gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 04:37:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refine Defender output merge and list parsing for issue #81 feedback

Browse Source
This commit is contained in:
Przemysław Kłys
2026-02-24 14:28:47 +01:00
parent 707c0ed4b2
commit 98e93aa07d
4 changed files with 164 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/ConvertTo-XMLRegistryDefenderOnReport.ps1
+40 -16
View File
@@ -31,25 +31,49 @@ function ConvertTo-XMLRegistryDefenderOnReport {
}
}
$UsedNames = [System.Collections.Generic.List[string]]::new()
$CreateGPO = [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
}
$DefenderSettings = 0
foreach ($Registry in $RegistrySettings) {
if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
[PSCustomObject] [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
FallbackSource = 'RegistrySettings'
Hive = $Registry.Hive
Key = $Registry.Key
Name = $Registry.Name
Type = $Registry.Type
Value = $Registry.Value
Changed = $Registry.Changed
Filters = $Registry.Filters
Linked = $GPO.Linked
LinksCount = $GPO.LinksCount
Links = $GPO.Links
$DefenderSettings++
$SettingName = if ($Registry.Name) { $Registry.Name } else { $Registry.Key }
$PropertyName = Format-ToTitleCase -Text $SettingName -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
if ($PropertyName -in $UsedNames) {
$UsedNames.Add($PropertyName)
$TimesUsed = ($UsedNames | Group-Object | Where-Object { $_.Name -eq $PropertyName }).Count
$PropertyName = -join ($PropertyName, "$TimesUsed")
} else {
$UsedNames.Add($PropertyName)
}
$SettingValue = $Registry.Value
if ($null -eq $SettingValue -or "$SettingValue" -eq '') {
$SettingValue = $Registry.Name
}
$CreateGPO[$PropertyName] = $SettingValue
# Some Defender data can be encoded in either value or value-name depending on setting type.
if ($Registry.Name -and "$SettingValue" -ne "$($Registry.Name)") {
$CreateGPO["$($PropertyName)ValueName"] = $Registry.Name
}
if ($Registry.Key) {
$CreateGPO["$($PropertyName)RegistryKey"] = $Registry.Key
}
}
}
if ($DefenderSettings -gt 0) {
$CreateGPO['Linked'] = $GPO.Linked
$CreateGPO['LinksCount'] = $GPO.LinksCount
$CreateGPO['Links'] = $GPO.Links
[PSCustomObject] $CreateGPO
}
}