param(
    [switch]$ResetPrusa,
    [string]$TargetUser,
    [string]$Material = "PLA"
)

# Makerspace Manager
# Build Date: 07/03/2026 18:41

$xaml = @'
<Window xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
        Title="Makerspace Manager" Height="610" Width="530" 
        WindowStartupLocation="CenterScreen" Topmost="False" ResizeMode="CanResize"
        Background="#1E1E1E" Foreground="#E0E0E0">
    <Window.Resources>
        <Style TargetType="TextBlock">
            <Setter Property="FontFamily" Value="Segoe UI"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="CheckBox">
            <Setter Property="Margin" Value="0,5"/>
            <Setter Property="FontSize" Value="13"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="RadioButton">
            <Setter Property="FontSize" Value="14"/>
            <Setter Property="FontWeight" Value="SemiBold"/>
            <Setter Property="Margin" Value="10,0"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="GroupBox">
            <Setter Property="Foreground" Value="#E0E0E0"/>
            <Setter Property="BorderBrush" Value="#444444"/>
            <Setter Property="Margin" Value="0,0,0,10"/>
            <Setter Property="Padding" Value="10"/>
        </Style>
        <Style TargetType="TextBox">
             <Setter Property="Background" Value="#252525"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#404040"/>
             <Setter Property="BorderThickness" Value="1"/>
             <Setter Property="Padding" Value="6,4"/>
             <Setter Property="CaretBrush" Value="#0063B1"/>
             <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="TextBox">
                        <Border Name="Border" Background="{TemplateBinding Background}" BorderBrush="{TemplateBinding BorderBrush}" BorderThickness="1" CornerRadius="4">
                            <ScrollViewer x:Name="PART_ContentHost" />
                        </Border>
                    </ControlTemplate>
                </Setter.Value>
             </Setter>
        </Style>
        <Style TargetType="Button">
             <Setter Property="Background" Value="#333333"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#404040"/>
             <Setter Property="BorderThickness" Value="1"/>
             <Setter Property="Cursor" Value="Hand"/>
             <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="Button">
                        <Border Name="BtnBorder" Background="{TemplateBinding Background}" BorderBrush="{TemplateBinding BorderBrush}" BorderThickness="1" CornerRadius="4">
                            <Grid>
                                <Border Name="Overlay" Background="Transparent" CornerRadius="3"/>
                                <ContentPresenter HorizontalAlignment="Center" VerticalAlignment="Center" Margin="{TemplateBinding Padding}"/>
                            </Grid>
                        </Border>
                        <ControlTemplate.Triggers>
                            <Trigger Property="IsMouseOver" Value="True">
                                <Setter TargetName="Overlay" Property="Background" Value="#1FFFFFFF"/>
                                <Setter TargetName="BtnBorder" Property="BorderBrush" Value="#666666"/>
                            </Trigger>
                            <Trigger Property="IsPressed" Value="True">
                                <Setter TargetName="Overlay" Property="Background" Value="#3F000000"/>
                            </Trigger>
                        </ControlTemplate.Triggers>
                    </ControlTemplate>
                </Setter.Value>
             </Setter>
        </Style>

        <Style TargetType="TabControl">
            <Setter Property="Background" Value="Transparent"/>
            <Setter Property="BorderThickness" Value="0"/>
        </Style>

        <Style TargetType="TabItem">
            <Setter Property="Foreground" Value="#EEEEEE"/>
            <Setter Property="FontSize" Value="14"/>
            <Setter Property="FontWeight" Value="Bold"/>
            <Setter Property="Padding" Value="20,10"/>
            <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="TabItem">
                        <Border Name="TabBorder" Background="#444444" BorderBrush="#555555" BorderThickness="1,1,1,0" CornerRadius="5,5,0,0" Margin="0,0,3,0">
                            <ContentPresenter ContentSource="Header" Margin="{TemplateBinding Padding}" HorizontalAlignment="Center" VerticalAlignment="Center"/>
                        </Border>
                        <ControlTemplate.Triggers>
                            <MultiTrigger>
                                <MultiTrigger.Conditions>
                                    <Condition Property="IsSelected" Value="False"/>
                                    <Condition Property="IsMouseOver" Value="True"/>
                                </MultiTrigger.Conditions>
                                <Setter TargetName="TabBorder" Property="Background" Value="#555555" />
                                <Setter TargetName="TabBorder" Property="BorderBrush" Value="#666666" />
                            </MultiTrigger>
                            <Trigger Property="IsSelected" Value="True">
                                <Setter TargetName="TabBorder" Property="Background" Value="#0063B1"/>
                                <Setter TargetName="TabBorder" Property="BorderBrush" Value="#0063B1"/>
                                <Setter Property="Foreground" Value="#FFFFFF"/>
                            </Trigger>
                        </ControlTemplate.Triggers>
                    </ControlTemplate>
                </Setter.Value>
            </Setter>
        </Style>
    </Window.Resources>
    
    <ScrollViewer VerticalScrollBarVisibility="Auto">
        <StackPanel Margin="20">
            
            <Grid Margin="0,0,0,15">
                <Grid.ColumnDefinitions>
                    <ColumnDefinition Width="*" />
                    <ColumnDefinition Width="Auto" />
                </Grid.ColumnDefinitions>
                <StackPanel Grid.Column="0">
                    <TextBlock Text="Makerspace Manager" FontSize="22" FontWeight="Bold" Foreground="#0063B1"/>
                    <TextBlock Text="Last Updated: 07/03/2026 18:41" Foreground="#666666" FontSize="10" FontStyle="Italic" Margin="0,2,0,0"/>
                </StackPanel>
                <CheckBox Name="chkDebugMode" Grid.Column="1" Content="Debug Mode" FontSize="10" VerticalAlignment="Top" Foreground="#666666" Margin="0,5,0,0"/>
            </Grid>
            
            <StackPanel Margin="0,0,0,15">
                <TextBlock Text="Select Target User:" FontWeight="SemiBold" Margin="0,0,0,5" Foreground="#E0E0E0"/>
                
                <ListBox Name="listUsers" Height="40" Background="Transparent" BorderThickness="0" ScrollViewer.HorizontalScrollBarVisibility="Auto" ScrollViewer.VerticalScrollBarVisibility="Disabled">
                    <ListBox.ItemsPanel>
                        <ItemsPanelTemplate>
                            <WrapPanel Orientation="Horizontal" />
                        </ItemsPanelTemplate>
                    </ListBox.ItemsPanel>
                    <ListBox.ItemContainerStyle>
                        <Style TargetType="ListBoxItem">
                            <Setter Property="Background" Value="#2D2D2D"/>
                            <Setter Property="Foreground" Value="#E0E0E0"/>
                            <Setter Property="Margin" Value="0,0,6,0"/>
                            <Setter Property="Padding" Value="10,4"/>
                            <Setter Property="FontSize" Value="11"/>
                            <Setter Property="FontWeight" Value="SemiBold"/>
                            <Setter Property="Template">
                                <Setter.Value>
                                    <ControlTemplate TargetType="ListBoxItem">
                                        <Border CornerRadius="4" Background="{TemplateBinding Background}" Padding="{TemplateBinding Padding}" BorderBrush="#3D3D3D" BorderThickness="1">
                                            <ContentPresenter VerticalAlignment="Center" HorizontalAlignment="Center"/>
                                        </Border>
                                    </ControlTemplate>
                                </Setter.Value>
                            </Setter>
                            <Style.Triggers>
                                <Trigger Property="IsMouseOver" Value="True">
                                    <Setter Property="Background" Value="#3D3D3D"/>
                                    <Setter Property="BorderBrush" Value="#0063B1"/>
                                </Trigger>
                                <Trigger Property="IsSelected" Value="True">
                                    <Setter Property="Background" Value="#0063B1"/>
                                    <Setter Property="BorderBrush" Value="#0078D4"/>
                                    <Setter Property="Foreground" Value="White"/>
                                </Trigger>
                            </Style.Triggers>
                        </Style>
                    </ListBox.ItemContainerStyle>
                </ListBox>

            </StackPanel>

            <TabControl Background="#1E1E1E" BorderBrush="#0063B1" BorderThickness="0,2,0,0" Margin="0,0,0,15">
                <TabItem Header="Restrictions">
                    <StackPanel Margin="0,15,0,0">
                        <Border Background="#202020" Padding="12" CornerRadius="6" Margin="0,0,0,15" BorderBrush="#333333" BorderThickness="1">
                            <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
                                <RadioButton Name="rbLock" Content="LOCK MODE" IsChecked="True" Foreground="#FF8C8C" Margin="0,0,20,0"/>
                                <RadioButton Name="rbUnlock" Content="UNLOCK MODE" Foreground="#8CFF8C"/>
                            </StackPanel>
                        </Border>

                        <Grid>
                            <Grid.ColumnDefinitions>
                                <ColumnDefinition Width="*"/>
                                <ColumnDefinition Width="*"/>
                            </Grid.ColumnDefinitions>

                            <GroupBox Grid.Column="0" Header="System" Padding="5" Margin="0,0,5,10" VerticalAlignment="Stretch">
                                <StackPanel>
                                    <CheckBox Name="chkReg" Content="Block Registry Editor"/>
                                    <CheckBox Name="chkControl" Content="Block Settings &amp; Control Panel"/>
                                    <CheckBox Name="chkInstall" Content="Block .MSI Installations"/>
                                    <CheckBox Name="chkCmd" Content="Block Command Line (CMD/PS/Terminal)"/>
                                    <CheckBox Name="chkTaskMgr" Content="Block Task Manager"/>
                                    <CheckBox Name="chkNoDisp" Content="Block Display Settings"/>
                                    <CheckBox Name="chkAdminTools" Content="Block Administrator Tools (MMC/EventVwr)"/>
                                </StackPanel>
                            </GroupBox>

