41 lines
2.0 KiB
PowerShell
41 lines
2.0 KiB
PowerShell
Write-Output "=== 1. OU placement ==="
|
|
$comp = ([adsisearcher]"(&(objectClass=computer)(cn=NURSESTATION-PC))").FindOne()
|
|
Write-Output "DN: $($comp.Properties.distinguishedname)"
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 2. GPOs linked to this machine ==="
|
|
gpresult /scope computer /r 2>&1 | Select-String "Applied Group Policy|CSC|Caregiver|Kiosk|Nurse|Lockdown"
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 3. Loopback processing (UserPolicyMode) ==="
|
|
$lp = Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows\System" -Name UserPolicyMode -ErrorAction SilentlyContinue
|
|
if ($lp) { Write-Output "UserPolicyMode=$($lp.UserPolicyMode) (1=Merge)" } else { Write-Output "NOT SET" }
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 4. DontDisplayLastUserName ==="
|
|
$dl = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name DontDisplayLastUserName -ErrorAction SilentlyContinue
|
|
Write-Output "DontDisplayLastUserName=$($dl.DontDisplayLastUserName)"
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 5. Kiosk GPO security filter (who gets locked down) ==="
|
|
Import-Module GroupPolicy
|
|
$acl = (Get-GPO -Name 'CSC - Nurse Station Kiosk').Path
|
|
$perms = Get-GPPermission -Name 'CSC - Nurse Station Kiosk' -All
|
|
$perms | ForEach-Object { Write-Output " $($_.Trustee.Name) : $($_.Permission)" }
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 6. Scheduled task: profile cleanup ==="
|
|
Get-ScheduledTask -TaskName '*Caregiver*' -ErrorAction SilentlyContinue | ForEach-Object {
|
|
Write-Output "Task: $($_.TaskName) State: $($_.State)"
|
|
Write-Output "Trigger: $($_.Triggers | ForEach-Object { $_.CimClass.CimClassName })"
|
|
}
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 7. Desktop shortcuts ==="
|
|
Write-Output "Public:"
|
|
Get-ChildItem "C:\Users\Public\Desktop\*.url","C:\Users\Public\Desktop\*.lnk" -ErrorAction SilentlyContinue | ForEach-Object { Write-Output " $($_.Name)" }
|
|
|
|
Write-Output ""
|
|
Write-Output "=== 8. Hybrid join + PRT capable ==="
|
|
dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|TenantId" | ForEach-Object { $_.Line.Trim() }
|