diff --git a/clients/cascades-tucson/scripts/stage-drivers.ps1 b/clients/cascades-tucson/scripts/stage-drivers.ps1
new file mode 100644
index 00000000..d69bf3dd
--- /dev/null
+++ b/clients/cascades-tucson/scripts/stage-drivers.ps1
@@ -0,0 +1,44 @@
+# Stage Konica and Canon printer drivers from SYSVOL to local, then install
+$ErrorActionPreference = "Stop"
+
+$sysvol = "\\cascades.local\SYSVOL\cascades.local\scripts\drivers"
+$local = "C:\ProgramData\Cascades\drivers"
+
+if (-not (Test-Path $local)) { New-Item $local -ItemType Directory -Force | Out-Null }
+
+Write-Host "=== Copying from SYSVOL ==="
+if (Test-Path "$sysvol\konica") {
+    Copy-Item "$sysvol\konica" "$local\konica" -Recurse -Force
+    Write-Host "[OK] Konica copied"
+} else {
+    Write-Host "[ERROR] Konica not found in SYSVOL"
+}
+
+if (Test-Path "$sysvol\canon") {
+    Copy-Item "$sysvol\canon" "$local\canon" -Recurse -Force
+    Write-Host "[OK] Canon copied"
+} else {
+    Write-Host "[ERROR] Canon not found in SYSVOL"
+}
+
+Write-Host "`n=== Konica files ==="
+Get-ChildItem "$local\konica" -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "  $($_.Name) ($($_.Length))" }
+
+Write-Host "`n=== Canon files ==="
+Get-ChildItem "$local\canon" -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "  $($_.Name) ($($_.Length))" }
+
+Write-Host "`n=== Installing Konica driver ==="
+try {
+    pnputil /add-driver "$local\konica\KOUWNJ1_.inf" /install 2>&1 | Write-Host
+} catch { Write-Host "[ERROR] $_" }
+
+Write-Host "`n=== Installing Canon driver ==="
+try {
+    pnputil /add-driver "$local\canon\cnp60ma64.inf" /install 2>&1 | Write-Host
+} catch { Write-Host "[ERROR] $_" }
+
+Write-Host "`n=== Printer drivers now ==="
+Get-PrinterDriver | Where-Object { $_.Name -match "Konica|Canon" } | Select-Object Name | Format-Table -AutoSize | Out-String | Write-Host
+
+# Cleanup
+Remove-Item $local -Recurse -Force -ErrorAction SilentlyContinue
diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-21-howard-assistnurse-pc-kiosk-setup.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-21-howard-assistnurse-pc-kiosk-setup.md
new file mode 100644
index 00000000..9d2190ae
--- /dev/null
+++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-21-howard-assistnurse-pc-kiosk-setup.md
@@ -0,0 +1,111 @@
+# Cascades of Tucson — ASSISTNURSE-PC Nurse Station Kiosk Setup
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Configured ASSISTNURSE-PC as the second shared caregiver nurse station at Cascades, replicating the NURSESTATION-PC kiosk build from 2026-07-17. Howard was physically at the machine in the Memory Care wing.
+
+The machine was domain-joined but sitting in the default `CN=Computers` container. Moved it to `OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local` via CS-SERVER RMM, which brought it into scope for the three caregiver GPOs (Kiosk, Lockdown, Caregiver Workstation). Ran gpupdate and triggered an Entra Connect delta sync. After reboot, the machine achieved hybrid Entra Join (`AzureAdJoined: YES`, `AzureAdPrt: YES`).
+
+Discovered the `CSC - Point and Print (CS-SERVER)` GPO was still pilot-scoped to a single machine (`DESKTOP-H6QHRR7$`). Widened the security filter from that pilot machine to `Domain Computers` so all machines in the linked OU get Point-and-Print. This was the root cause of the Konica and Canon printer driver download failures (error 0xBCB). The Brother printers worked because their generic driver is built into the Windows driver store.
