# Request Admin privileges
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Warning "You must run this script as Administrator!"
    Start-Sleep -Seconds 5
    Exit
}

$ErrorActionPreference = "Stop"

# --- WPF UI ---
Add-Type -AssemblyName PresentationFramework

$xaml = @"
<Window xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
        Title="Makerspace Manager" Height="600" Width="520" 
        WindowStartupLocation="CenterScreen" Topmost="False" ResizeMode="CanResize"
        Background="#1E1E1E" Foreground="#E0E0E0">
    <Window.Resources>
        <Style TargetType="TextBlock">
            <Setter Property="FontFamily" Value="Segoe UI"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="CheckBox">
            <Setter Property="Margin" Value="0,5"/>
            <Setter Property="FontSize" Value="13"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="RadioButton">
            <Setter Property="FontSize" Value="14"/>
            <Setter Property="FontWeight" Value="SemiBold"/>
            <Setter Property="Margin" Value="10,0"/>
            <Setter Property="Foreground" Value="#E0E0E0"/>
        </Style>
        <Style TargetType="GroupBox">
            <Setter Property="Foreground" Value="#E0E0E0"/>
            <Setter Property="BorderBrush" Value="#444444"/>
        </Style>
        <Style TargetType="TextBox">
             <Setter Property="Background" Value="#2D2D30"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#555555"/>
             <Setter Property="CaretBrush" Value="#FFFFFF"/>
        </Style>
        <Style TargetType="Button">
             <Setter Property="Background" Value="#333333"/>
             <Setter Property="Foreground" Value="#FFFFFF"/>
             <Setter Property="BorderBrush" Value="#555555"/>
             <Setter Property="Template">
                <Setter.Value>
                    <ControlTemplate TargetType="Button">
                        <Border Background="{TemplateBinding Background}" BorderBrush="{TemplateBinding BorderBrush}" BorderThickness="1" CornerRadius="3">
                            <ContentPresenter HorizontalAlignment="Center" VerticalAlignment="Center"/>
                        </Border>
                    </ControlTemplate>
                </Setter.Value>
             </Setter>
        </Style>
    </Window.Resources>
    
    <ScrollViewer VerticalScrollBarVisibility="Auto">
        <Grid Margin="20">
            <Grid.RowDefinitions>
                <RowDefinition Height="Auto"/> <!-- Header -->
                <RowDefinition Height="Auto"/> <!-- Mode Switch -->
                <RowDefinition Height="Auto"/> <!-- Input -->
                <RowDefinition Height="Auto"/> <!-- Checkboxes -->
                <RowDefinition Height="Auto"/> <!-- Buttons -->
                <RowDefinition Height="Auto"/> <!-- Log -->
            </Grid.RowDefinitions>
            
            <!-- Header -->
            <StackPanel Grid.Row="0" Margin="0,0,0,15">
                <TextBlock Text="Makerspace Manager" FontSize="22" FontWeight="Bold" Foreground="#4BA3E3"/>
                <TextBlock Text="Manage restrictions for user accounts" Foreground="#AAAAAA" FontSize="12"/>
            </StackPanel>
            
            <!-- Mode Switch -->
            <Border Grid.Row="1" Background="#252526" Padding="10" CornerRadius="5" Margin="0,0,0,15" BorderBrush="#444444" BorderThickness="1">
                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
                    <RadioButton Name="rbLock" Content="LOCK MODE" IsChecked="True" Foreground="#FF6B6B"/>
                    <RadioButton Name="rbUnlock" Content="UNLOCK MODE" Foreground="#6BCB77"/>
                </StackPanel>
            </Border>
            
