# Check what GP CSEs are registered on this machine
Write-Output "=== Shortcuts CSE registered? ==="
$shortcutCSE = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}" -ErrorAction SilentlyContinue
if ($shortcutCSE) {
    Write-Output "YES: $($shortcutCSE.'(default)') DLL: $($shortcutCSE.DllName)"
} else { Write-Output "NOT REGISTERED" }

Write-Output ""
Write-Output "=== All GP Preference CSEs ==="
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" | ForEach-Object {
    $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    $name = $p.'(default)'
    if ($name -match 'Preference|Shortcut|File|Folder') {
        Write-Output "  $($_.PSChildName): $name"
    }
}

Write-Output ""
Write-Output "=== Full GP event log (last 30, user policy) ==="
Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" -MaxEvents 30 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'user|User|loopback|Kiosk|Nurse|failed|error|Extension' -and $_.Level -le 3 } | ForEach-Object {
    Write-Output "$($_.TimeCreated) [id=$($_.Id) lvl=$($_.Level)]"
    Write-Output "  $($_.Message.Substring(0,[Math]::Min(250,$_.Message.Length)))"
}