sync: auto-sync from HOWARD-HOME at 2026-06-05 17:35:42

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-05 17:35:42

clients/cascades-tucson/scripts/link-caregiver-gpo.ps1

@@ -0,0 +1,31 @@
+# Link "CSC - Caregiver Workstation" at OU=Caregivers and apply TEST security filtering.
+# Auth Users -> Read only (MS16-072: computer must read user GPO). SG-Caregivers-Test -> Apply (pilot.test only).
+# Go-live later: Set-GPPermission ... -TargetName 'SG-Caregivers' -PermissionLevel GpoApply ; remove the test group.
+$ErrorActionPreference = 'Stop'
+Import-Module GroupPolicy -ErrorAction Stop
+
+$gpoName = 'CSC - Caregiver Workstation'
+$target  = 'OU=Caregivers,OU=Departments,DC=cascades,DC=local'
+
+# 1) Link (idempotent)
+try {
+  New-GPLink -Name $gpoName -Target $target -LinkEnabled Yes -ErrorAction Stop | Out-Null
+  Write-Output ('LINKED at ' + $target)
+} catch {
+  if ($_.Exception.Message -match 'already linked|already exists') { Write-Output ('Already linked at ' + $target) }
+  else { throw }
+}
+
+# 2) Security filtering: Auth Users -> Read, SG-Caregivers-Test -> Apply
+Set-GPPermission -Name $gpoName -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead -Replace | Out-Null
+Write-Output 'Authenticated Users -> GpoRead (read only)'
+Set-GPPermission -Name $gpoName -TargetName 'SG-Caregivers-Test' -TargetType Group -PermissionLevel GpoApply | Out-Null
+Write-Output 'SG-Caregivers-Test -> GpoApply'
+
+# 3) Verify
+Write-Output ''
+Write-Output '===== VERIFY ====='
+Write-Output '--- Permissions ---'
+Get-GPPermission -Name $gpoName -All | ForEach-Object { '  ' + $_.Trustee.Name + ' : ' + $_.Permission }
+Write-Output '--- Links on OU=Caregivers ---'
+(Get-GPInheritance -Target $target).GpoLinks | ForEach-Object { '  ' + $_.DisplayName + ' | enabled=' + $_.Enabled + ' | enforced=' + $_.Enforced }