gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 12:47:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refine Defender output merge and list parsing for issue #81 feedback

Browse Source
This commit is contained in:
Przemysław Kłys
2026-02-24 14:28:47 +01:00
parent 707c0ed4b2
commit 98e93aa07d
4 changed files with 164 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/ConvertTo-XMLGenericPolicy.ps1
+41 -3
View File
@@ -92,7 +92,26 @@
#>
if ($Value.Value.Element) {
$Settings["$SubName"] = $Value.Value.Element.Data -join '; '
[Array] $ElementValues = foreach ($Element in @($Value.Value.Element)) {
if (-not $Element) {
continue
}
$ElementName = [string] $Element.Name
$ElementData = [string] $Element.Data
if (-not [string]::IsNullOrWhiteSpace($ElementName) -and ($ElementData -eq '' -or $ElementData -eq '0')) {
$ElementName
} elseif (-not [string]::IsNullOrWhiteSpace($ElementName) -and -not [string]::IsNullOrWhiteSpace($ElementData) -and $ElementName -ne $ElementData) {
"$ElementName ($ElementData)"
} elseif (-not [string]::IsNullOrWhiteSpace($ElementData)) {
$ElementData
} elseif (-not [string]::IsNullOrWhiteSpace($ElementName)) {
$ElementName
}
}
if ($ElementValues.Count -gt 0) {
$Settings["$SubName"] = $ElementValues -join '; '
}
} elseif ($null -eq $Value.Value.Name) {
# Shouldn't happen but lets see
Write-Verbose "Tracking $Value"
@@ -174,7 +193,26 @@
#>
if ($Value.Value.Element) {
$CreateGPO["$SubName"] = $Value.Value.Element.Data -join '; '
[Array] $ElementValues = foreach ($Element in @($Value.Value.Element)) {
if (-not $Element) {
continue
}
$ElementName = [string] $Element.Name
$ElementData = [string] $Element.Data
if (-not [string]::IsNullOrWhiteSpace($ElementName) -and ($ElementData -eq '' -or $ElementData -eq '0')) {
$ElementName
} elseif (-not [string]::IsNullOrWhiteSpace($ElementName) -and -not [string]::IsNullOrWhiteSpace($ElementData) -and $ElementName -ne $ElementData) {
"$ElementName ($ElementData)"
} elseif (-not [string]::IsNullOrWhiteSpace($ElementData)) {
$ElementData
} elseif (-not [string]::IsNullOrWhiteSpace($ElementName)) {
$ElementName
}
}
if ($ElementValues.Count -gt 0) {
$CreateGPO["$SubName"] = $ElementValues -join '; '
}
} elseif ($null -eq $Value.Value.Name) {
# Shouldn't happen but lets see
Write-Verbose "Tracking $Value"
@@ -204,4 +242,4 @@
#}
}
}
}
}
Private/ConvertTo-XMLRegistryDefenderOnReport.ps1
+40 -16
View File
@@ -31,25 +31,49 @@ function ConvertTo-XMLRegistryDefenderOnReport {
}
}
$UsedNames = [System.Collections.Generic.List[string]]::new()
$CreateGPO = [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
}
$DefenderSettings = 0
foreach ($Registry in $RegistrySettings) {
if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
[PSCustomObject] [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
FallbackSource = 'RegistrySettings'
Hive = $Registry.Hive
Key = $Registry.Key
Name = $Registry.Name
Type = $Registry.Type
Value = $Registry.Value
Changed = $Registry.Changed
Filters = $Registry.Filters
Linked = $GPO.Linked
LinksCount = $GPO.LinksCount
Links = $GPO.Links
$DefenderSettings++
$SettingName = if ($Registry.Name) { $Registry.Name } else { $Registry.Key }
$PropertyName = Format-ToTitleCase -Text $SettingName -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
if ($PropertyName -in $UsedNames) {
$UsedNames.Add($PropertyName)
$TimesUsed = ($UsedNames | Group-Object | Where-Object { $_.Name -eq $PropertyName }).Count
$PropertyName = -join ($PropertyName, "$TimesUsed")
} else {
$UsedNames.Add($PropertyName)
}
$SettingValue = $Registry.Value
if ($null -eq $SettingValue -or "$SettingValue" -eq '') {
$SettingValue = $Registry.Name
}
$CreateGPO[$PropertyName] = $SettingValue
# Some Defender data can be encoded in either value or value-name depending on setting type.
if ($Registry.Name -and "$SettingValue" -ne "$($Registry.Name)") {
$CreateGPO["$($PropertyName)ValueName"] = $Registry.Name
}
if ($Registry.Key) {
$CreateGPO["$($PropertyName)RegistryKey"] = $Registry.Key
}
}
}
if ($DefenderSettings -gt 0) {
$CreateGPO['Linked'] = $GPO.Linked
$CreateGPO['LinksCount'] = $GPO.LinksCount
$CreateGPO['Links'] = $GPO.Links
[PSCustomObject] $CreateGPO
}
}