gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 12:47:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Defender policy detection for new ADMX paths and add registry fallback (#81)

Browse Source
This commit is contained in:
Przemysław Kłys
2026-02-18 11:39:31 +01:00
parent 95789953a8
commit 3a69d14354
4 changed files with 131 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/ConvertTo-XMLRegistryDefenderOnReport.ps1
+39
View File
@@ -0,0 +1,39 @@
function ConvertTo-XMLRegistryDefenderOnReport {
<#
.SYNOPSIS
Converts Defender-related raw registry settings from the RegistrySettings report.
.DESCRIPTION
This function is used as a fallback for Defender settings that are not exposed as
policy categories but are still present in RegistrySettings output.
.PARAMETER GPO
RegistrySettings report object generated by ConvertTo-XMLRegistrySettings -SingleObject.
#>
[cmdletBinding()]
param(
[PSCustomObject] $GPO
)
foreach ($Registry in $GPO.Settings) {
if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
[PSCustomObject] [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
FallbackSource = 'RegistrySettings'
Hive = $Registry.Hive
Key = $Registry.Key
Name = $Registry.Name
Type = $Registry.Type
Value = $Registry.Value
Changed = $Registry.Changed
Filters = $Registry.Filters
Linked = $GPO.Linked
LinksCount = $GPO.LinksCount
Links = $GPO.Links
}
}
}
}
Private/Script.GPODictionary.ps1
+21 -7
View File
@@ -1170,12 +1170,23 @@
Settings = 'Policy'
}
)
GPOPath = 'Policies -> Administrative Templates -> Windows Components/Windows Defender'
ByReports = @(
@{
Report = 'RegistrySettings'
}
)
GPOPath = @(
'Policies -> Administrative Templates -> Windows Components/Windows Defender'
'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus'
)
Code = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*'
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*'
}
CodeSingle = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*' -SingleObject
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*' -SingleObject
}
CodeReport = {
ConvertTo-XMLRegistryDefenderOnReport -GPO $GPO
}
}
WindowsDefenderExploitGuard = @{
@@ -1186,12 +1197,15 @@
Settings = 'Policy'
}
)
GPOPath = 'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard'
GPOPath = @(
'Policies -> Administrative Templates -> Windows Components/Windows Defender/Windows Defender Exploit Guard'
'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard'
)
Code = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*'
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*/Windows Defender Exploit Guard*', 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*', 'Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard*'
}
CodeSingle = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*' -SingleObject
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*/Windows Defender Exploit Guard*', 'Windows Components/Microsoft Defender Antivirus/Microsoft Defender Exploit Guard*', 'Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard*' -SingleObject
}
}
# WindowsFirewall = @{
@@ -1428,4 +1442,4 @@
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Update*', 'Windows Components/Delivery Optimization*' -SingleObject
}
}
}
}