[CmdletBinding(SupportsShouldProcess)]
param(
    [string]$TargetOuDn = 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx',
    [string]$GpoName = 'SGU - User session restrictions',
    [string]$DomainController = $env:COMPUTERNAME
)

$ErrorActionPreference = 'Stop'
$policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'
$policyValueName = 'DisableLockWorkstation'
$desktopPolicyKey = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Run this script from an elevated Windows PowerShell session on a domain controller or management host.'
}

Import-Module ActiveDirectory -ErrorAction Stop
Import-Module GroupPolicy -ErrorAction Stop

$targetOu = Get-ADOrganizationalUnit `
    -Identity $TargetOuDn `
    -Server $DomainController `
    -ErrorAction Stop
$domainDn = ($targetOu.DistinguishedName -split ',DC=', 2)[1]
if (-not $domainDn) {
    throw 'TargetOuDn does not contain a domain distinguished name.'
}
$domainName = ($domainDn -replace ',DC=', '.')

$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU user policy GPO')) {
    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController
}
if (-not $gpo) {
    throw "The GPO '$GpoName' does not exist and was not created."
}

$existingLink = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
    Where-Object DisplayName -eq $GpoName |
    Select-Object -First 1
$existingLinkEnabled = $existingLink -and (
    $existingLink.Enabled -eq $true -or
    [string]$existingLink.Enabled -eq 'Yes')
if (-not $existingLink) {
    if ($PSCmdlet.ShouldProcess($TargetOuDn, "Link and enable '$GpoName'")) {
        New-GPLink `
            -Name $GpoName `
            -Target $TargetOuDn `
            -Domain $domainName `
            -Server $DomainController `
            -LinkEnabled Yes | Out-Null
    }
}
elseif (-not $existingLinkEnabled -and
    $PSCmdlet.ShouldProcess($TargetOuDn, "Enable the '$GpoName' link")) {
    Set-GPLink `
        -Name $GpoName `
        -Target $TargetOuDn `
        -Domain $domainName `
        -Server $DomainController `
        -LinkEnabled Yes | Out-Null
}

if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking workstations')) {
    Set-GPRegistryValue `
        -Name $GpoName `
        -Domain $domainName `
        -Server $DomainController `
        -Key $policyKey `
        -ValueName $policyValueName `
        -Type DWord `
        -Value 1 | Out-Null

    Set-GPRegistryValue `
        -Name $GpoName `
        -Domain $domainName `
        -Server $DomainController `
        -Key $desktopPolicyKey `
        -ValueName 'ScreenSaveActive' `
        -Type String `
        -Value '0' | Out-Null
}

$configuredValue = Get-GPRegistryValue `
    -Name $GpoName `
    -Domain $domainName `
    -Server $DomainController `
    -Key $policyKey `
    -ValueName $policyValueName
$screenSaverValue = Get-GPRegistryValue `
    -Name $GpoName `
    -Domain $domainName `
    -Server $DomainController `
    -Key $desktopPolicyKey `
    -ValueName 'ScreenSaveActive'
$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
    Where-Object DisplayName -eq $GpoName |
    Select-Object -First 1
$linkEnabled = $link -and (
    $link.Enabled -eq $true -or
    [string]$link.Enabled -eq 'Yes')

[pscustomobject]@{
    GpoName = $GpoName
    GpoId = $gpo.Id
    TargetOu = $TargetOuDn
    LinkEnabled = [bool]$linkEnabled
    DisableLockWorkstation = [int]$configuredValue.Value
    ScreenSaverDisabled = [string]$screenSaverValue.Value -eq '0'
}