            <!-- Username Input -->
            <StackPanel Grid.Row="2" Margin="0,0,0,15">
                <TextBlock Text="Target Username:" FontWeight="SemiBold" Margin="0,0,0,5" Foreground="#E0E0E0"/>
                <Grid>
                    <Grid.ColumnDefinitions>
                        <ColumnDefinition Width="*"/>
                        <ColumnDefinition Width="Auto"/>
                    </Grid.ColumnDefinitions>
                    <TextBox Grid.Column="0" Name="txtUsername" Height="28" FontSize="14" Padding="4"/>
                    <Button Grid.Column="1" Name="btnCheck" Content="Check Status" Margin="5,0,0,0" Height="28" Padding="8,0" Background="#444444"/>
                </Grid>
            </StackPanel>
            
            <!-- Checkboxes -->
            <Grid Grid.Row="3" Margin="0,0,0,15">
                <Grid.RowDefinitions>
                    <RowDefinition Height="*"/>
                    <RowDefinition Height="Auto"/>
                </Grid.RowDefinitions>
                <Grid.ColumnDefinitions>
                    <ColumnDefinition Width="*"/>
                    <ColumnDefinition Width="*"/>
                </Grid.ColumnDefinitions>

                <!-- Column 0: System + Browsers -->
                <StackPanel Grid.Row="0" Grid.Column="0" Margin="0,0,5,10">
                    <GroupBox Header="Windows System" Padding="10">
                        <StackPanel>
                            <CheckBox Name="chkReg" Content="Block Registry Editor"/>
                            <CheckBox Name="chkControl" Content="Block Settings &amp; Control Panel"/>
                            <CheckBox Name="chkInstall" Content="Block Installers"/>
                            <CheckBox Name="chkCmd" Content="Block Command Line (CMD/PS/Terminal)"/>
                            <CheckBox Name="chkTaskMgr" Content="Block Task Manager"/>
                            <CheckBox Name="chkNoDisp" Content="Block Display Settings"/>
                        </StackPanel>
                    </GroupBox>
                    <GroupBox Header="Web Browsers" Padding="10" Margin="0,10,0,0">
                        <StackPanel>
                            <CheckBox Name="chkEdgePrivate" Content="Force InPrivate / Incognito"/>
                            <CheckBox Name="chkEdgeFav" Content="Lock Favorites (Makerspace Defaults)"/>
                        </StackPanel>
                    </GroupBox>
                </StackPanel>
                
                <!-- Column 1: Explorer & Desktop -->
                <GroupBox Grid.Row="0" Grid.Column="1" Header="Explorer &amp; Desktop" Padding="10" Margin="5,0,0,10">
                    <StackPanel>
                        <CheckBox Name="chkNoRun" Content="Disable Run Command (Win+R)"/>
                        <CheckBox Name="chkNoDrives" Content="Hide C: Drive in Explorer"/>
                        <CheckBox Name="chkNoWallpaper" Content="Prevent Changing Wallpaper"/>
                        <CheckBox Name="chkClearRecent" Content="Clear Recent Docs on Exit"/>
                        <CheckBox Name="chkNoNetwork" Content="Block Network &amp; Context Menus"/>
                        <CheckBox Name="chkTaskbar" Content="Lock Taskbar Settings"/>
                        <CheckBox Name="chkNoNotif" Content="Block Notifications &amp; Action Center"/>
                        <CheckBox Name="chkNoTray" Content="Disable Taskbar Context Menus"/>
                    </StackPanel>
                </GroupBox>
                
                <Button Grid.Row="1" Grid.Column="0" Grid.ColumnSpan="2" Name="btnSelectAll" Content="Select All" HorizontalAlignment="Left" Width="80" Height="22" Margin="0,0,0,0" Background="#444444"/>
            </Grid>
            
            <!-- Actions -->
            <Grid Grid.Row="4" Margin="0,0,0,15">
                <Grid.ColumnDefinitions>
                    <ColumnDefinition Width="*"/>
                    <ColumnDefinition Width="*"/>
                </Grid.ColumnDefinitions>
                <!-- Action Button -->
                <Button Grid.Column="0" Name="btnApply" Content="LOCK USER" Height="40" Margin="0,0,5,0" 
                        Background="#D9534F" Foreground="White" FontWeight="Bold" FontSize="14"/>
                <!-- Exit Button -->
                <Button Grid.Column="1" Name="btnClose" Content="Exit" Height="40" Margin="5,0,0,0"
                        Background="#0078D7" Foreground="White" FontWeight="Bold" FontSize="14"/>
            </Grid>
            
