Import-Module GroupPolicy
$gpo = 'CSC - Nurse Station Kiosk'
$hkcu = 'HKCU\Software\Policies\Microsoft\Windows'

# --- Start Menu / Taskbar restrictions ---
# Remove Run from Start Menu
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoRun' -Type DWord -Value 1 | Out-Null
# Remove Search from taskbar
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'DisableSearchBoxSuggestions' -Type DWord -Value 1 | Out-Null
# Remove Settings from Start
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoSetFolders' -Type DWord -Value 1 | Out-Null
# Remove Help
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoSMHelp' -Type DWord -Value 1 | Out-Null
# Don't keep history of recently opened documents
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoRecentDocsHistory' -Type DWord -Value 1 | Out-Null
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'ClearRecentDocsOnExit' -Type DWord -Value 1 | Out-Null

Write-Output "Start Menu restrictions set"

# --- Block command prompt and PowerShell ---
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Policies\Microsoft\Windows\System' -ValueName 'DisableCMD' -Type DWord -Value 1 | Out-Null
# Block access to registry editor
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' -ValueName 'DisableRegistryTools' -Type DWord -Value 1 | Out-Null
# Block Task Manager
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' -ValueName 'DisableTaskMgr' -Type DWord -Value 1 | Out-Null

Write-Output "CMD/regedit/taskmgr blocked"

# --- Restrict Control Panel ---
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoControlPanel' -Type DWord -Value 1 | Out-Null

Write-Output "Control Panel blocked"

# --- File Explorer restrictions ---
# Hide drives in My Computer (don't block access, just hide)
# Remove File Explorer from taskbar pinning isn't needed - just restrict what they see
# Prevent access to drives from My Computer - but allow printing and Office file access
# Remove Network from navigation pane
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoNetHood' -Type DWord -Value 1 | Out-Null

Write-Output "Explorer restrictions set"

# --- Prevent installing apps ---
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Policies\Microsoft\Windows\Installer' -ValueName 'DisableUserInstalls' -Type DWord -Value 1 | Out-Null

Write-Output "App install blocked"
Write-Output ""
Write-Output "Done. Caregivers can use: Edge, Office apps, Teams, printers."
Write-Output "Blocked: CMD, PowerShell, regedit, Task Manager, Control Panel, Run, Settings, app installs."
