sync: auto-sync from HOWARD-HOME at 2026-07-17 14:14:41

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-17 14:14:41

clients/cascades-tucson/scripts/verify-kiosk-config.ps1

@@ -0,0 +1,40 @@
+Write-Output "=== 1. OU placement ==="
+$comp = ([adsisearcher]"(&(objectClass=computer)(cn=NURSESTATION-PC))").FindOne()
+Write-Output "DN: $($comp.Properties.distinguishedname)"
+
+Write-Output ""
+Write-Output "=== 2. GPOs linked to this machine ==="
+gpresult /scope computer /r 2>&1 | Select-String "Applied Group Policy|CSC|Caregiver|Kiosk|Nurse|Lockdown"
+
+Write-Output ""
+Write-Output "=== 3. Loopback processing (UserPolicyMode) ==="
+$lp = Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows\System" -Name UserPolicyMode -ErrorAction SilentlyContinue
+if ($lp) { Write-Output "UserPolicyMode=$($lp.UserPolicyMode) (1=Merge)" } else { Write-Output "NOT SET" }
+
+Write-Output ""
+Write-Output "=== 4. DontDisplayLastUserName ==="
+$dl = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name DontDisplayLastUserName -ErrorAction SilentlyContinue
+Write-Output "DontDisplayLastUserName=$($dl.DontDisplayLastUserName)"
+
+Write-Output ""
+Write-Output "=== 5. Kiosk GPO security filter (who gets locked down) ==="
+Import-Module GroupPolicy
+$acl = (Get-GPO -Name 'CSC - Nurse Station Kiosk').Path
+$perms = Get-GPPermission -Name 'CSC - Nurse Station Kiosk' -All
+$perms | ForEach-Object { Write-Output "  $($_.Trustee.Name) : $($_.Permission)" }
+
+Write-Output ""
+Write-Output "=== 6. Scheduled task: profile cleanup ==="
+Get-ScheduledTask -TaskName '*Caregiver*' -ErrorAction SilentlyContinue | ForEach-Object {
+    Write-Output "Task: $($_.TaskName)  State: $($_.State)"
+    Write-Output "Trigger: $($_.Triggers | ForEach-Object { $_.CimClass.CimClassName })"
+}
+
+Write-Output ""
+Write-Output "=== 7. Desktop shortcuts ==="
+Write-Output "Public:"
+Get-ChildItem "C:\Users\Public\Desktop\*.url","C:\Users\Public\Desktop\*.lnk" -ErrorAction SilentlyContinue | ForEach-Object { Write-Output "  $($_.Name)" }
+
+Write-Output ""
+Write-Output "=== 8. Hybrid join + PRT capable ==="
+dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|TenantId" | ForEach-Object { $_.Line.Trim() }