+
+Pre-staged the Konica (`KONICA MINOLTA Universal PCL`, INF `KOUWNJ1_.inf`) and Canon (`Canon Generic Plus PCL6`, INF `cnp60ma64.inf`) drivers on ASSISTNURSE-PC by copying them from CS-SERVER's DriverStore to SYSVOL, then locally to the machine, and installing via `pnputil /add-driver /install`. Machine-level printer connections (`/ga`) were added for four printers: Nurses Brother, Health Services Konica, Copy Room (Canon), and Memory Care MedTech Brother. Howard ran the `/ga` commands locally from elevated PowerShell.
+
+Fixed the CMD window popup at logon caused by the `CSC Caregiver Idle Logoff` scheduled task running `powershell.exe` in the interactive session. Created a VBS wrapper (`idle-logoff-launcher.vbs`) that launches PowerShell with window style 0 (completely hidden), and updated the task to use `wscript.exe` with the VBS. Applied the same fix to NURSESTATION-PC proactively.
+
+Cleaned duplicate shortcuts from Public Desktop (ALIS.url, Helpany.url, LinkRx.url, Microsoft Edge.lnk) that were duplicating the GPP-delivered shortcuts from the kiosk GPO.
+
+Created a machine-wide default printer mechanism: a `CSC Set Default Printer` scheduled task that runs at every user logon (via VBS wrapper, invisible), waits up to 30s for the MedTech printer to appear, and sets it as default. Disabled Windows auto-manage default printer via HKLM policy.
+
+Verified all GPO restrictions are applying correctly for caregiver users: Edge SSO (BrowserSignin=2, EdgeDefaultProfileEnabled=1), UI restrictions (NoRun, NoControlPanel, DisableCMD, DisableRegistryTools, DisableTaskMgr, NoSetFolders, RemoveWindowsStore, DisableUserInstalls), AppLocker (AppIDSvc running), DontDisplayLastUserName. The restrictions were initially reported as missing because the audit checked the wrong registry paths (`HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer` instead of the GPO-managed `HKCU\Software\Policies\Microsoft\Windows\Explorer`).
+
+## Key Decisions
+
+- Widened Point-and-Print GPO security filter from pilot-only (`DESKTOP-H6QHRR7$`) to `Domain Computers`. This is a fleet-wide change that will benefit all future machine deployments in the Staff PCs OU.
+- Added Memory Care MedTech Brother and Copy Room Canon printers to ASSISTNURSE-PC (in addition to the Nurses Brother and Health Services Konica that NURSESTATION-PC has), per Howard's request for the Memory Care wing use case.
+- Set MedTech as the machine-wide default printer via a logon scheduled task rather than per-user GPP, since this is a per-machine setting and the kiosk GPO applies to all caregiver devices (not all of which should default to MedTech).
+- Pre-staged Konica and Canon drivers from CS-SERVER DriverStore via SYSVOL copy rather than relying on Point-and-Print auto-download, which was failing with 0xBCB. The drivers are now in the local DriverStore so future `/ga` connections work immediately.
+- Applied VBS wrapper fix for the idle-logoff CMD window to both ASSISTNURSE-PC and NURSESTATION-PC. The VBS wrapper (`wscript.exe` with run style 0) is the standard Windows approach for suppressing console windows from scheduled tasks running in the interactive session.
+
+## Problems Encountered
+
+- **Printers via RMM kept timing out.** Attempted to run `rundll32 printui.dll /ga` via RMM (SYSTEM context) multiple times, each timing out at 60-120s. Root cause: the SYSTEM context SYSTEM account was trying to connect to CS-SERVER's print share and download drivers, which hung. Should have immediately directed Howard to run the `/ga` commands locally (as was done on NURSESTATION-PC). Wasted multiple polling cycles.
+- **Point-and-Print GPO was pilot-scoped.** `CSC - Point and Print (CS-SERVER)` was filtered to only `DESKTOP-H6QHRR7$` (the original pilot machine). This blocked driver auto-download for all non-Brother printers. Should have checked the full `gpresult /scope computer /r` immediately after the OU move to catch this. Fixed by widening to `Domain Computers`.
+- **Driver pre-staging via `pnputil` failed from UNC paths.** `pnputil /add-driver` does not accept UNC paths. Also, the RMM agent's command body mangled `\\` backslashes in UNC paths (the known Windows quote-stripping issue). Resolved by using `ps-encoded.sh` to send the script with correct backslash preservation, and copying drivers to a local path before running `pnputil`.
