ( domain membeserver has domain objects in local Admin group, but those domain objects are deleted, so they are not resolved and SID is dispalyed in GUI) . PS fails miserably with same error.
—
Reply to this email directly, view it on GitHubhttps://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1855342179, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMK42GRCTEKXD22RG4H2TVTYJKVO5AVCNFSM4C4ETUL2U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBVGUZTIMRRG44Q.
You are receiving this because you commented.Message ID: @.***>

Ridonkulous that this has been a known problem for so long.  I experienced it with Win 11 and a server that always been joined to our main domain (likely because it had admin members from a trusted domain that's no longer present).  There's no good reason for the command to fail completely in scenarios like this.

Is Microsoft even listening to this thread??
Get Outlook for Androidhttps://aka.ms/AAb9ysg

From: Jesse Litton @.>
Sent: Saturday, December 16, 2023 5:49:38 PM
To: PowerShell/PowerShell @.>
Cc: itsBrendan @.>; Comment @.>
Subject: Re: [PowerShell/PowerShell] Get-LocalGroupMember - Failed to compare two elements in the array. (#2996)
Ridonkulous that this has been a known problem for so long. I experienced it with Win 11 and a server that always been joined to our main domain (likely because it had admin members from a trusted domain that's no longer present). There's no good reason for the command to fail completely in scenarios like this.
—
Reply to this email directly, view it on GitHubhttps://github.com/PowerShell/PowerShell/issues/2996#issuecomment-1858960040, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AHOVIRZTVSWTMVFXNZQUICTYJYQQFAVCNFSM4C4ETUL2U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBVHA4TMMBQGQYA.
You are receiving this because you commented.Message ID: @.***>

Attempted to use this in Win11Pro to verify that my script is working properly but it still returns the same error.

If anyone is looking for a workaround where getting an array of usernames is the goal and are fine with the old "net localgroup administrators", keeping in mind that this won't provide you with the user object, here are a couple of implementations:
Get all users in the group:
$(net localgroup administrators) | Where-Object { -not ($_ -match '^-+$|^The command completed successfully.$|^Members$|^Alias name\s+administrators$|^Comment\s+Administrators have complete and unrestricted access to the computer/domain$|^$') -and $_.Trim() -ne '' }
Get all users minus a few matching a regex filter, adding pipe | separated usernames (e.g, "Administrator") or more complex filters (e.g, ".*Domain Admins"):
$(net localgroup administrators) | Where-Object { -not ($_ -match 'Administrator|.*Domain Admins|^-+$|^The command completed successfully.$|^Members$|^Alias name\s+administrators$|^Comment\s+Administrators have complete and unrestricted access to the computer/domain$|^$') -and $_.Trim() -ne '' }

I was able to make an workaround for this issue because it's still exists in:
OSVersion                     : 2009
OSEdition                     : Microsoft Windows 11 Enterprise
OSBuild                       : 22621.3007
CurrentInstalledUpdate        : January 9, 2024 - KB5034123 (OS Builds 22621.3007 and 22631.3007)

There is an .NET method WindowsIdentity.GetCurrent Method
function CheckGroupMembership {
    param([string]$groupName)

    $id = [Security.Principal.WindowsIdentity]::GetCurrent()
    $groups = $id.Groups | foreach-object {$_.Translate([Security.Principal.NTAccount])}

    $isMember = ($groups.Value | Where-Object { $_.Split('\')[-1] -eq $groupName } | Measure-Object).Count -gt 0

    if ($isMember) {
        Write-Host "User: `"$($id.Name)`" is a member of a group ending with `"$groupName`"."
    } else {
        Write-Host "User: `"$($id.Name)`" is not a member of any group ending with `"$groupName`"."
    }
}

CheckGroupMembership -groupName "Administrators"

Examples:

if anyone is still getting this, i found that if an unknown/deleted user exists in the queried group, the command fails. you need to remove the SID of the unknown / non existing user from the group. this resolved the issue for me.

Yes.  I gave up on it and had to go with ADSI instead.  I've got thousands of servers with plenty of deleted accounts from retired employees and former contractors that the owners put in local groups over the last 20 years (trying to clean that up separately; I needed something that works now).

Why was this closed?
This issue is still present.