                            <GroupBox Grid.Column="1" Header="Explorer &amp; Browser" Padding="5" Margin="5,0,0,10" VerticalAlignment="Stretch">
                                <StackPanel>
                                    <CheckBox Name="chkNoRun" Content="Disable Run Command (Win+R)"/>
                                    <CheckBox Name="chkNoWallpaper" Content="Prevent Changing Wallpaper"/>
                                    <CheckBox Name="chkClearRecent" Content="Clear Recent Docs on Exit"/>
                                    <CheckBox Name="chkTaskbar" Content="Lock Taskbar Settings"/>
                                    <CheckBox Name="chkEdgePrivate" Content="Force Private Mode (Edge/Chrome)"/>
                                    <CheckBox Name="chkEdgeFav" Content="Lock Favorites (Edge/Chrome)"/>
                                </StackPanel>
                            </GroupBox>
                        </Grid>

                        <Button Name="btnSelectAll" Content="SELECT ALL" Height="42" Margin="0,0,0,10" Background="#333333" FontSize="14" FontWeight="Bold"/>
                        
                        <Button Name="btnApply" Content="LOCK" Height="42" Background="#C42B1C" Foreground="White" FontWeight="Bold" FontSize="14" BorderThickness="0"/>
                    </StackPanel>
                </TabItem>

                <TabItem Header="Tools">
                    <StackPanel Margin="0,15,0,0">
                        


                        <GroupBox Header="PrusaSlicer" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnPrusaNuke" Content="Reset PrusaSlicer to Defaults" Height="42" Background="#C42B1C" Foreground="White" FontWeight="Bold" Margin="0,0,0,8"/>
                                <Grid>
                                    <Grid.ColumnDefinitions>
                                        <ColumnDefinition Width="*"/>
                                        <ColumnDefinition Width="*"/>
                                    </Grid.ColumnDefinitions>
                                    <Button Grid.Column="0" Name="btnSchedulePrusa" Content="Create Schedule" Height="42" Margin="0,0,4,0" FontSize="14"/>
                                    <Button Grid.Column="1" Name="btnUnschedulePrusa" Content="Remove Schedule" Height="42" Margin="4,0,0,0" FontSize="14"/>
                                </Grid>
                                <TextBlock Name="lblPrusaStatus" Text="Status: Checking..." FontSize="10" Margin="0,5,0,0" Foreground="#888888" HorizontalAlignment="Center" TextWrapping="Wrap" TextAlignment="Center"/>
                            </StackPanel>
                        </GroupBox>

                        <GroupBox Header="Desktop Icons" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Grid>
                                    <Grid.ColumnDefinitions>
                                        <ColumnDefinition Width="*"/>
                                        <ColumnDefinition Width="*"/>
                                    </Grid.ColumnDefinitions>
                                    <Button Grid.Column="0" Name="btnLockDesktop" Content="Lock Icons" Height="42" Background="#333333" Foreground="White" FontWeight="Bold" Margin="0,0,5,0"/>
                                    <Button Grid.Column="1" Name="btnUnlockDesktop" Content="Unlock Icons" Height="42" Background="#333333" Foreground="White" FontWeight="Bold" Margin="5,0,0,0"/>
                                </Grid>
                            </StackPanel>
                        </GroupBox>

                        <GroupBox Header="Create Shortcut" Margin="0,0,0,10" Padding="10">
                            <StackPanel>
                                <Button Name="btnInstallShortcut" Content="Create Script Shortcut" Height="42" Background="#0063B1" Foreground="White" FontWeight="Bold"/>
                            </StackPanel>
                        </GroupBox>

                    </StackPanel>
                </TabItem>
            </TabControl>

            <GroupBox Header="Status Log" Padding="5" Margin="0,5,0,0">
                 <RichTextBox Name="txtLog" IsReadOnly="True" VerticalScrollBarVisibility="Auto" 
                             FontFamily="Consolas" FontSize="11" Background="#252526" BorderThickness="0" 
                             HorizontalAlignment="Stretch" Height="180">
                    <FlowDocument>
                        <Paragraph Margin="0"><Run Text="Ready..." Foreground="#888888"/></Paragraph>
                    </FlowDocument>
                </RichTextBox>
            </GroupBox>
        </StackPanel>
    </ScrollViewer>
 </Window>

'@

$global:prusaIni = @'
# generated by PrusaSlicer 2.9.4 on 2026-02-26 at 07:52:39 UTC
alert_when_supports_needed = 1
allow_auto_color_change = 1
allow_ip_resolve = 1
angle_precision = 1.
associate_3mf = 1
associate_stl = 1
auth_login_dialog_confirmed = 0
auto_toolbar_size = 77
background_processing = 0
clear_undo_redo_stack_on_new_project = 1
collapsed_sidebar = 0
color_mapinulation_panel = 0
connect_polling = 1
custom_toolbar_size = 100
dark_color_mode = 1
default_action_on_close_application = none
default_action_on_new_project = none
default_action_on_select_preset = none
downloader_url_registered = 1
drop_project_action = 1
export_sources_full_pathnames = 0
linear_precision = 0.005
no_controller = 1
no_defaults = 1
no_templates = 0
non_manifold_edges = 1
notify_release = none
order_volumes = 1
preset_update = 0
remember_output_path = 1
remember_output_path_removable = 1
restore_win_position = 1
reverse_mouse_wheel_zoom = 0
seq_top_layer_only = 1
show_drop_project_dialog = 1
show_estimated_times_in_dbl_slider = 1
show_hints = 0
show_incompatible_presets = 0
show_login_button = 0
show_ruler_bg_in_dbl_slider = 1
show_ruler_in_dbl_slider = 0
show_splash_screen = 1
show_step_import_parameters = 1
single_instance = 0
suppress_round_corners = 1
sys_menu_enabled = 1
url_downloader_dest = C:\Users\DefaultUser\Downloads
use_binary_gcode_when_supported = 1
use_custom_toolbar_size = 0
use_free_camera = 0
use_inches = 0
use_legacy_3DConnexion = 0
use_perspective_camera = 1
version = 2.9.4
version_online = 2.9.4
version_system_info_sent = 2.9.4
view_mode = expert
wifi_config_dialog_declined = 0

[filaments]
DefaultMaterial = 1
DefaultMaterial @Template = 1

[presets]
filament = DefaultMaterial
physical_printer = 
print = 0.15mm QUALITY @MK3
printer = Original Prusa i3 MK3S & MK3S+
sla_material = 
sla_print = 

[vendor:PrusaResearch]
model:MK3S = 0.4

# (Checksum removed to allow auto-generation)
'@

# ADMIN CHECK 
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "You must run this script as Administrator!"
    Start-Sleep -Seconds 3
    Exit
}

$ErrorActionPreference = "Stop"

# GLOBAL SETTINGS
$global:installDir = "$env:SystemDrive\MakerspaceManager"
$logDir = Join-Path $global:installDir "Logs"
if (-not (Test-Path $logDir)) {
    New-Item -Path $logDir -ItemType Directory -Force | Out-Null
}

try {
    if ($global:installDir -like "*MakerspaceManager") {
        $aclCmd = "icacls `"$global:installDir`" /inheritance:r /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-18:(OI)(CI)F /q"
        cmd.exe /c $aclCmd | Out-Null
    }
}
catch {}

$logTimestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
$global:logFile = Join-Path $logDir "MakerspaceManager_${logTimestamp}.log"

# LOGGING
function Log ($msg, $color = "Normal") {
    $timestamp = (Get-Date).ToString('HH:mm:ss')
    $logEntry = "[$timestamp] $msg"

    if ($null -ne $txtLog) {
        try {
            $paragraph = New-Object System.Windows.Documents.Paragraph
            $paragraph.Margin = New-Object System.Windows.Thickness(0)
            $run = New-Object System.Windows.Documents.Run
            $run.Text = $logEntry
            if ($color -like "#*") {
                $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString($color)
            }
            else {
                switch ($color) {
                    "Red" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF8C8C") }
                    "Green" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C") }
                    "Blue" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#60A5FA") }
                    "Cyan" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#60A5FA") }
                    "Yellow" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FFD93D") }
                    default { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#DDDDDD") }
                }
            }
            $paragraph.Inlines.Add($run)
            $txtLog.Document.Blocks.Add($paragraph)
            $txtLog.ScrollToEnd()
            
            $frame = New-Object System.Windows.Threading.DispatcherFrame
            [System.Windows.Threading.Dispatcher]::CurrentDispatcher.BeginInvoke([System.Windows.Threading.DispatcherPriority]::Background, [System.Action[System.Windows.Threading.DispatcherFrame]] { param($f) $f.Continue = $false }, $frame) | Out-Null
            [System.Windows.Threading.Dispatcher]::PushFrame($frame)
        }
        catch {
            Write-Host $logEntry
        }
    }
    else {
        Write-Host $logEntry
    }

    try {
        $logEntry | Out-File -FilePath $global:logFile -Append -Encoding UTF8
    }
    catch {}
}

function Debug-Log ($msg) {
    if ($null -ne $global:chkDebugMode -and $global:chkDebugMode.IsChecked -eq $true) {
        Log "[DEBUG] $msg" "#888888"
    }
}

