tests/Test-CmInstallAccountRoles.ps1

function Test-CmInstallAccountRoles {
    [CmdletBinding()]
    param (
        [parameter()][string] $TestName = "ConfigMgr Install Account Roles and Permissions",
        [parameter()][string] $TestGroup = "configuration",
        [parameter()][string] $Description = "Check if site install account has more permissions/roles than it needs",
        [parameter()][hashtable] $ScriptParams
    )
    try {
        $startTime = (Get-Date)
        #[int]$Setting = Get-CmHealthDefaultValue -KeySet "keygroup:keyname" -DataSet $CmHealthConfig
        [System.Collections.Generic.List[PSObject]]$tempdata = @() # for detailed test output to return if needed
        $stat   = "PASS" # do not change this
        $except = "WARNING" # or "FAIL"
        $msg    = "No issues found" # do not change this either
        [array]$localAdmins = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop
        [array]$sysadmins = Get-DbaServerRoleMember -SqlInstance $ScriptParams.SqlInstance -ServerRole "sysadmin" -ErrorAction Stop

        $query = "SELECT TOP (1) LogonName FROM dbo.vRBAC_Permissions WHERE CategoryID = 'SMS00ALL'"
        $res = Get-CmSqlQueryResult -Query $query -Params $ScriptParams
        $isLocalAdmin  = $False
        $isDomainAdmin = $False
        $isEntAdmin    = $False
        $isSchemaAdmin = $False
        $isSysAdmin    = $False
        [string]$msg = @()
        if ($null -ne $res) {
            $username = $res.LogonName
            $basename = $($username -split '\\')[1]
            if ($localAdmins.Name -contains $username) {
                Write-Verbose "install account is a direct member of local Administrators group"
                $isLocalAdmin = $True
            } else {
                Write-Verbose "install account is not a member of local Administrators group"
                $stat = $except
                $msg += "install account has fewer permissions than it may require"
            }
            if ($sysadmins -contains $username) {
                Write-Verbose "install account is a direct member of SQL sysadmins group"
                $isSysAdmin = $True
            }
            $dagroup = Get-ADSIGroupMember -Identity "Domain Admins" | Select-Object -expand name
            if ($dagroup -contains $basename) {
                Write-Verbose "install account is a direct member of Domain Admins group"
                $isDomainAdmin = $True
                $stat = $except
                $msg += "install account has more permissions than it may require"
            }
            $eagroup = Get-ADSIGroupMember -Identity "Enterprise Admins" | Select-Object -expand name
            if ($eagroup -contains $basename) {
                Write-Verbose "install account is a direct member of Enterprise Admins group"
                $isEntAdmin = $True
                $stat = $except
                $msg += "install account has more permissions than it may require"
            }
            $sagroup = Get-ADSIGroupMember -Identity "Schema Admins" | Select-Object -expand name
            if ($sagroup -contains $basename) {
                Write-Verbose "install account is a direct member of Schema Admins group"
                $isSchemaAdmin = $True
                $stat = $except
                $msg += "install account has more permissions than it may require"
            }
            $tempdata.Add([pscustomobject]@{
                InstallAccount = $username
                IsLocalAdmin   = $isLocalAdmin
                IsDomainAdmin  = $isDomainAdmin
                IsEnterpriseAdmin = $isEntAdmin
                IsSchemaAdmin  = $isSchemaAdmin
                IsSqlSysAdmin  = $isSysAdmin
            })
        } else {
            Write-Warning "unable to query site installation account from database"
        }
    }
    catch {
        $stat = 'ERROR'
        $msg += $_.Exception.Message -join ';'
    }
    finally {
        $msg = $($msg -join ';')
        $rt = Get-RunTime -BaseTime $startTime
        Write-Output $([pscustomobject]@{
            TestName    = $TestName
            TestGroup   = $TestGroup
            TestData    = $tempdata
            Description = $Description
            Status      = $stat
            Message     = $msg
            RunTime     = $rt
            Credential  = $(if($ScriptParams.Credential){$($ScriptParams.Credential).UserName} else { $env:USERNAME })
        })
    }
}