+- **CMD window at logon.** The `CSC Caregiver Idle Logoff` scheduled task runs `powershell.exe` in the interactive user session. Even with `-WindowStyle Hidden`, Task Scheduler's console host creates a visible window before PowerShell can hide it. Fixed with a VBS wrapper that uses `WshShell.Run` with style 0 (no window).
+- **UI restrictions appeared missing.** The audit checked the legacy registry paths (`HKCU\...\CurrentVersion\Policies\Explorer`) instead of the GPO-managed paths (`HKCU\Software\Policies\Microsoft\Windows\Explorer`). The kiosk GPO writes to the latter. All restrictions were actually applying correctly.
+
+## Configuration Changes
+
+**On CS-SERVER (via RMM):**
+- AD: Moved `ASSISTNURSE-PC` from `CN=Computers` to `OU=Caregiver Devices,OU=Staff PCs,OU=Workstations`
+- GPO `CSC - Point and Print (CS-SERVER)` (`bfab721a-513d-4c14-8255-deb1d4266830`): Security filter changed from `DESKTOP-H6QHRR7$` to `Domain Computers`
+- Entra Connect delta sync triggered
+- SYSVOL: `scripts\drivers\konica\` and `scripts\drivers\canon\` created with driver packages (staging area for client installs)
+
+**On ASSISTNURSE-PC (via RMM + local):**
+- Machine-level printer connections (`/ga`): `\\CS-SERVER\Nurses - Brother MFC-L8900CDW`, `\\CS-SERVER\Health Services - Konica Minolta C368`, `\\CS-SERVER\Copy Room`, `\\CS-SERVER\Memory Care MedTech - Brother`
+- Point-and-Print registry keys set (also delivered by GPO now): `RestrictDriverInstallationToAdministrators=0`, `PointAndPrint\Restricted=1, TrustedServers=1, ServerList=CS-SERVER, NoWarningNoElevationOnInstall=1, UpdatePromptSettings=2`
+- Drivers pre-staged via `pnputil /add-driver /install`: Konica MINOLTA Universal PCL (`KOUWNJ1_.inf`), Canon Generic Plus PCL6 (`cnp60ma64.inf`)
+- `C:\ProgramData\Cascades\idle-logoff-launcher.vbs` — NEW: VBS wrapper for invisible PowerShell launch
+- `C:\ProgramData\Cascades\set-default-printer.ps1` — NEW: Sets MedTech as default printer at logon
+- `C:\ProgramData\Cascades\set-default-printer-launcher.vbs` — NEW: VBS wrapper for default printer script
+- Scheduled task `CSC Caregiver Idle Logoff`: Updated Execute from `powershell.exe` to `wscript.exe "C:\ProgramData\Cascades\idle-logoff-launcher.vbs"`
+- Scheduled task `CSC Set Default Printer` — NEW: Runs at every user logon, sets MedTech as default
+- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LegacyDefaultPrinterMode=1` — Disable Windows auto-manage default printer
+- `HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\LetAppsManageDefaultPrinter=0` — Same via policy
+- Public Desktop cleaned: removed ALIS.url, Helpany.url, LinkRx.url, Microsoft Edge.lnk
+
+**On NURSESTATION-PC (via RMM):**
+- `C:\ProgramData\Cascades\idle-logoff-launcher.vbs` — NEW: Same VBS wrapper fix
+- Scheduled task `CSC Caregiver Idle Logoff`: Updated Execute from `powershell.exe` to `wscript.exe`
+
+**Local scripts created:**
+- `clients/cascades-tucson/scripts/stage-drivers.ps1` — Driver staging script (copies from SYSVOL, installs via pnputil)
+
+## Credentials & Secrets
+
+- `pilot.test` AD account: `cascades\pilot.test` / `CareTest2026!` (vault: `clients/cascades-tucson/pilot-test-ad.sops.yaml`)
+- `a.mcferren` caregiver account: `cascades\a.mcferren` / `Meadow8541@` (vault: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`)
+
+## Infrastructure & Servers
+