# LOG MAINTENANCE
function Remove-OldLogs ($path, $maxFiles = 20, $maxSizeMB = 50) {
    try {
        if (-not (Test-Path $path)) { return }
        $files = Get-ChildItem -Path $path -Filter "*.log" | Sort-Object LastWriteTime -Descending
        
        if ($files.Count -gt $maxFiles) {
            $files | Select-Object -Skip $maxFiles | Remove-Item -Force -ErrorAction SilentlyContinue
            $files = Get-ChildItem -Path $path -Filter "*.log" | Sort-Object LastWriteTime -Descending
        }

        $totalSize = ($files | Measure-Object -Property Length -Sum).Sum
        if ($totalSize -gt ($maxSizeMB * 1MB)) {
            $currentSize = $totalSize
            foreach ($f in ($files | Sort-Object LastWriteTime)) {
                if ($currentSize -le ($maxSizeMB * 1MB)) { break }
                $currentSize -= $f.Length
                Remove-Item -Path $f.FullName -Force -ErrorAction SilentlyContinue
            }
        }
    }
    catch {}
}

# REGISTRY HELPERS
function Get-UserSID ($targetUser) {
    Debug-Log "Get-UserSID: Resolving SID for '$targetUser'..."
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $null }

    # Method 1: Win32_UserAccount: Works regardless of calling token (SYSTEM, user, PS5/PS7)
    # Handles renamed machines, Finnish/localized account names, MSA-linked accounts
    try {
        $acct = Get-WmiObject -Class Win32_UserAccount | Where-Object { $_.Name -eq $targetUser }
        if ($acct) {
            Debug-Log "Get-UserSID: Resolved via Win32_UserAccount -> SID: $($acct.SID)"
            return $acct.SID
        }
    }
    catch { Debug-Log "Get-UserSID: Win32_UserAccount lookup failed: $_" }

    # Method 2: NTAccount translation: Fallback for standard local accounts when WMI fails
    try { 
        $sid = (New-Object System.Security.Principal.NTAccount($targetUser)).Translate([System.Security.Principal.SecurityIdentifier]).Value
        Debug-Log "Get-UserSID: Resolved via NTAccount -> SID: $sid"
        return $sid
    } 
    catch {
        $f = if ($targetUser -notmatch '\\') { ".\$targetUser" } else { $targetUser }
        try { 
            $sid = (New-Object System.Security.Principal.NTAccount($f)).Translate([System.Security.Principal.SecurityIdentifier]).Value
            Debug-Log "Get-UserSID: Resolved via NTAccount (prefixed) -> SID: $sid"
            return $sid
        }
        catch {}
    }

    Debug-Log "Get-UserSID: All methods failed for '$targetUser'"
    return $null
}

function Invoke-HiveUnload ($hiveName) {
    if (Test-Path "HKLM:\$hiveName") {
        & reg.exe unload "HKLM\$hiveName" *>$null
        if ($LASTEXITCODE -ne 0) {
            [System.GC]::Collect()
            [System.GC]::WaitForPendingFinalizers()
            Start-Sleep -Milliseconds 100
            & reg.exe unload "HKLM\$hiveName" *>$null
        }
    }
}

# SYSTEM CHECKS
function Test-IsAdmin ($targetUser) {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $false }
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    if ($targetUser -eq $actualUser) { return $true }
    
    $isAdmin = $false
    try {
        # Resolve marginalized/localized name for Administrators group using SID (always S-1-5-32-544)
        $sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544")
        $localGroupName = ($sid.Translate([System.Security.Principal.NTAccount]).Value -split '\\' | Select-Object -Last 1)

        $admins = Get-LocalGroupMember -Group $localGroupName -ErrorAction SilentlyContinue
        if ($admins | Where-Object { ($_.Name -split '\\' | Select-Object -Last 1) -eq $targetUser }) { $isAdmin = $true }
        
        if (-not $isAdmin) {
            $netAdmins = & net localgroup $localGroupName 2>$null
            if ($netAdmins -match "\b$targetUser\b") { $isAdmin = $true }
        }
    }
    catch {}

    return $isAdmin
}

function Test-IsUserLoggedOn ($targetUser) {
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $false }
    try {
        $p = Get-Process -IncludeUserName -ErrorAction SilentlyContinue | Where-Object { $_.UserName -match "\\$targetUser$" -or $_.UserName -eq $targetUser }
        return ($null -ne $p -and $p.Count -gt 0)
    }
    catch { return $false }
}

function Get-UserProfilePath ($targetUser) {
    Debug-Log "Get-UserProfilePath: Finding profile for '$targetUser'..."
    if ([string]::IsNullOrWhiteSpace($targetUser)) { return $null }
    $sid = Get-UserSID $targetUser
    if (!$sid) { 
        Debug-Log "Get-UserProfilePath: Failing (No SID found)"
        return $null 
    }
    Debug-Log "Get-UserProfilePath: SID found: '$sid'"
    try {
        # Query WMI for the actual local profile path
        $path = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.SID -eq $sid } | Select-Object -ExpandProperty LocalPath -ErrorAction SilentlyContinue
        if ($path -and (Test-Path $path)) { 
            Debug-Log "Get-UserProfilePath: Found via WMI: $path"
            return $path 
        }
    }
    catch { Debug-Log "Get-UserProfilePath: WMI search failed: $_" }
    
    # Fallback to standard path if WMI fails
    $fallback = "$env:SystemDrive\Users\$targetUser"
    Debug-Log "Get-UserProfilePath: Trying fallback path: $fallback"
    if (Test-Path $fallback) { 
        Debug-Log "Get-UserProfilePath: Found via Fallback"
        return $fallback 
    }
    Debug-Log "Get-UserProfilePath: Failing (Path not found)"
    return $null
}

function Get-UserDesktopPath ($targetUser) {
    $profileBase = Get-UserProfilePath $targetUser
    if (!$profileBase) { return $null }

    # Try common localized names (English, Finnish, Swedish, etc.)
    $names = @("Desktop", "Työpöytä", "Skrivbord")
    foreach ($n in $names) {
        $path = Join-Path $profileBase $n
        if (Test-Path $path) { return $path }
    }
    return $null
}

function Test-AppInstalled ($appName) {
    # Check 64-bit and 32-bit Uninstall registry keys
    $regPaths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
        "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    )
    foreach ($rp in $regPaths) {
        if (Get-ChildItem $rp -ErrorAction SilentlyContinue | Get-ItemProperty | Where-Object { $_.DisplayName -like "*$appName*" }) {
            return $true
        }
    }
    return $false
}

function Test-PrusaInstalled {
    return (Test-AppInstalled "PrusaSlicer") -or
    (Test-Path "C:\Program Files\Prusa3D\PrusaSlicer\prusa-slicer.exe") -or
    (Test-Path "C:\Program Files (x86)\Prusa3D\PrusaSlicer\prusa-slicer.exe")
}

# UNIFIED POLICY ENGINE
function Set-RegistryValue ($baseKey, $desc, $subKeyPath, $name, $value, $type, $lock) {
    # $baseKey is a Microsoft.Win32.RegistryKey
    Debug-Log "Update-Reg: SubKey='$subKeyPath', Name='$name', Value='$value', Type='$type', Lock=$lock"
    try {
        if ($lock) {
            $key = $baseKey.CreateSubKey($subKeyPath)
            if ($null -eq $key) { Log " [!] Error: Cannot create/open $subKeyPath" "Red"; return $false }
            
            $existing = $key.GetValue($name)
            if ($null -ne $existing -and $existing.ToString() -eq $value.ToString()) {
                if ($desc) { Log " [-] $desc already set. Skipping..." "Yellow" }
                $key.Close()
                return $false
            }

            # Map type string to RegistryValueKind
            $kind = switch ($type) {
                "DWord" { [Microsoft.Win32.RegistryValueKind]::DWord }
                "String" { [Microsoft.Win32.RegistryValueKind]::String }
                default { [Microsoft.Win32.RegistryValueKind]::String }
            }

            $key.SetValue($name, $value, $kind)
            if ($desc) { Log " [x] $desc BLOCKED" "Red" }
            $key.Close()
            return $true
        }
        else {
            $key = $baseKey.OpenSubKey($subKeyPath, $true)
            if ($null -eq $key) { 
                if ($desc) { Log " [-] $desc already removed. Skipping..." "Yellow" }
                return $false 
            }
            
            $existing = $key.GetValue($name)
            if ($null -eq $existing) {
                if ($desc) { Log " [-] $desc already removed. Skipping..." "Yellow" }
                $key.Close()
                return $false
            }

            $key.DeleteValue($name, $false)
            if ($desc) { Log " [x] $desc UNBLOCKED" "Green" }
            $key.Close()
            return $true
        }
    }
    catch {
        Log (" [!] Error updating " + $desc + ": " + $_) "Red"
        return $false
    }
}
function Initialize-LocalScript {
    Debug-Log "Initialize-LocalScript: installDir='$global:installDir'"
    if ([string]::IsNullOrWhiteSpace($global:installDir)) {
        Log "Error: installDir is empty. Cannot create local script copy." "Red"
        return $null
    }

    $localPath = Join-Path $global:installDir "MakerspaceManager_Local.ps1"
    Debug-Log "Initialize-LocalScript: localPath='$localPath'"

    # Force update: if (Test-Path $localPath) {
    #     Debug-Log "Initialize-LocalScript: Local copy already exists, reusing."
    #     return $localPath
    # }

    Log "Preparing local script copy for scheduling..." "Yellow"

    if (-not (Test-Path $global:installDir)) {
        Debug-Log "Initialize-LocalScript: Creating installDir..."
        New-Item -Path $global:installDir -ItemType Directory -Force | Out-Null
    }

