Fix Defender policy detection for new ADMX paths and add registry fallback (#81)

2026-08-30 20:29:06 +00:00 · 2026-02-18 11:39:31 +01:00
parent 95789953a8
commit 3a69d14354
4 changed files with 131 additions and 7 deletions
@@ -0,0 +1,39 @@
+function ConvertTo-XMLRegistryDefenderOnReport {
+    <#
+    .SYNOPSIS
+    Converts Defender-related raw registry settings from the RegistrySettings report.
+
+    .DESCRIPTION
+    This function is used as a fallback for Defender settings that are not exposed as
+    policy categories but are still present in RegistrySettings output.
+
+    .PARAMETER GPO
+    RegistrySettings report object generated by ConvertTo-XMLRegistrySettings -SingleObject.
+    #>
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+
+    foreach ($Registry in $GPO.Settings) {
+        if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
+            [PSCustomObject] [ordered] @{
+                DisplayName    = $GPO.DisplayName
+                DomainName     = $GPO.DomainName
+                GUID           = $GPO.GUID
+                GpoType        = $GPO.GpoType
+                FallbackSource = 'RegistrySettings'
+                Hive           = $Registry.Hive
+                Key            = $Registry.Key
+                Name           = $Registry.Name
+                Type           = $Registry.Type
+                Value          = $Registry.Value
+                Changed        = $Registry.Changed
+                Filters        = $Registry.Filters
+                Linked         = $GPO.Linked
+                LinksCount     = $GPO.LinksCount
+                Links          = $GPO.Links
+            }
+        }
+    }
+}