+- ASSISTNURSE-PC: RMM agent `62d108d6-4659-499f-9006-8fd79677daab`, IP `10.0.20.217` (Wi-Fi 2, VLAN 20), hybrid-joined (AzureAdJoined=YES, DomainJoined=YES), DN `CN=ASSISTNURSE-PC,OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local`
+- NURSESTATION-PC: RMM agent `f5a89784-834f-47b1-82e2-7e3e9dd337ff`
+- CS-SERVER: RMM agent `c39f1de7-d5b6-45ae-b132-e06977ab1713`
+- Point-and-Print GPO: `CSC - Point and Print (CS-SERVER)`, GUID `bfab721a-513d-4c14-8255-deb1d4266830`, linked to `Staff PCs`, filter `Domain Computers`
+- Kiosk GPO: `CSC - Nurse Station Kiosk`, GUID `32d76052-4d92-446c-95fb-614653f84742`
+- Printers on ASSISTNURSE-PC: Nurses Brother (TCP_192.168.2.75), Health Services Konica (TCP_192.168.1.138), Copy Room (TCP_192.168.2.230), MedTech Brother (TCP_192.168.2.53)
+
+## Commands & Outputs
+
+- `dsregcmd /status` on ASSISTNURSE-PC: initially `AzureAdJoined: NO`, after OU move + reboot + Entra Connect sync: `AzureAdJoined: YES`, `AzureAdPrt: YES`
+- `gpresult /scope computer /r`: Applied GPOs = CSC - Caregiver Device Lockdown, CSC - Point and Print (CS-SERVER), CSC - Always Wait For Network, Default Domain Policy
+- `gpresult /scope user /r` (a.mcferren): Applied GPOs = CSC - Nurse Station Kiosk, CSC - Caregiver Workstation (denied by security filtering)
+- PrintService event ID 513: `Error code 0xBCB` for Konica and Canon printers (driver not found) — resolved by pre-staging drivers
+- `pnputil /add-driver`: `Total driver packages: 1, Added driver packages: 1` for both Konica and Canon
+
+## Pending / Incomplete Tasks
+
+1. **Verify printers after re-login.** Copy Room (Canon) and Health Services (Konica) should now connect with pre-staged drivers. Howard needs to log out and back in to test.
+2. **Remove Edge.lnk from a.mcferren desktop** — `Microsoft Edge.lnk` showing on caregiver desktop (may be from Default profile copy on first login).
+3. **SYSVOL driver staging cleanup.** `\\cascades.local\SYSVOL\cascades.local\scripts\drivers\` (konica + canon folders) can be left for future machine deployments or removed.
+4. **CSC - Caregiver Workstation GPO** is `Denied (Security)` for a.mcferren — it's filtered to `SG-Caregivers-Test`, not `SG-Caregivers`. This was noted in the 7/17 session as pending the go-live flip.
+5. **CSC - Reception Workstation Policy** still applies to both NURSESTATION-PC and ASSISTNURSE-PC (pre-existing, unresolved from 7/17).
+6. **NURSESTATION-PC AzureAdPrt: NO** — PRT not active (nobody logged in at time of check; verify on next caregiver login).
+7. **Carried from prior sessions:** break-glass accounts, CA allow-list flip, M365 relicense 23 users, image backup repair, domain-join tail, network tail, SharePoint/Teams migration, ALIS online payments scoping.
+
+## Reference Information
+
+- Session log (NURSESTATION-PC build): `clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-nurse-station-kiosk-build.md`
+- Wiki: `wiki/clients/cascades-tucson.md`
+- Remaining work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
+- Kiosk GPO SYSVOL: `\\cascades.local\SYSVOL\cascades.local\Policies\{32d76052-4d92-446c-95fb-614653f84742}`
+- AppLocker policy XML: `\\cascades.local\SYSVOL\cascades.local\scripts\applocker-caregiver.xml`
+- Driver staging: `\\cascades.local\SYSVOL\cascades.local\scripts\drivers\` (konica, canon)
+- Vault pilot.test: `clients/cascades-tucson/pilot-test-ad.sops.yaml`
+- Vault caregiver passwords: `clients/cascades-tucson/caregiver-temp-passwords-2026-06-30.sops.yaml`