    $scriptContent = ""
    Debug-Log "Initialize-LocalScript: PSCommandPath='$PSCommandPath'"

    try {
        if (-not [string]::IsNullOrWhiteSpace($PSCommandPath) -and (Test-Path $PSCommandPath)) {
            Debug-Log "Initialize-LocalScript: Reading from PSCommandPath..."
            $scriptContent = Get-Content $PSCommandPath -Raw
            Debug-Log "Initialize-LocalScript: Read $($scriptContent.Length) chars from file."
        }
        else {
            Debug-Log "Initialize-LocalScript: PSCommandPath unavailable. Downloading from server..."
            Log "Downloading script copy from server..." "Blue"
            $scriptContent = Invoke-RestMethod "https://msm.samwhitley.com" -ErrorAction Stop
            Debug-Log "Initialize-LocalScript: Downloaded $($scriptContent.Length) chars."
        }
    }
    catch {
        Log "Error creating local copy: $_" "Red"
        Debug-Log "Initialize-LocalScript: Exception detail: $($_.Exception.Message)"
        Debug-Log "Initialize-LocalScript: Exception at: $($_.InvocationInfo.PositionMessage)"
        return $null
    }

    if ([string]::IsNullOrWhiteSpace($scriptContent)) {
        Log "Error: Script content was empty. Cannot save local copy." "Red"
        Debug-Log "Initialize-LocalScript: Content was null/empty -- aborting."
        return $null
    }

    try {
        Debug-Log "Initialize-LocalScript: Writing to '$localPath'..."
        $scriptContent | Out-File $localPath -Encoding UTF8 -Force
        Log "Local copy saved to $localPath" "Green"
        return $localPath
    }
    catch {
        Log "Error writing local copy: $_" "Red"
        Debug-Log "Initialize-LocalScript: Write exception: $($_.Exception.Message)"
        return $null
    }
}

# POLICY STATUS
function Invoke-StatusCheck ($targetUser, $clearLog) {
    if ($clearLog) { $txtLog.Document.Blocks.Clear() }

    if ([string]::IsNullOrWhiteSpace($targetUser)) {
        Log "Error: Please enter a username." "Red"
        return
    }

    # UI Reset
    $allChecks = @($chkReg, $chkControl, $chkInstall, $chkCmd, $chkTaskMgr, $chkNoDisp, $chkNoRun, $chkNoWallpaper, $chkClearRecent, $chkTaskbar, $chkEdgePrivate, $chkEdgeFav, $chkAdminTools)
    $colorNeutral = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#EEEEEE") 
    $colorLocked = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF8C8C")  
    $colorUnlocked = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C") 
    
    foreach ($c in $allChecks) { $c.Foreground = $colorNeutral }

    # Use whoami for current-user check: $env:USERNAME can be "SYSTEM" when launched via irm|iex
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    $isCurrentUser = ($targetUser -eq $actualUser)
    Debug-Log "StatusCheck: actualUser='$actualUser', targetUser='$targetUser', isCurrentUser=$isCurrentUser"
    Log "Checking status for '$targetUser'..." "Blue"

    $registry = $null
    $hiveName = "MSM_TempHive"
    $loadedViaReg = $false

    if ($isCurrentUser) {
        $registry = [Microsoft.Win32.Registry]::CurrentUser
        Log "Using current user hive (HKCU)..." "Yellow"
    }
    else {
        $sid = Get-UserSID $targetUser
        Debug-Log "StatusCheck: Target SID '$sid'"
        if ($null -ne $sid) {
            $subKey = [Microsoft.Win32.Registry]::Users.OpenSubKey($sid)
            if ($null -ne $subKey) {
                $registry = $subKey
                if (Test-IsUserLoggedOn $targetUser) {
                    Log "User is logged in. Checking live session hive..." "Yellow"
                }
                else {
                    Log "Targeting resident registry hive..." "Yellow"
                }
            }
        }

        if ($null -eq $registry) {
            $profilePath = Get-UserProfilePath $targetUser
            if (!$profilePath) { 
                Log "Error: Could not find profile folder for '$targetUser'." "Red"
                return 
            }
            $userPath = Join-Path $profilePath "NTUSER.DAT"
            if (-not (Test-Path $userPath)) { 
                Log "Error: NTUSER.DAT not found at: $userPath" "Red"
                return 
            }
            
            Invoke-HiveUnload $hiveName
            
            Log "Loading Registry Hive..." "Blue"
            Debug-Log "Loading Hive from: $userPath"
            & reg.exe load "HKLM\$hiveName" "$userPath" *>$null
            
            if ($LASTEXITCODE -eq 0) {
                Debug-Log "Hive loaded successfully into HKLM\$hiveName"
                $registry = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($hiveName)
                $loadedViaReg = $true
            }
            else {
                Debug-Log "Hive load FAILED with exit code: $LASTEXITCODE"
                Log "Could not load hive. (Error code: $LASTEXITCODE)." "Red"
                return
            }
        }
    }

    if ($null -eq $registry) { 
        Log "Failed to access registry root." "Red"
        return 
    }

    try {
        # Fast Lookup Helper
        $GetVal = {
            param($path, $name)
            $key = $registry.OpenSubKey($path)
            if ($null -eq $key) { return $null }
            $val = $key.GetValue($name)
            $key.Close()
            return $val
        }

        # Check Everything
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableRegistryTools") -eq 1) { $chkReg.Foreground = $colorLocked } else { $chkReg.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoControlPanel") -eq 1) { $chkControl.Foreground = $colorLocked } else { $chkControl.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Policies\Microsoft\Windows\Installer" "DisableMSI") -eq 1) { $chkInstall.Foreground = $colorLocked } else { $chkInstall.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Policies\Microsoft\Windows\System" "DisableCMD") -eq 2) { $chkCmd.Foreground = $colorLocked } else { $chkCmd.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableTaskMgr") -eq 1) { $chkTaskMgr.Foreground = $colorLocked } else { $chkTaskMgr.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\System" "NoDispCPL") -eq 1) { $chkNoDisp.Foreground = $colorLocked } else { $chkNoDisp.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" "10") -eq "mmc.exe") { $chkAdminTools.Foreground = $colorLocked } else { $chkAdminTools.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoRun") -eq 1) { $chkNoRun.Foreground = $colorLocked } else { $chkNoRun.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" "NoChangingWallPaper") -eq 1) { $chkNoWallpaper.Foreground = $colorLocked } else { $chkNoWallpaper.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "ClearRecentDocsOnExit") -eq 1) { $chkClearRecent.Foreground = $colorLocked } else { $chkClearRecent.Foreground = $colorUnlocked }
        if ((& $GetVal "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "LockTaskbar") -eq 1) { $chkTaskbar.Foreground = $colorLocked } else { $chkTaskbar.Foreground = $colorUnlocked }
            
        # Browsers
        $edgePriv = & $GetVal "Software\Policies\Microsoft\Edge" "InPrivateModeAvailability"
        $chromePriv = & $GetVal "Software\Policies\Google\Chrome" "IncognitoModeAvailability"
        if ($edgePriv -eq 2 -or $chromePriv -eq 2) { $chkEdgePrivate.Foreground = $colorLocked } else { $chkEdgePrivate.Foreground = $colorUnlocked }

        $edgeFav = & $GetVal "Software\Policies\Microsoft\Edge" "EditFavoritesEnabled"
        $chromeFav = & $GetVal "Software\Policies\Google\Chrome" "EditBookmarksEnabled"
        if ($edgeFav -eq 0 -or $chromeFav -eq 0 -or $null -ne (& $GetVal "Software\Policies\Microsoft\Edge" "ManagedFavorites") -or $null -ne (& $GetVal "Software\Policies\Google\Chrome" "ManagedBookmarks")) { 
            $chkEdgeFav.Foreground = $colorLocked 
        }
        else { 
            $chkEdgeFav.Foreground = $colorUnlocked 
        }

        # Summary Log
        $lockedCount = 0
        foreach ($c in $allChecks) { if ($c.Foreground -eq $colorLocked) { $lockedCount++ } }
        Log "Status check complete. ($lockedCount restrictions found)" "Green"
    }
    finally {
        if ($null -ne $registry -and -not $isCurrentUser) { $registry.Close() }
        if ($loadedViaReg) { Invoke-HiveUnload $hiveName }
    }
}

# PRUSASLICER CLEANUP
function Start-PrusaReset ($targetUser, $material = "PLA") {
    if ([string]::IsNullOrWhiteSpace($targetUser)) {
        Log "Error: Please enter a username." "Red"
        return
    }

    try {
        Log "Starting PrusaSlicer reset for $targetUser..." "Blue"

        # Close PrusaSlicer if running
        $proc = Get-Process -Name "prusa-slicer" -ErrorAction SilentlyContinue
        if ($null -ne $proc) {
            Log "Stopping PrusaSlicer process..." "Yellow"
            Debug-Log "Process ID to stop: $($proc.Id)"
            $proc | Stop-Process -Force -ErrorAction SilentlyContinue
            Start-Sleep -Milliseconds 500
        }

        $profilePath = Get-UserProfilePath $targetUser
        Debug-Log "PrusaReset: Profile path resolved: $profilePath"
        if (!$profilePath) {
            Log "Error: Could not find profile folder for '$targetUser'." "Red"
            return
        }
        $basePath = Join-Path $profilePath "AppData\Roaming\PrusaSlicer"
        if (-not (Test-Path $basePath)) {
            Log "Creating PrusaSlicer config directory at: $basePath" "Yellow"
            New-Item -Path $basePath -ItemType Directory -Force | Out-Null
        }

