$domain = 'cascades.local'
$gpoGuid = '{512B43A4-F049-4CE5-BFAC-860AD13E92BE}'
$srv = 'CS-SERVER'
$sysvol = "\\$srv\SYSVOL\$domain\Policies"

# === 1. Check fdeploy.ini — did GPMC save the folder redirection settings? ===
Write-Output "=== fdeploy.ini content ==="
$fdeployPath = "$sysvol\$gpoGuid\User\Documents & Settings\fdeploy.ini"
if (Test-Path $fdeployPath) {
    $content = [System.IO.File]::ReadAllText($fdeployPath)
    if ($content.Trim()) {
        Write-Output $content
    } else {
        Write-Output "(file exists but is EMPTY — GPMC did not save redirection settings)"
    }
} else {
    Write-Output "(fdeploy.ini does not exist)"
}

Write-Output ""
Write-Output "=== GPT.INI ==="
[System.IO.File]::ReadAllText("$sysvol\$gpoGuid\GPT.INI") | Write-Output

Write-Output ""
Write-Output "=== AD GPC attributes (CSE extension names) ==="
Import-Module ActiveDirectory -EA SilentlyContinue
$gpcObj = Get-ADObject -Filter "Name -eq '$gpoGuid'" `
    -SearchBase "CN=Policies,CN=System,DC=cascades,DC=local" `
    -Properties gPCUserExtensionNames,versionNumber -EA SilentlyContinue
if ($gpcObj) {
    Write-Output "  gPCUserExtensionNames: $($gpcObj.gPCUserExtensionNames)"
    Write-Output "  versionNumber: $($gpcObj.versionNumber)"
} else {
    Write-Output "  GPC object not found"
}

Write-Output ""
Write-Output "=== SYSVOL full tree ==="
Get-ChildItem "$sysvol\$gpoGuid" -Recurse -EA SilentlyContinue | ForEach-Object {
    $rel = $_.FullName.Replace("$sysvol\$gpoGuid", '')
    $type = if ($_.PSIsContainer) { '[DIR]' } else { "[FILE $($_.Length)b]" }
    Write-Output "  $type $rel"
}

# === 2. Check homes share path and NTFS permissions ===
Write-Output ""
Write-Output "=== homes share local path ==="
$share = Get-SmbShare -Name 'homes' -EA SilentlyContinue
if ($share) {
    Write-Output "  Share path: $($share.Path)"
    $homesPath = $share.Path

    Write-Output ""
    Write-Output "=== homes root NTFS ACL ==="
    (Get-Acl $homesPath).Access | ForEach-Object {
        Write-Output "  $($_.IdentityReference) | $($_.FileSystemRights) | $($_.AccessControlType) | Inherit:$($_.InheritanceFlags) Prop:$($_.PropagationFlags)"
    }

    Write-Output ""
    Write-Output "=== homes subfolders and their ACLs ==="
    Get-ChildItem $homesPath -Directory -EA SilentlyContinue | ForEach-Object {
        $folder = $_.FullName
        $name = $_.Name
        Write-Output "  --- $name ---"
        (Get-Acl $folder).Access | ForEach-Object {
            Write-Output "    $($_.IdentityReference) | $($_.FileSystemRights) | $($_.AccessControlType) | Inherit:$($_.InheritanceFlags)"
        }
    }
} else {
    Write-Output "  'homes' share not found on this server"
}
