Write-Output "=== 1. OU placement ==="
$comp = ([adsisearcher]"(&(objectClass=computer)(cn=NURSESTATION-PC))").FindOne()
Write-Output "DN: $($comp.Properties.distinguishedname)"

Write-Output ""
Write-Output "=== 2. GPOs linked to this machine ==="
gpresult /scope computer /r 2>&1 | Select-String "Applied Group Policy|CSC|Caregiver|Kiosk|Nurse|Lockdown"

Write-Output ""
Write-Output "=== 3. Loopback processing (UserPolicyMode) ==="
$lp = Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows\System" -Name UserPolicyMode -ErrorAction SilentlyContinue
if ($lp) { Write-Output "UserPolicyMode=$($lp.UserPolicyMode) (1=Merge)" } else { Write-Output "NOT SET" }

Write-Output ""
Write-Output "=== 4. DontDisplayLastUserName ==="
$dl = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name DontDisplayLastUserName -ErrorAction SilentlyContinue
Write-Output "DontDisplayLastUserName=$($dl.DontDisplayLastUserName)"

Write-Output ""
Write-Output "=== 5. Kiosk GPO security filter (who gets locked down) ==="
Import-Module GroupPolicy
$acl = (Get-GPO -Name 'CSC - Nurse Station Kiosk').Path
$perms = Get-GPPermission -Name 'CSC - Nurse Station Kiosk' -All
$perms | ForEach-Object { Write-Output "  $($_.Trustee.Name) : $($_.Permission)" }

Write-Output ""
Write-Output "=== 6. Scheduled task: profile cleanup ==="
Get-ScheduledTask -TaskName '*Caregiver*' -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Output "Task: $($_.TaskName)  State: $($_.State)"
    Write-Output "Trigger: $($_.Triggers | ForEach-Object { $_.CimClass.CimClassName })"
}

Write-Output ""
Write-Output "=== 7. Desktop shortcuts ==="
Write-Output "Public:"
Get-ChildItem "C:\Users\Public\Desktop\*.url","C:\Users\Public\Desktop\*.lnk" -ErrorAction SilentlyContinue | ForEach-Object { Write-Output "  $($_.Name)" }

Write-Output ""
Write-Output "=== 8. Hybrid join + PRT capable ==="
dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|TenantId" | ForEach-Object { $_.Line.Trim() }