        # Delete User Presets and Cache (Excluding "vendor" to avoid config wizard)
        $folders = @("print", "filament", "printer", "cache", "physical_printer")
        foreach ($f in $folders) {
            $fPath = Join-Path $basePath $f
            if (Test-Path $fPath) {
                Log " [x] Deleting: $f folder..." "Red"
                Remove-Item -Path "$fPath" -Recurse -Force -ErrorAction SilentlyContinue
                New-Item -Path $fPath -ItemType Directory -Force | Out-Null
            }
        }

        # Remove potential backup files that could cause issues
        $bakFile = Join-Path $basePath "PrusaSlicer.ini.bak"
        if (Test-Path $bakFile) {
            Log " [x] Deleting PrusaSlicer.ini.bak..." "Red"
            Remove-Item $bakFile -Force -ErrorAction SilentlyContinue
        }

        # Apply Default Config
        $destFile = Join-Path $basePath "PrusaSlicer.ini"
        
        # Access bundled INI (set by build script) or local file
        $iniContent = ""
        if (Get-Variable -Name "prusaIni" -ErrorAction SilentlyContinue) {
            $iniContent = $global:prusaIni
        }
        else {
            $localIni = Join-Path $global:installDir "PrusaSlicer.ini"
            if (Test-Path $localIni) { $iniContent = Get-Content $localIni -Raw }
        }

        if ([string]::IsNullOrWhiteSpace($iniContent)) {
            Log "Error: Default PrusaSlicer.ini template not found." "Red"
            return
        }

        $profileFolderName = Split-Path $profilePath -Leaf
        Debug-Log "PrusaReset: profilePath='$profilePath'"
        Debug-Log "PrusaReset: profileFolderName='$profileFolderName'"
        Debug-Log "PrusaReset: destFile='$destFile'"
        Debug-Log "PrusaReset: material='$material'"

        Log "Applying default configuration ($material)..." "Yellow"
        $iniContent = $iniContent.Trim()
        $iniContent = $iniContent.Replace("DefaultUser", $profileFolderName)
        $iniContent = $iniContent.Replace("DefaultMaterial", $material)

        # Write file without BOM for better compatibility
        [System.IO.File]::WriteAllText($destFile, $iniContent, (New-Object System.Text.UTF8Encoding $false))
        Debug-Log "PrusaReset: INI written successfully. File size: $((Get-Item $destFile).Length) bytes"
        Log "SUCCESS: PrusaSlicer reset complete for $targetUser. INI saved to: $destFile" "Green"
    }
    catch {
        Log "ERROR during PrusaSlicer reset: $_" "Red"
    }
}

function Update-PrusaScheduleStatus {
    try {
        if ($null -eq $global:lblPrusaStatus) { return }

        $exclude = @("Administrator", "Guest", "DefaultAccount", "WDAGUtilityAccount")
        $allUsers = Get-LocalUser | Where-Object { $_.Enabled -and $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        $allTasks = Get-ScheduledTask -TaskName "Makerspace_PrusaReset_*" -ErrorAction SilentlyContinue
        
        $scheduledUsers = @()
        if ($allTasks) {
            $scheduledUsers = $allTasks | ForEach-Object { $_.TaskName.Replace("Makerspace_PrusaReset_", "") }
        }

        $notScheduledUsers = $allUsers | Where-Object { $scheduledUsers -notcontains $_ }

        $global:lblPrusaStatus.Inlines.Clear()
        
        if ($scheduledUsers.Count -gt 0) {
            $run1 = New-Object System.Windows.Documents.Run("SCHEDULED: $($scheduledUsers -join ', ')")
            $run1.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#8CFF8C") # Green
            $global:lblPrusaStatus.Inlines.Add($run1)
        }
        
        if ($scheduledUsers.Count -gt 0 -and $notScheduledUsers.Count -gt 0) {
            $global:lblPrusaStatus.Inlines.Add((New-Object System.Windows.Documents.LineBreak))
        }
        
        if ($notScheduledUsers.Count -gt 0) {
            $run2 = New-Object System.Windows.Documents.Run("NOT SCHEDULED: $($notScheduledUsers -join ', ')")
            $run2.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FFD93D") # Yellow
            $global:lblPrusaStatus.Inlines.Add($run2)
        }
    }
    catch {
        if ($null -ne $global:lblPrusaStatus) {
            $global:lblPrusaStatus.Inlines.Clear()
            $global:lblPrusaStatus.Inlines.Add((New-Object System.Windows.Documents.Run("Status: Check Failed")))
        }
    }
}

# UI BOOTSTRAP 
Add-Type -AssemblyName PresentationFramework
Add-Type -AssemblyName System.Windows.Forms

# Load XAML (Assumes $xaml is already defined by build script)
$reader = [System.Xml.XmlReader]::Create([System.IO.StringReader]::new($xaml))
$global:window = [System.Windows.Markup.XamlReader]::Load($reader)
$global:window.Title = "Makerspace Manager"

# Setup Controls Helper
function Get-Ctrl ($name) { $global:window.FindName($name) }

# Global Control References
$global:rbLock = Get-Ctrl "rbLock"
$global:rbUnlock = Get-Ctrl "rbUnlock"
$global:chkReg = Get-Ctrl "chkReg"
$global:chkControl = Get-Ctrl "chkControl"
$global:chkInstall = Get-Ctrl "chkInstall"
$global:chkCmd = Get-Ctrl "chkCmd"
$global:chkTaskMgr = Get-Ctrl "chkTaskMgr"
$global:chkNoDisp = Get-Ctrl "chkNoDisp"
$global:chkAdminTools = Get-Ctrl "chkAdminTools"
$global:chkNoRun = Get-Ctrl "chkNoRun"
$global:chkNoWallpaper = Get-Ctrl "chkNoWallpaper"
$global:chkClearRecent = Get-Ctrl "chkClearRecent"
$global:chkTaskbar = Get-Ctrl "chkTaskbar"
$global:chkEdgePrivate = Get-Ctrl "chkEdgePrivate"
$global:chkEdgeFav = Get-Ctrl "chkEdgeFav"
$global:btnSelectAll = Get-Ctrl "btnSelectAll"
$global:btnApply = Get-Ctrl "btnApply"

$global:btnPrusaNuke = Get-Ctrl "btnPrusaNuke"
$global:btnSchedulePrusa = Get-Ctrl "btnSchedulePrusa"
$global:btnUnschedulePrusa = Get-Ctrl "btnUnschedulePrusa"
$global:lblPrusaStatus = Get-Ctrl "lblPrusaStatus"
$global:btnLockDesktop = Get-Ctrl "btnLockDesktop"
$global:btnUnlockDesktop = Get-Ctrl "btnUnlockDesktop"
$global:btnInstallShortcut = Get-Ctrl "btnInstallShortcut"
$global:listUsers = Get-Ctrl "listUsers"
$global:txtLog = Get-Ctrl "txtLog"
$global:chkDebugMode = Get-Ctrl "chkDebugMode"

# Feature Initialize logic
function Update-UserList {
    if ($null -eq $global:listUsers) { return }
    $global:listUsers.Items.Clear()
    $exclude = @("Administrator", "Guest", "DefaultAccount", "WDAGUtilityAccount")
    $foundUsers = @()

    # Method 1: Get-LocalUser (Standard Local Accounts)
    try {
        Debug-Log "Attempting Get-LocalUser..."
        $locals = Get-LocalUser | Where-Object { $_.Enabled -and $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        if ($locals) { Debug-Log "Found via Get-LocalUser: $($locals -join ', ')" }
        $foundUsers += $locals
    }
    catch { Debug-Log "Method 1 (Get-LocalUser) failed: $_" }
    
    # Method 2: CIM/WMI (Microsoft Accounts and Fallback)
    try {
        Debug-Log "Attempting CIM/WMI User Search..."
        $wmiFilter = "LocalAccount=True AND Disabled=False"
        $wmiUsers = if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) {
            Debug-Log "Using Get-CimInstance (Modern/PS7)"
            Get-CimInstance -ClassName Win32_UserAccount -Filter $wmiFilter
        }
        else {
            Debug-Log "Using Get-WmiObject (Legacy)"
            Get-WmiObject -Class Win32_UserAccount -Filter $wmiFilter
        }
        $wNames = $wmiUsers | Where-Object { $exclude -notcontains $_.Name } | Select-Object -ExpandProperty Name
        if ($wNames) { Debug-Log "Found via CIM/WMI: $($wNames -join ', ')" }
        $foundUsers += $wNames
    }
    catch { Debug-Log "Method 2 (CIM/WMI) failed: $_" }

    # Method 3: Profile Search cross-referenced with Win32_UserAccount.
    # Avoids NTAccount.Translate(SID) which silently fails when running as SYSTEM.
    # This catches accounts whose profile folder name differs from their account name (e.g. Omenanpaja3 -> C:\Users\entre)
    try {
        Debug-Log "Attempting Profile Folder Discovery..."
        $profiles = Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false }
        $allAccounts = Get-WmiObject -Class Win32_UserAccount | Group-Object SID -AsHashTable -AsString
        foreach ($p in $profiles) {
            Debug-Log "Discovered Profile Path: $($p.LocalPath)"
            $acct = $allAccounts[$p.SID]
            if ($acct) {
                $name = $acct.Name
                if ($exclude -notcontains $name) {
                    Debug-Log "Resolved Profile SID $($p.SID) to User: $name"
                    $foundUsers += $name
                }
            }
            else {
                Debug-Log "No Win32_UserAccount match for SID $($p.SID) - skipping"
            }
        }
    }
    catch { Debug-Log "Method 3 (Profile Search) failed: $_" }