The bug was fixed in PowerShell 7.4+ compatible (unofficial) version of the Microsoft.PowerShell.LocalAccounts module
https://github.com/iSazonov/LocalAccounts-MS/tree/v7.0.0-Release.1

Fixed in community module https://www.powershellgallery.com/packages/LocalAccounts

I've experienced this a few times.  Each time it's been due to a deleted account being part of the group in question.  Obviously, that shouldn't generate this issue, but in my case it does.
In Computer Management, I went in to the group, and in the Membership tab, there was a SID.  I simply removed the SID.


[fix][tests] Fix flaky test V1_ProxyAuthenticationTest.anonymousSocketTest

Fixes #17933
Motivation
V1_ProxyAuthenticationTest.anonymousSocketTest is flaky.
Modifications

fix thread safety issues with SimpleConsumerSocket and SimpleProducerSocket

Documentation

[ ] doc
[ ] doc-required
[x] doc-not-needed
[ ] doc-complete

Matching PR in forked repository
PR in forked repository: https://github.com/lhotari/pulsar/pull/96

another: https://github.com/apache/pulsar/actions/runs/3217598688/jobs/5262602494


Python 3 + pylint fixes

Having a separate python3 branch was going to / got messy.
This PR has python3 changes (mostly cosmetic, maybe a few more unneeded objects created in some py2 operations) and pylint changes (caps in testing constants).
Supersedes #206.

@whoburg, if this looks good I'll merge it with master by hand.

In this branch the unit test sometimes all succeed; python 3 has randomized dictionary ordering, which screws with our tests quite a bit (though it doesn't hurt our actual functionality). The only solver curently supported in python3 is mosek_cli.

Before merging:
[ ] Added inline comments to address
[ ] Please try to merge the two commits 6feb52522475a2f064aa80169b8369cf27d8eb1d and 16719cb29c686154b30169cbf85830f3de4b58e4 currently living on the "cosmetics" branch (sorry for not having turned this into a pull request yet). Not sure on the best way here -- either merging those into this, or merging those into master first...
[ ] Unit tests should all pass on 2.7 (understood there are still issues with unit tests on python3)


latest tagged version (0.15.0) makes use of lambda runtime nodejs14.x, which is deprecated.

What
Update latest released/tagged version to not use lambda runtime nodejs14.x, as that version is deprecated.
Why
Runtime no longer supported by AWS, making it impossible to provision a new superwerker setup.

I also add to this interesting point the End of Life of Python 3.7 since June 27, 2023.
It is recommended to update the version to python 3.11.
I do not know if this is a blocker for new provision.


Provide autocompletion for environment variables in tox.ini files

Problem
tox.ini files in larger projects can grow quite large and contain many variables from various sources. In order to ease the development of tox environments a preview feature for environment variables in tox would be helpful.
Solution

Show previews for environment variables in tox.ini files for passenv and setenv variables.
Variables could be assigned directly in a section (environment) or in the inherited section testenv which can be reused by all other sections (environments).
passenv variables are read from the current environment.
setenv variables are assigned either directly inside the tox.ini file or indirectly referenced from an external .env file.

Implemented in #20


build wheels for patched Torch releases

🚀 Feature
Please consider publishing builds also for patched PyTorch releases on https://pytorch-geometric.com/whl/

1.7.1
1.8.1

see PT releases: https://pypi.org/project/torch/#history
Motivation
it is great to be able to use build wheels to speed up installation, but these limitations to initial feature releases limit uses fixed Torch versions
Additional context

You can use the PyTorch 1.*.0 wheels for the patch releases as well, see here.


Update README to fix incorrect example

I struggled with this example for a few hours, and then realized that the example doesn't return an error in the callback function, which prevents the request from failing properly in the case where there's no whitelist match. I've updated it in the simplest way possible to make it work.

published as 2.7.2


Wallet passphrases are sended as plain text

My proposal it to introduce a secret session phrase and share it between wallet and connector.
Connector can take it from a file restricted with -rw------- (400) together with KDF (key-derivation function) details.
For every eth_sendTransaction request we can use X-Session-Key header to encrypt digest of message together with wallet's passphrase: initialization vector (16 bytes) | encrypted text | hmac (32 bytes).
Should fix security hole introduced by #42.

