#Requires -Version 5.1

param(
    [Parameter(Mandatory=$true)][string]$Username,
    [Parameter(Mandatory=$true)][string]$Password,
    [Parameter(Mandatory=$true)][string]$FullName,
    [Parameter(Mandatory=$true)][string]$Description
)
LogMsg "Create-LocalAdmin.ps1"
LogMsg "Securing supplied password"
Try { $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force ; $Password = $null }
Catch { LogErr $_.Exception.Message ; Exit }
If ( IsAdmin )
{
    If ( $(Get-CimInstance -ClassName Win32_OperatingSystem -Property ProductType | Select-Object -ExpandProperty ProductType) -ne "2" )
    {
        If ( $(Get-LocalUser -Name $Username -ErrorAction SilentlyContinue) )
        {
            LogMsg "Updating user: ${Username}"
            Try { Set-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
            Catch { LogErr $_.Exception.Message ; Exit }
        }
        Else
        {
            LogMsg "Creating user: ${Username}"
            Try { New-LocalUser -Name $Username -Password $SecurePassword -FullName $FullName -Description $Description -AccountNeverExpires -PasswordNeverExpires $true }
            Catch { LogErr $_.Exception.Message ; Exit }
        }
        If ( !($(Get-LocalGroupMember -Group "Administrators" -Member $Username -ErrorAction SilentlyContinue)) )
        {
            LogMsg "Adding ""${Username}"" to local Administrators group"
            Try { Add-LocalGroupMember -Group "Administrators" -Member $Username }
            Catch { LogErr $_.Exception.Message ; Exit }
        }
    }
    Else { LogMsg "The local user account ""${Username}"" cannot be created on a domain controller" }
}
Else { LogMsg "Cannot create a local administrator account without administrative privileges" }

## TODO: Hide account from logon screen
#Get-ChildItem "HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"