            <!-- Log Output -->
            <GroupBox Grid.Row="5" Header="Status Log" Padding="5" VerticalAlignment="Stretch">
                 <RichTextBox Name="txtLog" IsReadOnly="True" VerticalScrollBarVisibility="Visible" 
                             FontFamily="Consolas" FontSize="11" Background="#252526" BorderThickness="0" 
                             VerticalAlignment="Stretch" HorizontalAlignment="Stretch" Height="150">
                    <FlowDocument>
                        <Paragraph Margin="0"><Run Text="Ready..." Foreground="#888888"/></Paragraph>
                    </FlowDocument>
                </RichTextBox>
            </GroupBox>
        </Grid>
    </ScrollViewer>
</Window>
"@

$reader = [System.Xml.XmlReader]::Create([System.IO.StringReader]::new($xaml))
$window = [System.Windows.Markup.XamlReader]::Load($reader)

# --- Helpers ---
function Get-Ctrl ($name) { $window.FindName($name) }

$rbLock = Get-Ctrl "rbLock"
$rbUnlock = Get-Ctrl "rbUnlock"
$txtUsername = Get-Ctrl "txtUsername"
$btnCheck = Get-Ctrl "btnCheck"
$chkReg = Get-Ctrl "chkReg"
$chkControl = Get-Ctrl "chkControl"
$chkInstall = Get-Ctrl "chkInstall"
$chkCmd = Get-Ctrl "chkCmd"
$chkTaskMgr = Get-Ctrl "chkTaskMgr"
$chkNoDisp = Get-Ctrl "chkNoDisp"
$chkNoRun = Get-Ctrl "chkNoRun"
$chkNoDrives = Get-Ctrl "chkNoDrives"
$chkNoWallpaper = Get-Ctrl "chkNoWallpaper"
$chkClearRecent = Get-Ctrl "chkClearRecent"
$chkNoNetwork = Get-Ctrl "chkNoNetwork"
$chkTaskbar = Get-Ctrl "chkTaskbar"
$chkNoNotif = Get-Ctrl "chkNoNotif"
$chkNoTray = Get-Ctrl "chkNoTray"
$chkEdgePrivate = Get-Ctrl "chkEdgePrivate"
$chkEdgeFav = Get-Ctrl "chkEdgeFav"
$btnSelectAll = Get-Ctrl "btnSelectAll"
$btnApply = Get-Ctrl "btnApply"
$btnClose = Get-Ctrl "btnClose"
$txtLog = Get-Ctrl "txtLog"

function Log ($msg, $color = "Normal") {
    $paragraph = New-Object System.Windows.Documents.Paragraph
    $paragraph.Margin = New-Object System.Windows.Thickness(0)
    $run = New-Object System.Windows.Documents.Run
    $run.Text = "[$((Get-Date).ToString('HH:mm:ss'))] $msg"
    switch ($color) {
        "Red" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF6B6B") }
        "Green" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#6BCB77") }
        "Blue" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#4BA3E3") }
        "Yellow" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FFD93D") }
        "Cyan" { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#4DD0E1") }
        default { $run.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#DDDDDD") }
    }
    $paragraph.Inlines.Add($run)
    $txtLog.Document.Blocks.Add($paragraph)
    $txtLog.ScrollToEnd()
    [System.Windows.Forms.Application]::DoEvents() 
}

Add-Type -AssemblyName System.Windows.Forms

# --- UI Logic ---

# Toggle Mode
$rbLock.Add_Checked({
        $btnApply.Content = "LOCK USER"
        $btnApply.Background = [System.Windows.Media.Brushes]::IndianRed # D9534F
    