Receive session key - session_phrase =KDF> session_key (32 bytes)
Calculate request params hash - json_params =keccak256> json_hash
Verify data integrity & authentification - (json_hash, session_text, session_key) =keccak256> hmac
Decrypt wallet passphrase - session_text =aes-128-ctr> account_passphrase

This proporsal has drawbacks - multiple cycles for encryption and decryption, it can bee three times slowly compared to just send passphrase as plain text.

connector can publish own Public Key to send sensitive data to it

or better not to reinvent the wheel and take something like Salted Challenge Response HTTP Authentication Mechanism

As another alternative - AWS Signature Version 4.

We will integrate emerald-rs into wallet directly via ffi, not needed any more.


add tombstoneFormatVersionSize & tombstonesCRCSize constants

Signed-off-by: chenlujjj<EMAIL_ADDRESS>

Merging this despite the unrelated windows test failure. Fix for that is in progress.


Create Issue template and Contribution, update readme

Add Authentication, contribution section in the readme
In the contribution add the required point and what should be the issue template.

Git Issues:

https://github.ibm.com/bluemix-mobile-services/bmd-project-push/issues/6958
https://github.ibm.com/bluemix-mobile-services/bmd-project-push/issues/6960
https://github.ibm.com/bluemix-mobile-services/bmd-project-push/issues/6961

Merging to development.


System color mode doesn't react to changes

Description
When you set useSystemColorMode to true, if you start the app, it does use the system color mode as the initial theme but once you toggle the system color mode, it doesn't react to those changes. You gotta quit and re-open the app in order for it to work.
CodeSandbox/Snack link
N/A
Steps to reproduce

Enable useSystemColorMode on your config
Start your app
Toggle the system appearance

NativeBase Version
3.4.13
Platform

[X] Android
[ ] CRA
[X] Expo
[X] iOS
[ ] Next

Other Platform
No response
Additional Information
No response

Hi @focux, can you provide a snack link?

Hi @Rutger, Can you provide a snack link?

Hi @Rutger, Can you provide a snack link?

Sure! I've added a Snack link to my original issue: https://github.com/GeekyAnts/NativeBase/issues/5260#issuecomment-1222439062


Minor fixes in user groups UI and streams UI.

First commit is to fix the table header column when users list is empty - https://github.com/zulip/zulip/pull/27912#issuecomment-1828341257
Second commit is to hide "+" button if user is not allowed to create groups.
Third commit is to remove the green banner shown on user group creation.

Screenshots and screen captures:

Self-review checklist

[ ] Self-reviewed the changes for clarity and maintainability
(variable names, code reuse, readability, etc.).

Communicate decisions, questions, and potential concerns.

[ ] Explains differences from previous plans (e.g., issue description).
[ ] Highlights technical choices and bugs encountered.
[ ] Calls out remaining decisions and concerns.
[ ] Automated tests verify logic where appropriate.

Individual commits are ready for review (see commit discipline).

[ ] Each commit is a coherent idea.
[ ] Commit message(s) explain reasoning and motivation for changes.

Completed manual review and testing of the following:

[ ] Visual appearance of the changes.
[ ] Responsiveness and internationalization.
[ ] Strings and tooltips.
[ ] End-to-end functionality of buttons, interactions and flows.
[ ] Corner cases, error conditions, and easily imagined bugs.

Added a commit to fix "Who can access all users in this organization" setting in dark mode.
Dropdown in dark mode

Disabled dropdown in dark mode


[pilot] ReconcileStatuses: fix iterator range issue

Signed-off-by: Gaurav Singh<EMAIL_ADDRESS>Go uses the same address variable while iterating in a range, so use a copy when using its address, otherwise we end up using the last value for all iterations.
[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[X ] Developer Infrastructure

Hi @gaurav1086. Thanks for your PR.
I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@gaurav1086: The following test failed, say /retest to rerun all failed tests:

Test name
Commit
Details
Rerun command

release-notes_istio
9e9dfe1b3a1edf9c1bfbf8456abd3a59a56b14d4
link
/test release-notes_istio

Instructions for interacting with me using PR comments are available here.  If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.


Failed to login to EWS

It seems that I can connect to EWS with viewpoint.
Doing various tests, I always end upwith the same error
Failed to login to EWS at https://mail.mycompany.com/EWS/Exchange.asmx. Please check your credentials.
I tried the username and password with OWA and accessing https://mail.mycompany.com/EWS/Exchange.asmx by HTTP and it does work. But I can get around connecting to EWS with Viewpoint.
Any idea what could cause the problem ?
Rails version is 2.3.8 with ruby 1.8.7

Please try using this NTLM gem instead: https://github.com/wimm/rubyntlm.git

Hello,
How do I do that ?
Note : I already have the gem rubyntlm (0.1.1) installed

git clone https://github.com/wimm/rubyntlm.git
cd rubyntlm
gem build rubyntlm.gemspec
gem install rubyntlm-0.1.2.gem

Did that work for you?