    # Deduplicate and sort
    $finalList = $foundUsers | Select-Object -Unique | Sort-Object

    # Use whoami for pre-selection: $env:USERNAME is "SYSTEM" when launched via irm|iex in Windows Terminal
    $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
    Debug-Log "Update-UserList: actualUser='$actualUser'"

    foreach ($u in $finalList) {
        [void]$global:listUsers.Items.Add($u)
        if ($u -eq $actualUser) { $global:listUsers.SelectedItem = $u }
    }
    
    if ($null -eq $global:listUsers.SelectedItem -and $global:listUsers.Items.Count -gt 0) { $global:listUsers.SelectedIndex = 0 }
    Debug-Log "Final deduped user list: $($finalList -join ', ')"
}

# TAB NAVIGATION
$rbLock.Add_Checked({
        $txtLog.Document.Blocks.Clear()
        $btnApply.Content = "LOCK"
        $btnApply.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#C42B1C")
        $btnApply.Foreground = [System.Windows.Media.Brushes]::White

        $chkReg.Content = "Block Registry Editor"
        $chkControl.Content = "Block Settings & Control Panel"
        $chkInstall.Content = "Block .MSI Installations"
        $chkCmd.Content = "Block Command Line (CMD/PS/Terminal)"
        $chkTaskMgr.Content = "Block Task Manager"
        $chkNoDisp.Content = "Block Display Settings"
        $chkNoRun.Content = "Block Run Command (Win+R)"
        $chkNoWallpaper.Content = "Block Wallpaper Changes"
        $chkClearRecent.Content = "Clear Recent Docs on Exit"
        $chkTaskbar.Content = "Lock Taskbar Settings"
        $chkEdgePrivate.Content = "Force Private Mode (Edge/Chrome)"
        $chkEdgeFav.Content = "Lock Favorites (Edge/Chrome)"
        $chkAdminTools.Content = "Block Admin Tools (MMC/EventVwr)"
        Log "Lock mode selected" "#FF8C8C"
    })

$rbUnlock.Add_Checked({
        $txtLog.Document.Blocks.Clear()
        $btnApply.Content = "UNLOCK"
        $btnApply.Background = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#107C10")
        $btnApply.Foreground = [System.Windows.Media.Brushes]::White

        $chkReg.Content = "Unblock Registry Editor"
        $chkControl.Content = "Unblock Settings & Control Panel"
        $chkInstall.Content = "Unblock .MSI Installations"
        $chkCmd.Content = "Unblock Command Line (CMD/PS/Terminal)"
        $chkTaskMgr.Content = "Unblock Task Manager"
        $chkNoDisp.Content = "Unblock Display Settings"
        $chkNoRun.Content = "Unblock Run Command (Win+R)"
        $chkNoWallpaper.Content = "Allow Wallpaper Changes"
        $chkClearRecent.Content = "Keep Recent Docs on Exit"
        $chkTaskbar.Content = "Unlock Taskbar Settings"
        $chkEdgePrivate.Content = "Allow Normal Mode (Edge/Chrome)"
        $chkEdgeFav.Content = "Unlock Favorites (Edge/Chrome)"
        $chkAdminTools.Content = "Unblock Admin Tools (MMC/EventVwr)"
        Log "Unlock mode selected" "Green"
    })

# SELECTION
$btnSelectAll.Add_Click({
        if ($btnSelectAll.Content -eq "SELECT ALL") {
            $chkReg.IsChecked = $true
            $chkControl.IsChecked = $true
            $chkInstall.IsChecked = $true
            $chkCmd.IsChecked = $true
            $chkTaskMgr.IsChecked = $true
            $chkNoDisp.IsChecked = $true
            $chkNoRun.IsChecked = $true
            $chkNoWallpaper.IsChecked = $true
            $chkClearRecent.IsChecked = $true
            $chkTaskbar.IsChecked = $true
            $chkEdgePrivate.IsChecked = $true
            $chkEdgeFav.IsChecked = $true
            $chkAdminTools.IsChecked = $true
            $btnSelectAll.Content = "Unselect All"
        }
        else {
            $chkReg.IsChecked = $false
            $chkControl.IsChecked = $false
            $chkInstall.IsChecked = $false
            $chkCmd.IsChecked = $false
            $chkTaskMgr.IsChecked = $false
            $chkNoDisp.IsChecked = $false
            $chkNoRun.IsChecked = $false
            $chkNoWallpaper.IsChecked = $false
            $chkClearRecent.IsChecked = $false
            $chkTaskbar.IsChecked = $false
            $chkEdgePrivate.IsChecked = $false
            $chkEdgeFav.IsChecked = $false
            $chkAdminTools.IsChecked = $false
            $btnSelectAll.Content = "SELECT ALL"
        }
    })

$listUsers.Add_SelectionChanged({
        if ($listUsers.SelectedItem) {
            Invoke-StatusCheck $listUsers.SelectedItem $true
            Update-PrusaScheduleStatus
        }
    })

# APPLY POLICIES
$btnApply.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $txtLog.Document.Blocks.Clear()
            $isLockMode = $rbLock.IsChecked
            $targetUser = $listUsers.SelectedItem

            if (-not $targetUser) {
                Log "Error: Select a target user from the list first." "Red"
                return
            }

            $allChecks = @($chkReg, $chkControl, $chkInstall, $chkCmd, $chkTaskMgr, $chkNoDisp, $chkNoRun, $chkNoWallpaper, $chkClearRecent, $chkTaskbar, $chkEdgePrivate, $chkEdgeFav, $chkAdminTools)
            $anyChecked = $allChecks | Where-Object { $_.IsChecked }
            if (-not $anyChecked) {
                Log "Error: Select at least one restriction checkbox before applying." "Red"
                return
            }


            # Use whoami for current-user check: $env:USERNAME is "SYSTEM" when launched via irm|iex
            $actualUser = try { (& whoami 2>$null).Split('\')[-1] } catch { $env:USERNAME }
            $isCurrentUser = ($targetUser -eq $actualUser)

            # Safety Check for Self-Lockout
            if ($isCurrentUser -and $isLockMode) {
                $msg = "WARNING: You are about to lock system policies for YOUR OWN account ($targetUser).`n`nThis may restrict your ability to use tools like PowerShell, CMD, or Registry Editor.`n`nAre you sure you want to proceed?"
                $result = [System.Windows.Forms.MessageBox]::Show($msg, "Confirm Lock", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Warning)
                if ($result -eq [System.Windows.Forms.DialogResult]::No) {
                    $txtLog.Document.Blocks.Clear()
                    Log "Operation cancelled by user." "Yellow"
                    return
                }

                if (Test-IsAdmin $targetUser) {
                    $adminMsg = "CRITICAL: You are an ADMINISTRATOR.`n`nIf you lock these tools for yourself, you may lose the ability to undo these changes without another admin account.`n`nThis could effectively 'brick' your ability to manage this PC. Are you ABSOLUTELY sure?"
                    $adminResult = [System.Windows.Forms.MessageBox]::Show($adminMsg, "URGENT - Admin Self-Lockout", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Stop)
                    if ($adminResult -eq [System.Windows.Forms.DialogResult]::No) {
                        $txtLog.Document.Blocks.Clear()
                        Log "Operation cancelled to prevent Admin lockout." "Yellow"
                        return
                    }
                }
            }

            $txtLog.Document.Blocks.Clear()
            Log "Preparing to update policies for '$targetUser'..." "Blue"

            if ($isCurrentUser) {
                $basePath = "HKCU:"
                Log "Using current user hive (HKCU)..." "Yellow"
            }
            else {
                # Resolve Target
                $sid = Get-UserSID $targetUser
                if (Test-IsUserLoggedOn $targetUser) {
                    Log "User '$targetUser' is active. Targeting live session hive..." "Yellow"
                }

                # Target Hive
                $isLoaded = $false
                if ($null -ne $sid -and (Test-Path "Registry::HKEY_USERS\$sid")) {
                    $isLoaded = $true
                    Log "Targeting live session hive..." "Yellow"
                    $basePath = "HKU:\$sid"
                    if (-not (Get-PSDrive -Name HKU -ErrorAction SilentlyContinue)) {
                        New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
                    }
                }

                if (-not $isLoaded) {
                    $profilePath = Get-UserProfilePath $targetUser
                    if (!$profilePath) { Log "Error: Profile folder for '$targetUser' not found." "Red"; return }
                    $userPath = Join-Path $profilePath "NTUSER.DAT"
                    if (-not (Test-Path $userPath)) { Log "Error: NTUSER.DAT not found at: $userPath" "Red"; return }
                    
                    $hiveName = "MSM_TempHive"
                    Invoke-HiveUnload $hiveName
                    
                    Log "Loading Registry Hive..." "Blue"
                    & reg.exe load "HKLM\$hiveName" "$userPath" *>$null
                    
                    if ($LASTEXITCODE -ne 0) { Log "Error: Failed to load hive (Code $LASTEXITCODE)." "Red"; return }
                    $basePath = "HKLM:\$hiveName"
                    $loadedViaReg = $true
                }
            }