        $chkReg.Content = "Block Registry Editor"
        $chkControl.Content = "Block Settings & Control Panel"
        $chkInstall.Content = "Block Installers"
        $chkCmd.Content = "Block Command Line (CMD/PS/Terminal)"
        $chkTaskMgr.Content = "Block Task Manager"
        $chkNoDisp.Content = "Block Display Settings"
        $chkNoRun.Content = "Disable Run Command (Win+R)"
        $chkNoDrives.Content = "Hide C: Drive in Explorer"
        $chkNoWallpaper.Content = "Prevent Changing Wallpaper"
        $chkClearRecent.Content = "Clear Recent Docs on Exit"
        $chkNoNetwork.Content = "Block Network & Context Menus"
        $chkTaskbar.Content = "Lock Taskbar Settings"
        $chkNoNotif.Content = "Block Notifications & Action Center"
        $chkNoTray.Content = "Disable Taskbar Context Menus"
        $chkEdgePrivate.Content = "Force InPrivate / Incognito"
        $chkEdgeFav.Content = "Lock Favorites (Makerspace Defaults)"
        Log "Switched to LOCK Mode" "Red"
    })

$rbUnlock.Add_Checked({
        $btnApply.Content = "UNLOCK USER"
        $btnApply.Background = [System.Windows.Media.Brushes]::ForestGreen # 5CB85C
    
        $chkReg.Content = "Unblock Registry Editor"
        $chkControl.Content = "Unblock Settings & Control Panel"
        $chkInstall.Content = "Unblock Installers"
        $chkCmd.Content = "Unblock Command Line"
        $chkTaskMgr.Content = "Unblock Task Manager"
        $chkNoDisp.Content = "Unblock Display Settings"
        $chkNoRun.Content = "Enable Run Command"
        $chkNoDrives.Content = "Unhide C: Drive"
        $chkNoWallpaper.Content = "Allow Changing Wallpaper"
        $chkClearRecent.Content = "Don't Clear Recent Docs"
        $chkNoNetwork.Content = "Unblock Network / Context Menus"
        $chkTaskbar.Content = "Unlock Taskbar Settings"
        $chkNoNotif.Content = "Unblock Notifications"
        $chkNoTray.Content = "Enable Taskbar Context Menus"
        $chkEdgePrivate.Content = "Unforce InPrivate / Incognito"
        $chkEdgeFav.Content = "Unlock Favorites"
        Log "Switched to UNLOCK Mode" "Green"
    })

$btnSelectAll.Add_Click({
        if ($btnSelectAll.Content -eq "Select All") {
            $chkReg.IsChecked = $true
            $chkControl.IsChecked = $true
            $chkInstall.IsChecked = $true
            $chkCmd.IsChecked = $true
            $chkTaskMgr.IsChecked = $true
            $chkNoDisp.IsChecked = $true
            $chkNoRun.IsChecked = $true
            $chkNoDrives.IsChecked = $true
            $chkNoWallpaper.IsChecked = $true
            $chkClearRecent.IsChecked = $true
            $chkNoNetwork.IsChecked = $true
            $chkTaskbar.IsChecked = $true
            $chkNoNotif.IsChecked = $true
            $chkNoTray.IsChecked = $true
            $chkEdgePrivate.IsChecked = $true
            $chkEdgeFav.IsChecked = $true
            $btnSelectAll.Content = "Unselect All"
        }
        else {
            $chkReg.IsChecked = $false
            $chkControl.IsChecked = $false
            $chkInstall.IsChecked = $false
            $chkCmd.IsChecked = $false
            $chkTaskMgr.IsChecked = $false
            $chkNoDisp.IsChecked = $false
            $chkNoRun.IsChecked = $false
            $chkNoDrives.IsChecked = $false
            $chkNoWallpaper.IsChecked = $false
            $chkClearRecent.IsChecked = $false
            $chkNoNetwork.IsChecked = $false
            $chkTaskbar.IsChecked = $false
            $chkNoNotif.IsChecked = $false
            $chkNoTray.IsChecked = $false
            $chkEdgePrivate.IsChecked = $false
            $chkEdgeFav.IsChecked = $false
            $btnSelectAll.Content = "Select All"
        }
    })

