Import-Module ActiveDirectory
$sam = 'test.caregiver'
$existing = Get-ADUser -Filter "SamAccountName -eq '$sam'" -ErrorAction SilentlyContinue
if ($existing) { Write-Output "EXISTS: $($existing.DistinguishedName)"; exit 0 }
# Place it in the same OU as an existing caregiver
$member = Get-ADGroupMember 'SG-Caregivers' | Where-Object objectClass -eq 'user' | Select-Object -First 1
$refUser = Get-ADUser $member.SamAccountName
$ou = ($refUser.DistinguishedName -split ',',2)[1]
Write-Output "Target OU: $ou"
$pw = ConvertTo-SecureString 'KioskTest-7492!' -AsPlainText -Force
New-ADUser -Name 'Test Caregiver' -GivenName 'Test' -Surname 'Caregiver' `
  -SamAccountName $sam -UserPrincipalName 'test.caregiver@cascadestucson.com' `
  -Path $ou -AccountPassword $pw -Enabled $true -ChangePasswordAtLogon $false `
  -Description 'ACG kiosk pilot test account - remove after WS3 go-live'
Add-ADGroupMember -Identity 'SG-Caregivers' -Members $sam
Start-Sleep -Seconds 3
$u = Get-ADUser $sam -Properties MemberOf
Write-Output "CREATED: $($u.DistinguishedName)"
Write-Output "Groups: $($u.MemberOf -join '; ')"
try { Import-Module ADSync -ErrorAction Stop; Start-ADSyncSyncCycle -PolicyType Delta | Out-Null; Write-Output 'Delta sync started' } catch { Write-Output "Delta sync skipped: $_" }