Sorry, I did not had the opportunity to try yet.
BTW, if I understand correctly, I have to compile locally the rubyntlm gem and install - Am i correct ?

It's not really a compile in the classical sense of the term. It's really just packaging it for installation, but yes you are correct.

Ok, It tried with the rubyntlm gem and it seems I can connect to the server.
Now I'll have to find out how to retrieve calendar items :-D
Thanks for your help,

Glad you got authentication working. Here's a little something to get you going on the calendar items...
cal  = Viewpoint::EWS::CalendarFolder.get_folder(:calendar)
items = cal.todays_items
# or
items = cal.items_since(DateTime.parse('some date'))
# or
items = cal.items_between(DateTime.parse('some start date'), DateTime.parse('some end date'))

Thanks - I had this (and some other things) figured looking at test spec and the model files :-D
By the way, I think todays_itemha san issue when the date format is localized. I'll try to give further investigation into this and report an issue if necessary.
Thanks gain for your help and this great gem.


expose current loop state

This patch exposes the current loop state as loop.state. I find myself repeatedly needing to read the loop state in many circumstances, so I usually create a state variable, but then I need to keep the loop state in sync with that variable and I need to pass around both objects all over the place. One recent example is to get browserify-hmr working well with main-loop, I need to trigger a loop update with the current state unchanged. With this patch loop.update(loop.state) will do the trick.
One caveat is that people might try writing to this value instead of calling loop.update() but I added a note to the docs to say not to do that.
If nothing else, you can cherry-pick 0b534b5 to get more API docs without the other state-exposing changes.

One caveat is that people might try writing to this value instead of calling loop.update() but I added a note to the docs to say not to do that.

we could use object.{freeze,unfreeze} if available to help preventing this

Patch looks good. Agree with julian: .freeze() could be reasonable to enforce values to be read-only. Alternatively a getter could perhaps work?
var state = initialState
var loop = {
  target: target,
  update: update
}

Object.defineProperty(loop, 'state', {
  get: function () { return state }
})

return loop

lgtm as is.

Note:

Object.freeze is too opinionated; we don't own the state and we cant freeze it.
ES5 getter's add complexity and performance penalties that are not worth it. We should trust users to not do bad things.

Published v3.2.0

Can we avoid currentState variable, then?


chore: Add Snyk to ADOPTERS.md

o/ This patch adds Snyk as an adopter; we're using Backstage via Roadie's SaaS platform
Signed-off-by: Rob Cresswell<EMAIL_ADDRESS>

I've not included the whitespace the previous adopters had; please let me know if this is required. I couldn't understand why it was needed (markdown doesn't care) and the wrapping was annoying

Hey! So nice to have you here - you'll unfortunately have to DCO sign the commit though! See the check details

@freben Sorry about that!  My bad

That sorted it. We'll merge in a bit, waiting for a release flow to finish first.


add file wordpress.yml

The 2 changes requested are done; however, as we talked, the use of the variables as user input, will be an improvement when available.


Demo Setup

Hi,
Is there a special reason why you shut down the demo setup?
Can I assist you with resources?
Or is it possible to get an export/backup of the demo prometheus database?
Otherwise I will loose all the historical data.
Thanks JO

Hi! I do have a backup, send me a private mail and I will provide you with a download link.

Mail sent. Thanks :)


Update README.md

Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

AWS CodeBuild CI Report

CodeBuild project: codebuildgithubautobuildPro-sdNVS2x9cuir
Commit ID: c27ef1da31176c84cd5f6e40d314b30eb6482e8f
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

AWS CodeBuild CI Report

CodeBuild project: codebuildgithubautobuildPro-ZQrYvg1Wv7BG
Commit ID: c27ef1da31176c84cd5f6e40d314b30eb6482e8f
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

AWS CodeBuild CI Report

CodeBuild project: codebuildgithubautobuildPro-HHah0H4kRcJ1
Commit ID: c27ef1da31176c84cd5f6e40d314b30eb6482e8f
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository


Error: "password authentication failed for user admin"