$btnClose.Add_Click({ $window.Close() })

$btnCheck.Add_Click({
        $txtLog.Document.Blocks.Clear()
        $targetUser = $txtUsername.Text.Trim()
        if ([string]::IsNullOrWhiteSpace($targetUser)) { return }
    
        $userPath = "C:\Users\$targetUser\NTUSER.DAT"
        if (-not (Test-Path $userPath)) { 
            Log "User not found." "Red"
            return 
        }

        $hiveName = "TempCheckHive"
        Log "Checking status for '$targetUser'..." "Cyan"
    
        # Load Hive
        $p = New-Object System.Diagnostics.ProcessStartInfo
        $p.FileName = "reg"
        $p.Arguments = "load HKLM\$hiveName `"$userPath`""
        $p.CreateNoWindow = $true
        $p.UseShellExecute = $false
        $proc = [System.Diagnostics.Process]::Start($p)
        $proc.WaitForExit()
    
        if ($proc.ExitCode -ne 0) {
            Log "Could not load hive (User logged in?)." "Red"
            return
        }

        try {
            $basePath = "HKLM:\$hiveName"
        
            $Check = { 
                param($chk, $subPath, $name, $val)
                $fullPath = "$basePath\$subPath"
                $blocked = $false
            
                if (Test-Path $fullPath) {
                    # ErrorAction SilentlyContinue in case property doesn't exist
                    $prop = Get-ItemProperty -Path $fullPath -Name $name -ErrorAction SilentlyContinue
                    if ($prop -and $prop.$name -eq $val) {
                        $blocked = $true
                    }
                }
            
                if ($blocked) {
                    $chk.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#FF6B6B")
                    # $chk.IsChecked = $true (User requested to NOT check the box)
                }
                else {
                    $chk.Foreground = [System.Windows.Media.BrushConverter]::new().ConvertFromString("#6BCB77")
                    # $chk.IsChecked = $false
                }
            }

            # 1. Registry
            & $Check $chkReg "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableRegistryTools" 1
        
            # 2. Control Panel
            & $Check $chkControl "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoControlPanel" 1
        
            # 3. Installers
            & $Check $chkInstall "Software\Policies\Microsoft\Windows\Installer" "DisableMSI" 1
        
            # 4. CMD
            & $Check $chkCmd "Software\Policies\Microsoft\Windows\System" "DisableCMD" 2
        
            # 5. Task Mgr
            & $Check $chkTaskMgr "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableTaskMgr" 1
        
            # 6. Display
            & $Check $chkNoDisp "Software\Microsoft\Windows\CurrentVersion\Policies\System" "NoDispCPL" 1
        
            # 7. Run
            & $Check $chkNoRun "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoRun" 1
        
            # 8. Drives (Hide C)
            & $Check $chkNoDrives "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoDrives" 4
        
            # 9. Wallpaper
            & $Check $chkNoWallpaper "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" "NoChangingWallPaper" 1
        
            # 10. Clear Recent
            & $Check $chkClearRecent "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "ClearRecentDocsOnExit" 1
        
            # 11. Network
            & $Check $chkNoNetwork "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoNetHood" 1
        
            # 12. Taskbar
            & $Check $chkTaskbar "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "LockTaskbar" 1
        
            # 13. Notif
            & $Check $chkNoNotif "Software\Policies\Microsoft\Windows\Explorer" "DisableNotificationCenter" 1
        
