Import-Module ActiveDirectory
# Check what the original working GPO had
$cwDN = "CN={3B5CD9A6-A278-4676-A9FD-9396D21A8261},CN=Policies,CN=System,DC=cascades,DC=local"
$cwExt = (Get-ADObject $cwDN -Properties gPCUserExtensionNames).gPCUserExtensionNames
Write-Output "Original Caregiver Workstation CSE: $cwExt"

# Fix the kiosk GPO with the CORRECT Shortcuts CSE
$kioskGuid = '32d76052-4d92-446c-95fb-614653f84742'
$kioskDN = "CN={$kioskGuid},CN=Policies,CN=System,DC=cascades,DC=local"
# {C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7} = Group Policy Shortcuts CSE
# Use same tool GUID as original, or the generic preference tool GUID
$cse = '[{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}]'
if ($cwExt) { $cse = $cwExt }
Set-ADObject $kioskDN -Replace @{gPCUserExtensionNames=$cse}
$verify = (Get-ADObject $kioskDN -Properties gPCUserExtensionNames).gPCUserExtensionNames
Write-Output "Kiosk GPO CSE set to: $verify"

# Update GPT.INI
$gptPath = "\\cascades.local\SYSVOL\cascades.local\Policies\{$kioskGuid}\GPT.INI"
$ini = Get-Content $gptPath -Raw
if ($ini -match 'gPCUserExtensionNames=') { $ini = $ini -replace 'gPCUserExtensionNames=.*', "gPCUserExtensionNames=$cse" } else { $ini = $ini.TrimEnd() + "`r`ngPCUserExtensionNames=$cse`r`n" }
if ($ini -match 'Version=(\d+)') {
    $ver = [int]$matches[1]; $newVer = ((($ver -shr 16)+1) -shl 16) -bor ($ver -band 0xFFFF)
    $ini = $ini -replace "Version=\d+", "Version=$newVer"
}
Set-Content $gptPath $ini -Force
Write-Output "GPT.INI:"
Get-Content $gptPath

# Verify Shortcuts.xml still exists
$xmlPath = "\\cascades.local\SYSVOL\cascades.local\Policies\{$kioskGuid}\User\Preferences\Shortcuts\Shortcuts.xml"
if (Test-Path $xmlPath) { Write-Output "Shortcuts.xml: EXISTS" } else { Write-Output "Shortcuts.xml: MISSING - need to restore" }