            # Policy Engine Inner Helper
            function Update-Reg ($desc, $subKey, $name, $data, $type, $lock) {
                $fullKey = "$basePath\$subKey"
                $prop = Get-ItemProperty -Path $fullKey -Name $name -ErrorAction SilentlyContinue
                $propExists = $null -ne $prop -and $null -ne $prop.$name

                if ($lock) {
                    if ($propExists -and $prop.$name.ToString() -eq $data.ToString()) {
                        if ($desc) { Log " [-] $desc already set. Skipping..." "Yellow" }
                        return $false
                    }
                    if (-not (Test-Path $fullKey)) { New-Item -Path $fullKey -Force | Out-Null }
                    Set-ItemProperty -Path $fullKey -Name $name -Value $data -Type $type
                    if ($desc) { Log " [x] $desc BLOCKED" "Red" }
                    return $true
                }
                else {
                    if (-not $propExists) {
                        if ($desc) { Log " [-] $desc already removed. Skipping..." "Yellow" }
                        return $false
                    }
                    Remove-ItemProperty -Path $fullKey -Name $name -ErrorAction SilentlyContinue
                    if ($desc) { Log " [x] $desc UNBLOCKED" "Green" }
                    return $true
                }
            }

            # Policy Execution
            if ($chkReg.IsChecked) { Update-Reg "Registry" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableRegistryTools" 1 "DWord" $isLockMode | Out-Null }
            if ($chkControl.IsChecked) { Update-Reg "Control Panel" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoControlPanel" 1 "DWord" $isLockMode | Out-Null }
            if ($chkInstall.IsChecked) {
                Update-Reg ".MSI Installations" "Software\Policies\Microsoft\Windows\Installer" "DisableMSI" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "" "Software\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" 0 "DWord" $isLockMode | Out-Null
            }
            if ($chkTaskMgr.IsChecked) { Update-Reg "Task Manager" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableTaskMgr" 1 "DWord" $isLockMode | Out-Null }
            if ($chkNoDisp.IsChecked) { Update-Reg "Display Settings" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "NoDispCPL" 1 "DWord" $isLockMode | Out-Null }
            if ($chkNoRun.IsChecked) { Update-Reg "Run Command" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoRun" 1 "DWord" $isLockMode | Out-Null }
            if ($chkClearRecent.IsChecked) { Update-Reg "Clear Recent" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "ClearRecentDocsOnExit" 1 "DWord" $isLockMode | Out-Null }
            if ($chkNoWallpaper.IsChecked) { Update-Reg "Wallpaper" "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" "NoChangingWallPaper" 1 "DWord" $isLockMode | Out-Null }

            if ($chkTaskbar.IsChecked) {
                Update-Reg "Lock Taskbar" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "LockTaskbar" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "" "Software\Policies\Microsoft\Windows\Explorer" "DisableNotificationCenter" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoPinningToTaskbar" 1 "DWord" $isLockMode | Out-Null
            }

            if ($chkCmd.IsChecked) {
                Update-Reg "" "Software\Policies\Microsoft\Windows\System" "DisableCMD" 2 "DWord" $isLockMode | Out-Null
                $disRunPath = "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun"
                if ($isLockMode) {
                    $c1 = Update-Reg "" $disRunPath "1" "powershell.exe" "String" $true
                    $c2 = Update-Reg "" $disRunPath "2" "pwsh.exe" "String" $true
                    $c3 = Update-Reg "" $disRunPath "3" "wt.exe" "String" $true
                    $c4 = Update-Reg "" $disRunPath "4" "cmd.exe" "String" $true
                    $c5 = Update-Reg "" $disRunPath "5" "WindowsTerminal.exe" "String" $true
                    Update-Reg "" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $true | Out-Null
                    if ($c1 -or $c2 -or $c3 -or $c4 -or $c5) { Log " [x] CMD/PS/Terminal BLOCKED" "Red" }
                    else { Log " [-] CMD/PS/Terminal already blocked. Skipping..." "Yellow" }
                }
                else {
                    $c1 = Update-Reg "" $disRunPath "1" "powershell.exe" "String" $false
                    $c2 = Update-Reg "" $disRunPath "2" "pwsh.exe" "String" $false
                    $c3 = Update-Reg "" $disRunPath "3" "wt.exe" "String" $false
                    $c4 = Update-Reg "" $disRunPath "4" "cmd.exe" "String" $false
                    $c5 = Update-Reg "" $disRunPath "5" "WindowsTerminal.exe" "String" $false
                    # Only remove DisallowRun flag if Admin Tools entries don't exist
                    $adminStillBlocked = (Get-ItemProperty -Path "$basePath\$disRunPath" -Name "10" -ErrorAction SilentlyContinue) -ne $null
                    if (-not $adminStillBlocked) {
                        Update-Reg "" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $false | Out-Null
                    }
                    if ($c1 -or $c2 -or $c3 -or $c4 -or $c5) { Log " [x] CMD/PS/Terminal UNBLOCKED" "Green" }
                    else { Log " [-] CMD/PS/Terminal already open. Skipping..." "Yellow" }
                }
            }

            if ($chkEdgePrivate.IsChecked) {
                Update-Reg "Edge InPrivate" "Software\Policies\Microsoft\Edge" "InPrivateModeAvailability" 2 "DWord" $isLockMode | Out-Null
                Update-Reg "Chrome Incognito" "Software\Policies\Google\Chrome" "IncognitoModeAvailability" 2 "DWord" $isLockMode | Out-Null
            }

            if ($chkEdgeFav.IsChecked) {
                Update-Reg "Edge Favs Lock" "Software\Policies\Microsoft\Edge" "EditFavoritesEnabled" 0 "DWord" $isLockMode | Out-Null
                Update-Reg "Chrome Favs Lock" "Software\Policies\Google\Chrome" "EditBookmarksEnabled" 0 "DWord" $isLockMode | Out-Null
                if ($isLockMode) {
                    $json = '[{"toplevel_name":"Makerspace"}, {"url":"https://varaamo.espoo.fi/","name":"Varaamo"}, {"name":"3D-Printers","children":[{"url":"https://www.printables.com/","name":"Printables"},{"url":"https://www.thingiverse.com/","name":"Thingiverse"}]}, {"name":"Lasercutter","children":[{"url":"https://www.epiloglaser.com/how-it-works/laser-material-compatibility/","name":"Material"}]}]'
                    Update-Reg "" "Software\Policies\Microsoft\Edge" "ManagedFavorites" $json "String" $true | Out-Null
                    Update-Reg "" "Software\Policies\Google\Chrome" "ManagedBookmarks" $json "String" $true | Out-Null
                }
                else {
                    Update-Reg "" "Software\Policies\Microsoft\Edge" "ManagedFavorites" "" "String" $false | Out-Null
                    Update-Reg "" "Software\Policies\Google\Chrome" "ManagedBookmarks" "" "String" $false | Out-Null
                }
            }

            if ($chkAdminTools.IsChecked) {
                $disRunPath = "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun"
                if ($isLockMode) {
                    $c10 = Update-Reg "" $disRunPath "10" "mmc.exe" "String" $true
                    $c11 = Update-Reg "" $disRunPath "11" "eventvwr.exe" "String" $true
                    $c12 = Update-Reg "" $disRunPath "12" "eventvwr.msc" "String" $true
                    Update-Reg "" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $true | Out-Null
                    if ($c10 -or $c11 -or $c12) { Log " [x] Admin Tools BLOCKED" "Red" }
                    else { Log " [-] Admin Tools already blocked. Skipping..." "Yellow" }
                }
                else {
                    $c10 = Update-Reg "" $disRunPath "10" "mmc.exe" "String" $false
                    $c11 = Update-Reg "" $disRunPath "11" "eventvwr.exe" "String" $false
                    $c12 = Update-Reg "" $disRunPath "12" "eventvwr.msc" "String" $false
                    # Only remove DisallowRun flag if CMD entries don't exist
                    $cmdStillBlocked = (Get-ItemProperty -Path "$basePath\$disRunPath" -Name "1" -ErrorAction SilentlyContinue) -ne $null
                    if (-not $cmdStillBlocked) {
                        Update-Reg "" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $false | Out-Null
                    }
                    if ($c10 -or $c11 -or $c12) { Log " [x] Admin Tools UNBLOCKED" "Green" }
                    else { Log " [-] Admin Tools already open. Skipping..." "Yellow" }
                }
            }

            Log "SUCCESS: Policies updated for '$targetUser'." "Green"
            if (($targetUser -eq $env:USERNAME) -or (Test-IsUserLoggedOn $targetUser)) {
                Log "NOTE: User is currently logged in. A manual logout may be required for all changes to take effect." "Yellow"
            }

            if ($loadedViaReg) {
                Invoke-HiveUnload $hiveName
                $loadedViaReg = $false
            }
            Invoke-StatusCheck $targetUser $false
        }
        catch {
            Log "Unexpected error in btnApply: $_" "Red"
        }
        finally {
            if ($loadedViaReg) { Invoke-HiveUnload $hiveName }
            $btnApply.IsEnabled = $true
        }
    })

# PRUSASLICER TOOLS 
$btnPrusaNuke.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user from the list." "Red"; return }
            $txtLog.Document.Blocks.Clear()
            if (-not (Test-PrusaInstalled)) { Log "Error: PrusaSlicer does not appear to be installed on this machine." "Red"; return }

            # Material selection for manual reset (allows shortcuts 1/2 or custom name)
            Add-Type -AssemblyName Microsoft.VisualBasic
            $inst = "Select default filament material for the reset:`n`n 1 = Prusament PLA`n 2 = Generic ABS`n`nOr type custom name (e.g. Generic PETG):"
            $matInput = [Microsoft.VisualBasic.Interaction]::InputBox($inst, "Select Reset Material", "1")
            
            if ([string]::IsNullOrWhiteSpace($matInput)) { Log "Reset cancelled." "Yellow"; return }
            
            $selectedMaterial = switch ($matInput.Trim()) {
                "1" { "Prusament PLA" }
                "2" { "Generic ABS" }
                default { $matInput.Trim() } # Allow custom filament names
            }