            # 14. Tray
            & $Check $chkNoTray "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoTrayContextMenu" 1
        
            # 15. Edge Priv
            & $Check $chkEdgePrivate "Software\Policies\Microsoft\Edge" "InPrivateModeAvailability" 2
        
            # 16. Favs
            & $Check $chkEdgeFav "Software\Policies\Microsoft\Edge" "EditFavoritesEnabled" 0 


        }
        finally {
            [System.GC]::Collect()
            reg unload "HKLM\$hiveName" 2>$null | Out-Null
        }
    })

$btnApply.Add_Click({
        $txtLog.Document.Blocks.Clear()
        $isLockMode = $rbLock.IsChecked
        $targetUser = $txtUsername.Text.Trim()
    
        if ([string]::IsNullOrWhiteSpace($targetUser)) {
            Log "Error: Please enter a username." "Red"
            return
        }

        $userPath = "C:\Users\$targetUser\NTUSER.DAT"
        if (-not (Test-Path $userPath)) {
            Log "Error: User '$targetUser' not found." "Red"
            return
        }

        $hiveName = "TempLockdownHive"
        Log "Loading Registry Hive..." "Cyan"
    
        $p = New-Object System.Diagnostics.ProcessStartInfo
        $p.FileName = "reg"
        $p.Arguments = "load HKLM\$hiveName `"$userPath`""
        $p.RedirectStandardOutput = $true
        $p.RedirectStandardError = $true
        $p.UseShellExecute = $false
        $p.CreateNoWindow = $true
    
        $proc = [System.Diagnostics.Process]::Start($p)
        $proc.WaitForExit()
    
        if ($proc.ExitCode -ne 0) {
            $stdErr = $proc.StandardError.ReadToEnd()
            Log "Error: Failed to load hive." "Red"
            if ($stdErr -match "process cannot access") {
                Log "REASON: User is LOGGED IN. Log them out first." "Yellow"
            }
            else {
                Log "$stdErr" "Red"
            }
            return
        }

        try {
            $basePath = "HKLM:\$hiveName"
            
            # Helper to check and apply
            function Update-Reg ($desc, $subKey, $name, $data, $type, $lock) {
                $fullKey = "$basePath\$subKey"
                $propExists = $false
                $currentVal = $null
                
                if (Test-Path $fullKey) {
                    $prop = Get-ItemProperty -Path $fullKey -Name $name -ErrorAction SilentlyContinue
                    if ($prop -and $prop.PSObject.Properties[$name]) {
                        $propExists = $true
                        $currentVal = $prop.$name
                    }
                }

                if ($lock) {
                    # We want it to be $data
                    if ($propExists -and $currentVal -eq $data) {
                        Log " [-] $desc already set. Skipping..." "Yellow"
                        return $false
                    }
                    else {
                        if (-not (Test-Path $fullKey)) { New-Item -Path $fullKey -Force | Out-Null }
                        Set-ItemProperty -Path $fullKey -Name $name -Value $data -Type $type
                        Log " [x] $desc BLOCKED" "Red"
                        return $true
                    }
                }
                else {
                    # We want it gone (or default)
                    if (-not $propExists) {
                        Log " [-] $desc already removed. Skipping..." "Yellow"
                        return $false
                    }
                    else {
                        Remove-ItemProperty -Path $fullKey -Name $name -ErrorAction SilentlyContinue
                        Log " [x] $desc UNBLOCKED" "Green"
                        return $true
                    }
                }
            }
        
            # 1. Registry
            if ($chkReg.IsChecked) {
                Update-Reg "Registry" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableRegistryTools" 1 "DWord" $isLockMode | Out-Null
            }

            # 2. Control Panel
            if ($chkControl.IsChecked) {
                Update-Reg "Control Panel" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoControlPanel" 1 "DWord" $isLockMode | Out-Null
            }

