$ErrorActionPreference = 'Continue'
Write-Output "=== KFM Check: $env:COMPUTERNAME ==="
Write-Output ""
Write-Output "--- Logged on users ---"
query user 2>&1 | ForEach-Object { Write-Output $_ }
Write-Output ""
Write-Output "--- OneDrive.exe processes ---"
$odProcs = Get-CimInstance Win32_Process -Filter "Name='OneDrive.exe'" -EA SilentlyContinue
if ($odProcs) {
    foreach ($p in $odProcs) {
        $o = $p.GetOwner()
        Write-Output "  Running as: $($o.Domain)\$($o.User)"
    }
} else { Write-Output "  Not running" }
Write-Output ""
Write-Output "--- User profile OneDrive folders ---"
Get-ChildItem C:\Users -Directory -EA SilentlyContinue |
    Where-Object { $_.Name -notin @('Public','Default','Default User','All Users') } |
    ForEach-Object {
        $od = Get-ChildItem $_.FullName -Directory -Filter 'OneDrive*' -EA SilentlyContinue
        Write-Output "  $($_.Name): $(if ($od) { $od.Name -join ', ' } else { 'no OneDrive folder' })"
    }
Write-Output ""
Write-Output "--- Loaded HKU shell folders ---"
Get-ChildItem 'Registry::HKEY_USERS' -EA SilentlyContinue |
    Where-Object { $_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes' } |
    ForEach-Object {
        $sid = $_.PSChildName
        try { $un = ([System.Security.Principal.SecurityIdentifier]$sid).Translate([System.Security.Principal.NTAccount]).Value } catch { $un = $sid }
        Write-Output "  User: $un"
        $sf = Get-ItemProperty "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -EA SilentlyContinue
        if ($sf) {
            $d  = $sf.Personal
            $dt = $sf.Desktop
            $dl = $sf.'{374DE290-123F-4565-9164-39C4925E467B}'
            Write-Output "    Documents: $d$(if ($d  -like '*OneDrive*') { ' [KFM ACTIVE]' })"
            Write-Output "    Desktop:   $dt$(if ($dt -like '*OneDrive*') { ' [KFM ACTIVE]' })"
            Write-Output "    Downloads: $dl$(if ($dl -like '*OneDrive*') { ' [KFM ACTIVE]' })"
        } else { Write-Output "    Shell Folders key not present (user not logged in or hive not loaded)" }
    }