Rasa version: 1.8.1
Rasa X version: 0.26.1
Python version: 3.6
Operating system (windows, osx, ...): Ubuntu 18
Issue:
I installed Rasa X on my new VM with Ubuntu 18, followed all the steps for the Quick Docker Installation, but when it comes to creating a user I get an error with my db credentials. If I run sudo docker-compose up I can see that the error is the one I put below.
However, I did nothing but following the steps in the guide which are:
$ curl -sSL -o install.sh https://storage.googleapis.com/rasa-x-releases/0.26.1/install.sh
$ sudo bash ./install.sh
$ cd /etc/rasa
$ sudo docker-compose up -d
$ sudo python rasa_x_commands.py create --update admin me
Error (including full traceback):
db_1               | INFO  ==> ** Starting PostgreSQL setup **
db_1               | INFO  ==> Validating settings in POSTGRESQL_* env vars..
db_1               | INFO  ==> Initializing PostgreSQL database...
db_1               | INFO  ==> postgresql.conf file not detected. Generating it...
db_1               | INFO  ==> pg_hba.conf file not detected. Generating it...
db_1               | INFO  ==> Deploying PostgreSQL with persisted data...
db_1               | INFO  ==> Configuring replication parameters
db_1               | INFO  ==> Configuring fsync
db_1               | INFO  ==> Loading custom scripts...
db_1               | INFO  ==> Enabling remote connections
db_1               | INFO  ==> Stopping PostgreSQL...
db_1               |
db_1               | INFO  ==> ** PostgreSQL setup finished! **
db_1               | INFO  ==> ** Starting PostgreSQL **
db_1               | 2020-03-16 10:43:51.559 GMT [1] LOG:  listening on IPv4 address "<IP_ADDRESS>", port 5432
db_1               | 2020-03-16 10:43:51.559 GMT [1] LOG:  listening on IPv6 address "::", port 5432
db_1               | 2020-03-16 10:43:51.561 GMT [1] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"
db_1               | 2020-03-16 10:43:51.581 GMT [151] LOG:  database system was shut down at 2020-03-15 19:12:19 GMT
db_1               | 2020-03-16 10:43:51.590 GMT [1] LOG:  database system is ready to accept connections
db_1               | 2020-03-16 10:43:58.922 GMT [158] FATAL:  password authentication failed for user "admin"
db_1               | 2020-03-16 10:43:58.922 GMT [158] DETAIL:  Password does not match for user "admin".
db_1               |    Connection matched pg_hba.conf line 1: "host     all             all             <IP_ADDRESS>/0               md5"
db_1               | 2020-03-16 10:43:59.169 GMT [159] FATAL:  password authentication failed for user "admin"
db_1               | 2020-03-16 10:43:59.169 GMT [159] DETAIL:  Password does not match for user "admin".
db_1               |    Connection matched pg_hba.conf line 1: "host     all             all             <IP_ADDRESS>/0               md5"
duckling_1         | no port specified, defaulting to port 8000
duckling_1         | Listening on http://<IP_ADDRESS>:8000

Command or request that led to error:
sudo docker-compose up

Thanks for the issue, @wochinge will get back to you about it soon!
You may find help in the docs and the forum, too 🤗

@tiz-lab Rasa X does not support multiple users besides from the user me. Rasa Enterprise can handle multiple users.
So what your command should look like: sudo python rasa_x_commands.py create --update admin me <your password>.
However, it seems that Rasa X can't access your database. What's the output of docker-compose logs rasa-x?

@wochinge I'm facing to the same issue, and this is RasaX that  can't access to the database, docker-compose logs rasa-x returns :
FATAL:  password authentication failed for user "admin"

@PaulContremoulin Does the database password contain any weird characters (quotes, spaces)?

No, password contains only alphabetic characters. I'm trying to launch the docker-compose on Windows, It's can be related to the issue ?

