Power Rule - Hyper-V

Hi ​@KD8AVA 

This is using an Audit Script instead.
This should work for you, but there is usually the hurdle that a system would need to be logged off and back on before they get the group membership to Hyper-V Administrators functions.
Here is the script. 

<#
.SYNOPSIS
    Adds the currently logged-on domain user to the local "Hyper-V Administrators" group.
.DESCRIPTION
    Designed to run in the SYSTEM context (e.g., via SCCM, Intune, or a Scheduled Task).
    Detects the interactive logged-on user by finding the owner of the explorer.exe process,
    then adds that user to the built-in "Hyper-V Administrators" group.
    No user interaction is required and nothing is displayed EPM Not allowed.
    No functions are used in this script.
.NOTES
    Prerequisite   : Must be run as SYSTEM (elevated). The SYSTEM account has rights
#>

# --- Configuration ---
$GroupName = "Hyper-V Administrators"

# --- Run silently � suppress all output to the console ---
$ErrorActionPreference = "SilentlyContinue"
$WarningPreference     = "SilentlyContinue"
$VerbosePreference     = "SilentlyContinue"
$DebugPreference       = "SilentlyContinue"
$ProgressPreference    = "SilentlyContinue"

try {
    # Step 1: Detect the logged-on domain user via explorer.exe process owner
    $explorerProcesses = Get-CimInstance -ClassName Win32_Process -Filter "Name = 'explorer.exe'" -ErrorAction Stop

    $loggedOnUser = $null

    if (-not $explorerProcesses) {
        # No explorer.exe found � no interactive session
        exit 0
    }

    foreach ($proc in $explorerProcesses) {
        $ownerInfo = $proc | Invoke-CimMethod -MethodName GetOwner -ErrorAction Stop

        if ($ownerInfo.ReturnValue -eq 0 -and $ownerInfo.Domain -and $ownerInfo.User) {
            $domainUser = "$($ownerInfo.Domain)\$($ownerInfo.User)"

            # Skip machine/system accounts (end with $)
            if ($ownerInfo.User -match '\$$') {
                continue
            }

            # Skip the local SYSTEM account explicitly
            if ($ownerInfo.User -ieq "SYSTEM") {
                continue
            }

            $loggedOnUser = $domainUser
            break
        }
    }

    # Fallback: Try Win32_ComputerSystem if explorer method failed
    if (-not $loggedOnUser) {
        $cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction SilentlyContinue
        if ($cs.UserName) {
            $loggedOnUser = $cs.UserName
        }
    }

    # If still no user found, exit gracefully
    if (-not $loggedOnUser) {
        exit 0
    }

    # Step 2: Parse domain and username from the detected user string
    $parts = $loggedOnUser -split '\\'
    if ($parts.Count -ge 2) {
        $domain = $parts[0]
        $user  = $parts[1]
    }
    elseif ($loggedOnUser -match '@') {
        # Handle UPN format (user@domain.com)
        $atParts = $loggedOnUser -split '@'
        $domain  = $atParts[1]
        $user    = $atParts[0]
    }
    else {
        # Unrecognised format � exit gracefully
        exit 0
    }

    # Skip if the detected user is a machine account
    if ($user -match '\$$') {
        exit 0
    }

    # Step 3: Connect to the local group via WinNT ADSI provider
    $computerName = $env:COMPUTERNAME
    $group = [ADSI]"WinNT://$computerName/$GroupName,group"

    if (-not $group.Path) {
        # Group does not exist (Hyper-V role may not be installed)
        exit 1
    }

    # Step 4: Check if the user is already a member (idempotent check)
    $alreadyMember = $false

    $existingMembers = @($group.psbase.Invoke("Members"))

    foreach ($member in $existingMembers) {
        $adsPath = $member.GetType().InvokeMember("AdsPath", 'GetProperty', $null, $member, $null)
        # Normalize: "WinNT://DOMAIN/User" vs "WinNT://DOMAIN/User,user"
        $normalizedMember = ($adsPath -replace 'WinNT://', '' -replace ',.*$', '')
        $normalizedTarget = "$domain/$user"

        if ($normalizedMember -ieq $normalizedTarget) {
            $alreadyMember = $true
            break
        }
    }

    if ($alreadyMember) {
        # Already a member - no action needed, exit successfully
        exit 0
    }

    # Step 5: Add the domain user to the Hyper-V Administrators group
    $userAdsPath = "WinNT://$domain/$user"
    $group.Add($userAdsPath)

    # Exit successfully
    exit 0
}
catch {
    # Any unexpected error - exit with failure code
    exit 1
}

Here is a GIF of how it works.

KR Jens

Perhaps a bit late - but what problem were you trying to solve with the script? Is it because the user needs to be a member of the group to use the Hyper-V snap-in?

If that’s the case, using a custom token to inject that Hyper-V group membership when that specific snap-in is loaded, is a more dynamic and product native way to achieve the same outcome. 

Obviously if you need to populate the group for another scenario, such as remove connections, this may not be the appropriate solution, but I wanted to offer it  just in case.