            Start-PrusaReset $targetUser $selectedMaterial
        }
        finally { $btnApply.IsEnabled = $true }
    })

$btnSchedulePrusa.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user from the list." "Red"; return }

            $msg = "This will schedule a task to reset PrusaSlicer to default settings for user '$targetUser' during Startup and Login.`n`nDo you want to proceed?"
            $res = [System.Windows.Forms.MessageBox]::Show($msg, "Confirm Prusa Schedule", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
            if ($res -eq [System.Windows.Forms.DialogResult]::No) { return }

            $txtLog.Document.Blocks.Clear()
            if (-not (Test-PrusaInstalled)) { Log "Error: PrusaSlicer does not appear to be installed on this machine." "Red"; return }

            # Ask which filament material to reset to via numbered input or custom name
            Add-Type -AssemblyName Microsoft.VisualBasic
            $inst = "Select default filament material:`n`n 1 = Prusament PLA`n 2 = Generic ABS`n`nOr type custom name (e.g. Generic PETG):"
            $matInput = [Microsoft.VisualBasic.Interaction]::InputBox($inst, "Select Default Material", "1")
            
            if ([string]::IsNullOrWhiteSpace($matInput)) { Log "Scheduling cancelled." "Yellow"; return }
            
            $selectedMaterial = switch ($matInput.Trim()) {
                "1" { "Prusament PLA" }
                "2" { "Generic ABS" }
                default { $matInput.Trim() } # Allow custom filament names
            }
            Debug-Log "PrusaSchedule: targetUser='$targetUser', selectedMaterial='$selectedMaterial'"

            Log "Creating PrusaSlicer reset schedule for '$targetUser' (Material: $selectedMaterial)..." "Blue"

            $localScript = Initialize-LocalScript
            if ($null -eq $localScript) {
                Log "Error: Could not establish a local script copy for scheduling." "Red"
                Debug-Log "PrusaSchedule: Initialize-LocalScript returned null. Aborting."
                return
            }
            Debug-Log "PrusaSchedule: localScriptPath='$localScript'"

            $taskName = "Makerspace_PrusaReset_$targetUser"
            $taskArgs = "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$localScript`" -ResetPrusa -TargetUser `"$targetUser`" -Material `"$selectedMaterial`""
            Debug-Log "PrusaSchedule: taskName='$taskName'"
            Debug-Log "PrusaSchedule: taskArguments='$taskArgs'"
            
            $action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument $taskArgs
            $triggers = @(
                (New-ScheduledTaskTrigger -AtStartup),
                (New-ScheduledTaskTrigger -AtLogon)
            )

            Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $triggers -User "System" -RunLevel Highest -Force
            Log "SUCCESS: PrusaSlicer schedule created for '$targetUser' with material: $selectedMaterial." "Green"
            Update-PrusaScheduleStatus
        }
        catch { Log "Error scheduling task: $_" "Red" }
        finally { $btnApply.IsEnabled = $true }
    })

$btnUnschedulePrusa.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user from the list." "Red"; return }
            $txtLog.Document.Blocks.Clear()
            Log "Removing PrusaSlicer reset schedule for '$targetUser'..." "Blue"
            $taskName = "Makerspace_PrusaReset_$targetUser"
            if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
                Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
                Log "SUCCESS: PrusaSlicer schedule for '$targetUser' removed." "Green"
            }
            else {
                Log "No specific schedule found for '$targetUser' to remove." "Yellow"
            }
            Update-PrusaScheduleStatus
        }
        catch { Log "Error removing schedule: $_" "Red" }
        finally { $btnApply.IsEnabled = $true }
    })

# DESKTOP TOOLS
$btnLockDesktop.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user from the list." "Red"; return }

            $txtLog.Document.Blocks.Clear()
            if (Test-IsAdmin $targetUser) { Log "Error: Target user is an Admin. Restricted tool." "Red"; return }

            $publicDesktop = [Environment]::GetFolderPath("CommonDesktopDirectory")
            $userDesktop = Get-UserDesktopPath $targetUser
            if (!$userDesktop) { Log "Error: Desktop folder not found for '$targetUser'." "Red"; return }

            Log "Locking desktop shortcuts for '$targetUser'..." "Blue"
            Debug-Log "Public Desktop Path: $publicDesktop"
            Debug-Log "User Desktop Path: $userDesktop"
            $shortcuts = Get-ChildItem -Path $userDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue
            if ($shortcuts.Count -eq 0) { Log "No shortcuts found." "Yellow"; return }

            $movedCount = 0
            foreach ($shortcut in $shortcuts) {
                $destPath = Join-Path $publicDesktop $shortcut.Name
                if (Test-Path $destPath) {
                    Remove-Item -Path $shortcut.FullName -Force -ErrorAction SilentlyContinue
                }
                else {
                    Copy-Item -Path $shortcut.FullName -Destination $destPath -Force
                    Remove-Item -Path $shortcut.FullName -Force
                    Log " [+] Locked: $($shortcut.Name)" "Red"
                    $movedCount++
                }
            }
            Log "Done. $movedCount shortcuts locked." "Green"
        }
        catch { Log "ERROR: $_" "Red" }
        finally { $btnApply.IsEnabled = $true }
    })

$btnUnlockDesktop.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user from the list." "Red"; return }

            $txtLog.Document.Blocks.Clear()
            if (Test-IsAdmin $targetUser) { Log "Error: Target user is an Admin. Restricted tool." "Red"; return }

            $publicDesktop = [Environment]::GetFolderPath("CommonDesktopDirectory")
            $userDesktop = Get-UserDesktopPath $targetUser
            if (!$userDesktop) { Log "Error: Desktop folder not found for '$targetUser'." "Red"; return }

            Log "Restoring shortcuts to '$targetUser'..." "Blue"
            Debug-Log "Public Desktop Path: $publicDesktop"
            Debug-Log "User Desktop Path: $userDesktop"
            $shortcuts = Get-ChildItem -Path $publicDesktop -Filter "*.lnk" -ErrorAction SilentlyContinue
            if ($shortcuts.Count -eq 0) { Log "No shortcuts in Public Desktop." "Yellow"; return }

            $movedCount = 0
            foreach ($shortcut in $shortcuts) {
                Move-Item -Path $shortcut.FullName -Destination $userDesktop -Force
                Log " [^] Restored: $($shortcut.Name)" "Green"
                $movedCount++
            }
            Log "Done. $movedCount shortcuts restored." "Green"
        }
        catch { Log "ERROR: $_" "Red" }
        finally { $btnApply.IsEnabled = $true }
    })

# INSTALLER
$btnInstallShortcut.Add_Click({
        $btnApply.IsEnabled = $false
        try {
            $targetUser = $listUsers.SelectedItem
            if (-not $targetUser) { Log "Error: Select a target user." "Red"; return }
        
            $txtLog.Document.Blocks.Clear()
            if (-not (Test-IsAdmin $targetUser)) { Log "'$targetUser' is not an Admin. Skipping..." "Red"; return }

            Log "Creating shortcut on $targetUser's desktop..." "Blue"
            
            $localScript = Initialize-LocalScript
            if ($null -eq $localScript) {
                Log "Error: Could not establish a local script copy." "Red"
                return
            }

            # Shortcut Logic
            $desktopPath = [Environment]::GetFolderPath("Desktop")
            if ($targetUser -ne $env:USERNAME) {
                $userDesktop = Get-UserDesktopPath $targetUser
                if ($userDesktop) { $desktopPath = $userDesktop }
                else { Log "Warning: Localized desktop folder not found for $targetUser. Falling back to default." "Yellow" }
            }
            $shortcutPath = Join-Path $desktopPath "MakerspaceManager.lnk"
            Remove-Item $shortcutPath -Force -ErrorAction SilentlyContinue

            $WshShell = New-Object -ComObject WScript.Shell
            $psPath = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
            $shortcut = $WshShell.CreateShortcut($shortcutPath)
            $shortcut.TargetPath = $psPath
            $shortcut.Arguments = "-NoProfile -ExecutionPolicy Bypass -Command `"`& { try { `$c = Invoke-RestMethod https://msm.samwhitley.com -ErrorAction Stop; `$c | Out-File '$localScript' -Force; Invoke-Expression `$c } catch { if (Test-Path '$localScript') { & '$localScript' } } }`""
            $shortcut.WorkingDirectory = $global:installDir
            $shortcut.IconLocation = "$psPath,0"
            $shortcut.Save()

            # Admin magic bit
            $bytes = [System.IO.File]::ReadAllBytes($shortcutPath)
            $bytes[21] = $bytes[21] -bor 0x20
            [System.IO.File]::WriteAllBytes($shortcutPath, $bytes)
            Log "Shortcut created successfully." "Green"
        }
        catch { Log "Error: $_" "Red" }
        finally { $btnApply.IsEnabled = $true }
    })

# CLI EXECUTION
if ($ResetPrusa) {
    # Generate timestamped log file for scheduled tasks
    $timestamp = (Get-Date).ToString("yyyyMMdd_HHmmss")
    $global:logFile = Join-Path $logDir "MakerspaceManager_Task_Prusa_${timestamp}.log"
    Remove-OldLogs -path $logDir
}

if ($ResetPrusa) {
    Log "=== CLI Mode: PrusaSlicer Reset ==="
    Start-PrusaReset -targetUser $TargetUser -material $Material
    Exit
}

# STARTUP
Remove-OldLogs -path $logDir
Initialize-LocalScript | Out-Null
Update-UserList
Update-PrusaScheduleStatus
$global:window.ShowDialog() | Out-Null