Import-Module ActiveDirectory
# 1. Remove the duplicate created today
Remove-ADUser -Identity 'test.caregiver' -Confirm:$false
Write-Output 'Removed duplicate test.caregiver'
# 2. Ensure pilot.test is in SG-Caregivers (kiosk GPO filter) - keep SG-Caregivers-Test
Add-ADGroupMember -Identity 'SG-Caregivers' -Members 'pilot.test'
# 3. Reset password to the documented pilot value so it is deterministic
$pw = ConvertTo-SecureString 'CareTest2026!' -AsPlainText -Force
Set-ADAccountPassword -Identity 'pilot.test' -NewPassword $pw -Reset
Set-ADUser 'pilot.test' -ChangePasswordAtLogon $false -Enabled $true
$v = Get-ADUser 'pilot.test' -Properties MemberOf, Enabled
Write-Output "pilot.test enabled=$($v.Enabled)"
Write-Output "Groups: $($v.MemberOf -join '; ')"
try { Import-Module ADSync -ErrorAction Stop; Start-ADSyncSyncCycle -PolicyType Delta | Out-Null; Write-Output 'Delta sync started' } catch { Write-Output "Delta sync skipped: $_" }
