#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]
param(
    [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
    [string]$GpoName = 'SGU - Laboratorio wallpaper protection',
    [string]$DomainController = $env:COMPUTERNAME,
    [string]$WallpaperPath = '%LOCALAPPDATA%\SGU\Wallpapers\welcome-%COMPUTERNAME%.jpg'
)

$ErrorActionPreference = 'Stop'
Import-Module ActiveDirectory -ErrorAction Stop
Import-Module GroupPolicy -ErrorAction Stop
$domainName = (Get-ADDomain -Server $DomainController).DNSRoot
Get-ADOrganizationalUnit -Identity $TargetOuDn -Server $DomainController -ErrorAction Stop | Out-Null
if (-not $PSCmdlet.ShouldProcess($TargetOuDn, "Apply '$GpoName' with enforced loopback Merge")) {
    return
}

$backupPath = $null
$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
if ($gpo) {
    $backupPath = Join-Path $env:ProgramData ('SGU\PolicyBackups\Wallpaper-' + [guid]::NewGuid().ToString('N'))
    New-Item -ItemType Directory -Path $backupPath -Force | Out-Null
    Backup-GPO -Guid $gpo.Id -Path $backupPath -Domain $domainName -Server $DomainController | Out-Null
}
else {
    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController `
        -Comment 'Protects the SGU desktop wallpaper on Laboratorio computers and child OUs; loopback Merge preserves existing user policies.'
}

# These are user policies scoped by the computer OU, not by the user OU.
# Match the per-user/per-computer output of Set-SguWelcomeWallpaper.ps1.
$settings = @(
    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\System'; Name = 'UserPolicyMode'; Type = 'DWord'; Value = 1 },
    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop'; Name = 'NoChangingWallPaper'; Type = 'DWord'; Value = 1 },
    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'Wallpaper'; Type = 'ExpandString'; Value = $WallpaperPath },
    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'WallpaperStyle'; Type = 'String'; Value = '10' }
)
foreach ($setting in $settings) {
    Set-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
        -Key $setting.Key -ValueName $setting.Name -Type $setting.Type -Value $setting.Value | Out-Null
}
$linkParameters = @{
    Guid = $gpo.Id
    Target = $TargetOuDn
    Domain = $domainName
    Server = $DomainController
    LinkEnabled = 'Yes'
    Enforced = 'Yes'
    Order = 1
}
$existingLink = (Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
    Where-Object GpoId -eq $gpo.Id
if ($existingLink) {
    Set-GPLink @linkParameters | Out-Null
}
else {
    New-GPLink @linkParameters | Out-Null
}
foreach ($setting in $settings) {
    $actual = Get-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
        -Key $setting.Key -ValueName $setting.Name
    if ([string]$actual.Value -ne [string]$setting.Value -or [string]$actual.Type -ne $setting.Type) {
        throw "Wallpaper policy verification failed for $($setting.Name)."
    }
}
[pscustomobject]@{
    Name = $gpo.DisplayName
    Id = $gpo.Id
    TargetOuDn = $TargetOuDn
    WallpaperPath = $WallpaperPath
    Loopback = 'Merge'
    Enforced = $true
    BackupPath = $backupPath
}