# 1. Check GPO shortcut preferences (GP Preferences > Shortcuts)
Write-Output "=== GPO Results: Shortcut Preferences ==="
$gpResults = gpresult /scope user /xml 2>$null
if ($gpResults) {
    $xml = [xml]$gpResults
    # Look for shortcut extensions
    $ns = @{gp='http://www.microsoft.com/GroupPolicy/Settings/Shortcuts'}
    $shortcuts = $xml.SelectNodes('//gp:Shortcut', $ns)
    if ($shortcuts.Count -gt 0) {
        foreach ($s in $shortcuts) { Write-Output "  GPP Shortcut: $($s.OuterXml.Substring(0, [Math]::Min(300, $s.OuterXml.Length)))" }
    } else { Write-Output "  No GPP shortcuts found in XML" }
    # Also check for file preferences
    $ns2 = @{gp='http://www.microsoft.com/GroupPolicy/Settings/Files'}
    $files = $xml.SelectNodes('//gp:FileSetting', $ns2)
    if ($files.Count -gt 0) {
        foreach ($f in $files) { Write-Output "  GPP File: $($f.OuterXml.Substring(0, [Math]::Min(300, $f.OuterXml.Length)))" }
    }
}

# 2. Check logon scripts in GPO
Write-Output ""
Write-Output "=== Logon Scripts (GPO) ==="
$scripts = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\*\*" -ErrorAction SilentlyContinue
if ($scripts) { $scripts | ForEach-Object { Write-Output "  Script: $($_.Script) Params: $($_.Parameters)" } } else { Write-Output "  None" }

# 3. Check SYSVOL for any scripts referencing our URLs
Write-Output ""
Write-Output "=== SYSVOL scripts mentioning ALIS/Helpany/PharmCare/LinkRx ==="
$sysvol = "\\cascades.local\SYSVOL\cascades.local"
Get-ChildItem "$sysvol\Policies" -Recurse -Include *.ps1,*.bat,*.cmd,*.vbs -ErrorAction SilentlyContinue | ForEach-Object {
    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    if ($content -match 'alis|helpany|pharmcare|linkrx|\.url') {
        Write-Output "  MATCH: $($_.FullName)"
    }
}

# 4. Check GP Preferences XML in SYSVOL for shortcut/file items
Get-ChildItem "$sysvol\Policies" -Recurse -Include "Shortcuts.xml","Files.xml","Drives.xml" -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Output "  GPP XML: $($_.FullName)"
    $c = Get-Content $_.FullName -Raw
    if ($c -match 'alis|helpany|pharmcare|linkrx|\.url') { Write-Output "    -> contains shortcut references" }
}

# 5. Check scheduled tasks
Write-Output ""
Write-Output "=== Scheduled tasks mentioning shortcuts ==="
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'shortcut|url|alis|helpany|pharmcare' -or $_.TaskName -match 'shortcut|desktop' } | ForEach-Object { Write-Output "  Task: $($_.TaskName) -> $($_.Actions.Execute)" }

# 6. Check ActiveSetup
Write-Output ""
Write-Output "=== Active Setup (per-user on first login) ==="
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\*" -ErrorAction SilentlyContinue | Where-Object { $_.StubPath -match 'url|shortcut|alis|helpany|pharmcare|linkrx|desktop' } | ForEach-Object { Write-Output "  $($_.PSChildName): $($_.StubPath)" }