I'm trying to launch the docker-compose on Windows, It's can be related to the issue ?

mhm, could be 🤔
Does this guide help? https://forum.rasa.com/t/tool-guide-unofficial-rasax-quick-install-script-for-a-pure-windows-machine/25938

I also faced this issue with docker-compose on Windows 10. The root cause in my case was not deleting db-volume from docker container.
On Day 1 : I created docker containers with Rasa 2 docker-compose files.
On Day 2 : I deleted all images and containers from Docker Dashboard but did not delete db-volume. I used a new .env file with fresh generated paswords.
Then i started seeing this error in logs
 File "/usr/local/lib/python3.7/site-packages/psycopg2/__init__.py", line 127, in connect
conn = _connect(dsn, connection_factory=connection_factory, **kwasync)
sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) FATAL: password authentication failed for user "admin"
(Background on this error at: http://sqlalche.me/e/13/e3q8)

Solution : I had to delete db-volume from docker along with db container and run docker-compose. This rebuild the db container with new password.
Saw this thread during google search hence adding my solution to help others.

On Day 2 : I deleted all images and containers from Docker Dashboard but did not delete db-volume. I used a new .env file wi

I tried your method: I deleted db-volume and db container but it didn't help. Is there any extra steps? Or maybe can you explain with more details so I can see what did I do wrong?

@chupachupbum Can you please create a new issue or ask in the forum?


Please update Android example with notification body

This is what worked for me - receive on device
playload => #{
registration_ids => [<<"your_id">>],
priority => <<"high">>,
notification => #{
title => <<"Your turn">>,
body => <<"Your turn">>
}
Please update the Readme with the notification key.
Thank you for this library, it is very helpful :)

This is not a issue. The example in README also work for Android, was retested. Playload can be different. I'm glad you found this library useful. Cheers!

Ok thanks - I understand now - including the notification key is not required for the device to receive it BUT it must be there to show to user.

Ok thanks - I understand now - including the notification key is not required for the device to receive it BUT it must be there to show to user.

Right.


More flexible support for endpoints

[ ] Support multiple --endpoint arguments and add them all to generated DIDDocs
[ ] Support a --hostname parameter and automatically derive endpoint(s) based on the inbound transports supported

@andrewwhitehead - is this done?  I think we have that and so can close this.  Or is this over and above what we have?  At minimum, if this is to stay open, we need to move it to ACA-Py.

Moved here


Work about sections

In this PR I did the following:

Re-created  the recent-works page.
Re-created the about us page.

Thanks @amon-cofie


WIP: Add JSON manifest support

Codecov Report

Merging #72 into master will decrease coverage by 0.13%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master      #72      +/-   ##
==========================================
- Coverage   92.72%   92.58%   -0.14%
==========================================
  Files          36       36
  Lines        2391     2348      -43
==========================================
- Hits         2217     2174      -43
  Misses        174      174

Impacted Files
Coverage Δ

lhotse/audio.py
96.21% <100.00%> (-0.25%)
:arrow_down:

lhotse/cut.py
88.36% <100.00%> (-0.29%)
:arrow_down:

lhotse/features/base.py
94.50% <100.00%> (-0.14%)
:arrow_down:

lhotse/supervision.py
98.07% <100.00%> (-0.23%)
:arrow_down:

lhotse/utils.py
86.53% <100.00%> (+4.03%)
:arrow_up:

test/cut/test_cut_set.py
100.00% <100.00%> (ø)

test/test_feature_set.py
100.00% <100.00%> (ø)

test/test_recording_set.py
100.00% <100.00%> (ø)

test/test_supervision_set.py
100.00% <100.00%> (ø)

lhotse/features/spectrogram.py
90.32% <0.00%> (-0.31%)
:arrow_down:

... and 25 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 572d6d0...0fc7694. Read the comment docs.

@danpovey I implemented full JSON support and changed YAML to JSON in every test, data preparation script, notebook, etc. When I got to updating the documentation, it struck me that it's really hard to read through that. So I left YAML support after all, if only for the sake of explaining how Lhotse works to other people...
This should be ready to merge.

LGTM! More painless than I expected.

Aye, although going through all that code made me realize that Lhotse had grown bigger than I thought.


Support JSON without objects and support JSON without objects or arrays

Technically that's not JSON.
I hacked around your codebase to implement it here - https://github.com/SamuelMarks/serde-json-extensions
Would you be amenable to PRs to make more of your API public so I don't need to steal ahem copy so much of your codebase into mine; and can just depend on it?
I can imagine people creating relaxed supersets of JSON (e.g., to allow trailing commas and comments like JSON5), and more restricted subsets of JSON (like mine).
Thanks for creating a great library!

Copying the code is all right. Someone could even make a crate expressly for the purpose of facilitating JSON superset and JSON subset crates. But I would prefer not to expose serde_json internals for this purpose.