Health Checker: Quick output fixes (#2524, #2381, #2508)

[dpaulson45]

Summary

Quick output fixes for Health Checker addressing three issues:

Fix empty ExScripts path in mitigation service output

Fixes #2524

The `` variable is an Exchange Management Shell (EMS) variable that is not available in the Health Checker context. Replaced with a constructed path using [System.IO.Path]::Combine(.RegistryValues.MsiInstallPath, "Scripts").

Improve error message for orphaned SIDs in local Administrators group

Fixes #2381

When Get-LocalGroupMember throws an InvalidOperationException ("Failed to compare two elements in the array") on Windows Server 2022 and earlier, the analyzer now shows a specific message about orphaned/deleted SIDs instead of the generic "results were blank" message. This is a known OS bug fixed in Server 2025.

Clarify Visual C++ Redistributable finding and documentation

Fixes #2508

• Updated the docs page (https://aka.ms/HC-LatestVC) to clarify that Exchange specifically requires the Visual C++ 2012 and 2013 Redistributable, and that these are not replaced by newer versions (e.g., VC++ 2015-2022).
• Updated analyzer output so that when a version is reported as outdated, the message specifies which year's Redistributable needs updating.
• Fixed double "the" typo in documentation.

Files Changed

• Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1
• Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerExchangeInformation.ps1
• Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityMitigationService.ps1
• Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Invoke-JobExchangeInformationLocal.ps1
• Diagnostics/HealthChecker/Features/Get-HealthCheckerDataObject.ps1
• Diagnostics/HealthChecker/Tests/HealthChecker.E16.Main.Tests.ps1
• Diagnostics/HealthChecker/Tests/HealthChecker.E19.Main.Tests.ps1
• docs/Diagnostics/HealthChecker/VisualCRedistributableVersionCheck.md

Testing

All Pester tests pass (91 tests, 0 failures).

[Copilot]

Pull request overview

This PR makes targeted Health Checker output improvements to address (1) missing mitigation script path output, (2) clearer diagnostics when local Administrators membership enumeration fails due to orphaned SIDs on older Windows Server builds, and (3) clearer Visual C++ Redistributable messaging + documentation.

Changes:

• Constructed the mitigation scripts path from MsiInstallPath instead of relying on EMS-only variables.
• Persisted and surfaced Get-LocalGroupMember exceptions to provide a more accurate “orphaned SID” explanation on pre-Server-2025 OS builds.
• Clarified VC++ 2012/2013 “outdated” messages and updated the corresponding documentation and Pester expectations.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/Diagnostics/HealthChecker/VisualCRedistributableVersionCheck.md	Updates documentation to clarify that Exchange requires VC++ 2012/2013 and that “outdated” means update within that series.
Diagnostics/HealthChecker/Tests/HealthChecker.E19.Main.Tests.ps1	Updates test expectations for the refined VC++ 2013 “outdated” output string.
Diagnostics/HealthChecker/Tests/HealthChecker.E16.Main.Tests.ps1	Updates test expectations for the refined VC++ 2012/2013 “outdated” output strings.
Diagnostics/HealthChecker/Features/Get-HealthCheckerDataObject.ps1	Extends the data object to carry LocalGroupMemberException into analyzers.
Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Invoke-JobExchangeInformationLocal.ps1	Captures the Get-LocalGroupMember exception for later analyzer logic.
Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityMitigationService.ps1	Fixes mitigation guidance output by building the Scripts path from the Exchange install path.
Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1	Improves VC++ “outdated” wording and adds Exchange-specific clarification text.
Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerExchangeInformation.ps1	Uses captured exception + OS build gating to emit a clearer orphaned-SID-related failure message.

[dpaulson45]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).