Import-Module GroupPolicy
$guid = '32d76052-4d92-446c-95fb-614653f84742'

# 1. Write the logon script to SYSVOL (netlogon share)
$scriptContent = @'
@echo off
REM Deploy caregiver desktop shortcuts
if not exist "%USERPROFILE%\Desktop\ALIS.url" (
    echo [InternetShortcut] > "%USERPROFILE%\Desktop\ALIS.url"
    echo URL=https://cascadestucson.alisonline.com/ >> "%USERPROFILE%\Desktop\ALIS.url"
)
if not exist "%USERPROFILE%\Desktop\PharmCare.url" (
    echo [InternetShortcut] > "%USERPROFILE%\Desktop\PharmCare.url"
    echo URL=https://pharmcare.linkrxnow.com/ >> "%USERPROFILE%\Desktop\PharmCare.url"
)
if not exist "%USERPROFILE%\Desktop\Helpany.url" (
    echo [InternetShortcut] > "%USERPROFILE%\Desktop\Helpany.url"
    echo URL=https://app.helpany.com/start >> "%USERPROFILE%\Desktop\Helpany.url"
)
'@
$netlogon = "\\cascades.local\SYSVOL\cascades.local\scripts"
Set-Content "$netlogon\deploy-caregiver-shortcuts.bat" $scriptContent -Force
Write-Output "Logon script written to: $netlogon\deploy-caregiver-shortcuts.bat"

# 2. Remove the broken GPP Shortcuts.xml
$xmlDir = "\\cascades.local\SYSVOL\cascades.local\Policies\{$guid}\User\Preferences\Shortcuts"
if (Test-Path $xmlDir) {
    Remove-Item $xmlDir -Recurse -Force
    Write-Output "Removed GPP Shortcuts dir"
}

# 3. Set the logon script on the kiosk GPO
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0\0' -ValueName 'Script' -Type String -Value 'deploy-caregiver-shortcuts.bat' | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0\0' -ValueName 'Parameters' -Type String -Value '' | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0\0' -ValueName 'IsPowershell' -Type DWord -Value 0 | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0' -ValueName 'GPO-ID' -Type String -Value "cn={$guid},cn=policies,cn=system,DC=cascades,DC=local" | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0' -ValueName 'SOM-ID' -Type String -Value 'OU=Caregiver Devices,OU=Staff PCs,OU=Workstations,DC=cascades,DC=local' | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0' -ValueName 'FileSysPath' -Type String -Value "\\cascades.local\SysVol\cascades.local\Policies\{$guid}\User\Scripts\Logon" | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0' -ValueName 'DisplayName' -Type String -Value 'CSC - Nurse Station Kiosk' | Out-Null
Set-GPRegistryValue -Guid $guid -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Logon\0' -ValueName 'GPOName' -Type String -Value $guid | Out-Null
Write-Output "Logon script GPO registry entries set"

# 4. Also copy the bat into the GPO's own scripts folder
$gpoScripts = "\\cascades.local\SYSVOL\cascades.local\Policies\{$guid}\User\Scripts\Logon"
New-Item -ItemType Directory -Path $gpoScripts -Force | Out-Null
Copy-Item "$netlogon\deploy-caregiver-shortcuts.bat" "$gpoScripts\deploy-caregiver-shortcuts.bat" -Force
Write-Output "Script copied to GPO scripts folder"

# 5. Write scripts.ini
$ini = "[Logon]`r`n0CmdLine=deploy-caregiver-shortcuts.bat`r`n0Parameters=`r`n"
Set-Content "$gpoScripts\scripts.ini" $ini -Force
Write-Output "scripts.ini written"

# 6. Update CSE GUIDs for Scripts
$scriptsCSE = '[{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}]'
$dn = "CN={$guid},CN=Policies,CN=System,DC=cascades,DC=local"
Set-ADObject $dn -Replace @{gPCUserExtensionNames=$scriptsCSE}
Write-Output "CSE GUIDs set for Scripts"

# 7. Bump version
$gptPath = "\\cascades.local\SYSVOL\cascades.local\Policies\{$guid}\GPT.INI"
$gptIni = Get-Content $gptPath -Raw
$gptIni = $gptIni -replace 'gPCUserExtensionNames=.*', "gPCUserExtensionNames=$scriptsCSE"
if ($gptIni -match 'Version=(\d+)') {
    $ver = [int]$matches[1]; $newVer = ((($ver -shr 16)+1) -shl 16) -bor ($ver -band 0xFFFF)
    $gptIni = $gptIni -replace "Version=\d+", "Version=$newVer"
}
Set-Content $gptPath $gptIni -Force
Write-Output "GPT.INI updated"
Get-Content $gptPath