            # 3. Installers
            if ($chkInstall.IsChecked) {
                Update-Reg "Installers (MSI)" "Software\Policies\Microsoft\Windows\Installer" "DisableMSI" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "Installers (Elevated)" "Software\Policies\Microsoft\Windows\Installer" "AlwaysInstallElevated" 0 "DWord" $isLockMode | Out-Null
            }

            # 4. Task Manager
            if ($chkTaskMgr.IsChecked) {
                Update-Reg "Task Manager" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "DisableTaskMgr" 1 "DWord" $isLockMode | Out-Null
            }

            # 4.1 Display Settings
            if ($chkNoDisp.IsChecked) {
                Update-Reg "Display Settings" "Software\Microsoft\Windows\CurrentVersion\Policies\System" "NoDispCPL" 1 "DWord" $isLockMode | Out-Null
            }
            
            # 5. Explorer Restrictions
            if ($chkNoRun.IsChecked) {
                Update-Reg "Run Command" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoRun" 1 "DWord" $isLockMode | Out-Null
            }

            if ($chkNoDrives.IsChecked) {
                Update-Reg "C: Drive" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoDrives" 4 "DWord" $isLockMode | Out-Null
            }

            if ($chkClearRecent.IsChecked) {
                Update-Reg "Clear Recent" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "ClearRecentDocsOnExit" 1 "DWord" $isLockMode | Out-Null
            }

            if ($chkNoNetwork.IsChecked) {
                Update-Reg "Net Hood" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoNetHood" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "View On Drive" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoViewOnDrive" 1 "DWord" $isLockMode | Out-Null
                Update-Reg "Manage Ctxt" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoManageMyComputerVerb" 1 "DWord" $isLockMode | Out-Null
            }
            
            # 10. Taskbar
            if ($chkTaskbar.IsChecked) {
                Update-Reg "Lock Taskbar" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "LockTaskbar" 1 "DWord" $isLockMode | Out-Null
            }

            # 11. Notifications (Action Center)
            if ($chkNoNotif.IsChecked) {
                Update-Reg "Notifications" "Software\Policies\Microsoft\Windows\Explorer" "DisableNotificationCenter" 1 "DWord" $isLockMode | Out-Null
            }

            # 12. Tray Context Menus
            if ($chkNoTray.IsChecked) {
                Update-Reg "Tray Menus" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "NoTrayContextMenu" 1 "DWord" $isLockMode | Out-Null
            }

            # 6. Wallpaper
            if ($chkNoWallpaper.IsChecked) {
                Update-Reg "Wallpaper" "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" "NoChangingWallPaper" 1 "DWord" $isLockMode | Out-Null
            }

            # 7. Command Line
            if ($chkCmd.IsChecked) {
                # Part 1: DisableCMD
                Update-Reg "CMD" "Software\Policies\Microsoft\Windows\System" "DisableCMD" 2 "DWord" $isLockMode | Out-Null
                
                # Part 2: DisallowRun
                $explPolPath = "$basePath\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
                $disRunPath = "$explPolPath\DisallowRun"

                if ($isLockMode) {
                    $allSet = $true
                    if (-not (Test-Path $disRunPath)) { $allSet = $false }
                    else {
                        $p1 = Get-ItemProperty $disRunPath -Name "1" -ErrorAction SilentlyContinue
                        if ($null -eq $p1 -or $p1."1" -ne "powershell.exe") { $allSet = $false }
                    }

