gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-18 06:23:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address PR feedback: make Defender fallback work without RegistrySettings type

Browse Source
This commit is contained in:
Przemysław Kłys
2026-02-18 11:48:10 +01:00
parent 3a69d14354
commit 707c0ed4b2
3 changed files with 55 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/ConvertTo-XMLRegistryDefenderOnReport.ps1
+17 -1
View File
@@ -15,7 +15,23 @@ function ConvertTo-XMLRegistryDefenderOnReport {
[PSCustomObject] $GPO
)
foreach ($Registry in $GPO.Settings) {
[Array] $RegistrySettings = @()
if ($GPO.Settings) {
$RegistrySettings = $GPO.Settings
} elseif ($GPO.DataSet) {
# This path supports direct use from dictionary code where RegistrySettings is not requested explicitly.
[Array] $DataSet = $GPO.DataSet
if ($DataSet.Count -gt 0 -and (
$DataSet[0].PSObject.Properties.Name -contains 'Properties' -or
$DataSet[0].PSObject.Properties.Name -contains 'Registry' -or
$DataSet[0].PSObject.Properties.Name -contains 'Collection'
)
) {
$RegistrySettings = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
}
}
foreach ($Registry in $RegistrySettings) {
if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
[PSCustomObject] [ordered] @{
DisplayName = $GPO.DisplayName
Private/Script.GPODictionary.ps1
+10 -8
View File
@@ -1169,10 +1169,9 @@
Category = 'RegistrySettings'
Settings = 'Policy'
}
)
ByReports = @(
@{
Report = 'RegistrySettings'
Category = 'RegistrySettings'
Settings = 'RegistrySettings'
}
)
GPOPath = @(
@@ -1180,13 +1179,16 @@
'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus'
)
Code = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*'
@(
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*'
ConvertTo-XMLRegistryDefenderOnReport -GPO $GPO
) | Where-Object { $_ }
}
CodeSingle = {
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*' -SingleObject
}
CodeReport = {
ConvertTo-XMLRegistryDefenderOnReport -GPO $GPO
@(
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Windows Defender*', 'Windows Components/Microsoft Defender Antivirus*' -SingleObject
ConvertTo-XMLRegistryDefenderOnReport -GPO $GPO
) | Where-Object { $_ }
}
}
WindowsDefenderExploitGuard = @{
Tests/DefenderContent.Tests.ps1
+28 -2
View File
@@ -8,8 +8,8 @@ Describe 'Defender content detection' {
$Entry = $Script:GPODitionary['WindowsDefender']
$Entry.GPOPath | Should -Contain 'Policies -> Administrative Templates -> Windows Components/Windows Defender'
$Entry.GPOPath | Should -Contain 'Policies -> Administrative Templates -> Windows Components/Microsoft Defender Antivirus'
$Entry.ByReports.Report | Should -Contain 'RegistrySettings'
$Entry.CodeReport.ToString() | Should -Match 'ConvertTo-XMLRegistryDefenderOnReport'
($Entry.Types | Where-Object { $_.Category -eq 'RegistrySettings' -and $_.Settings -eq 'RegistrySettings' }).Count | Should -BeGreaterOrEqual 1
$Entry.Code.ToString() | Should -Match 'ConvertTo-XMLRegistryDefenderOnReport'
}
}
@@ -61,4 +61,30 @@ Describe 'Defender content detection' {
$Result[0].Name | Should -Be 'MpFolderScanThreadCount'
}
}
It 'ConvertTo-XMLRegistryDefenderOnReport supports raw DataSet input' {
InModuleScope GPOZaurr {
$GPO = [PSCustomObject] @{
DisplayName = 'Test Defender GPO'
DomainName = 'contoso.com'
GUID = '11111111-1111-1111-1111-111111111111'
GpoType = 'Computer'
Linked = $true
LinksCount = 1
Links = @('OU=Workstations,DC=contoso,DC=com')
DataSet = ([xml] @"
<Root>
<Registry changed='2026-02-18T11:15:00' disabled='0'>
<Properties action='U' hive='HKEY_LOCAL_MACHINE' key='SOFTWARE\Microsoft\Windows Defender\MpEngine' name='MpFolderScanThreadCount' type='REG_DWORD' value='4' />
</Registry>
</Root>
"@).Root.Registry
}
[Array] $Result = ConvertTo-XMLRegistryDefenderOnReport -GPO $GPO
$Result.Count | Should -Be 1
$Result[0].Key | Should -Be 'SOFTWARE\Microsoft\Windows Defender\MpEngine'
$Result[0].Name | Should -Be 'MpFolderScanThreadCount'
}
}
}