                    if ($allSet) {
                        Log " [-] PS/Terminal blocks already set. Skipping..." "Yellow"
                    }
                    else {
                        Update-Reg "DisallowRun Mode" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $isLockMode | Out-Null
                        if (-not (Test-Path $disRunPath)) { New-Item -Path $disRunPath -Force | Out-Null }
                        Set-ItemProperty -Path $disRunPath -Name "1" -Value "powershell.exe" -Type String
                        Set-ItemProperty -Path $disRunPath -Name "2" -Value "pwsh.exe" -Type String
                        Set-ItemProperty -Path $disRunPath -Name "3" -Value "wt.exe" -Type String
                        Set-ItemProperty -Path $disRunPath -Name "4" -Value "cmd.exe" -Type String
                        Set-ItemProperty -Path $disRunPath -Name "5" -Value "WindowsTerminal.exe" -Type String
                        Log " [x] PS/Terminal BLOCKED" "Red"
                    }
                }
                else {
                    if (-not (Test-Path $disRunPath)) {
                        Log " [-] PS/Terminal already unblocked. Skipping..." "Yellow"
                    }
                    else {
                        foreach ($n in 1..5) { Remove-ItemProperty -Path $disRunPath -Name "$n" -ErrorAction SilentlyContinue }
                        Update-Reg "DisallowRun Mode" "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "DisallowRun" 1 "DWord" $isLockMode | Out-Null
                        Log " [x] PS/Terminal UNBLOCKED" "Green"
                    }
                }
            }

            # 8. Browsers (Edge & Chrome) InPrivate
            if ($chkEdgePrivate.IsChecked) {
                Update-Reg "Edge InPrivate" "Software\Policies\Microsoft\Edge" "InPrivateModeAvailability" 2 "DWord" $isLockMode | Out-Null
                Update-Reg "Chrome Incognito" "Software\Policies\Google\Chrome" "IncognitoModeAvailability" 2 "DWord" $isLockMode | Out-Null
            }

            # 9. Browser Favorites
            if ($chkEdgeFav.IsChecked) {
                # 1. The Flag
                $didEdge = Update-Reg "Edge Favs Lock" "Software\Policies\Microsoft\Edge" "EditFavoritesEnabled" 0 "DWord" $isLockMode
                $didChrome = Update-Reg "Chrome Favs Lock" "Software\Policies\Google\Chrome" "EditBookmarksEnabled" 0 "DWord" $isLockMode

                # 2. The JSON
                if ($isLockMode) {
                    # Prepare JSON
                    $favList = @(
                        @{ "toplevel_name" = "Makerspace" },
                        @{ "url" = "https://varaamo.espoo.fi/"; "name" = "Varaamo" },
                        @{ "url" = "https://www.printables.com/"; "name" = "Printables" },
                        @{ "url" = "https://www.thingiverse.com/"; "name" = "Thingiverse" }
                    )
                    $json = $favList | ConvertTo-Json -Depth 2 -Compress

                    # Edge
                    if ($didEdge) {
                        $edgePath = "$basePath\Software\Policies\Microsoft\Edge"
                        if (-not (Test-Path $edgePath)) { New-Item -Path $edgePath -Force | Out-Null }
                        Set-ItemProperty -Path $edgePath -Name "ManagedFavorites" -Value $json -Type String
                    }
                     
                    # Chrome
                    if ($didChrome) {
                        $chromePath = "$basePath\Software\Policies\Google\Chrome"
                        if (-not (Test-Path $chromePath)) { New-Item -Path $chromePath -Force | Out-Null }
                        Set-ItemProperty -Path $chromePath -Name "ManagedBookmarks" -Value $json -Type String
                    }

                }
                else {
                    # Unlock: Remove JSON props
                    Update-Reg "Edge JSON" "Software\Policies\Microsoft\Edge" "ManagedFavorites" "" "String" $false | Out-Null
                    Update-Reg "Chrome JSON" "Software\Policies\Google\Chrome" "ManagedBookmarks" "" "String" $false | Out-Null
                }
            }

            Log "SUCCESS: Action completed for '$targetUser'." "Blue"

        }
        catch {
            Log "EXCEPTION: $_" "Red"
        }
        finally {
            Log "Unloading hive..." "Cyan"
            [System.GC]::Collect()
            [System.GC]::WaitForPendingFinalizers()
            reg unload "HKLM\$hiveName" 2>$null | Out-Null
            Log "Done." "Cyan"
        }
    })

$window.ShowDialog() | Out-Null