GPOZaurr/Private/ConvertTo-XMLWindowsFirewallRules.ps1

function ConvertTo-XMLWindowsFirewallRules {
    <#
    .SYNOPSIS
    Converts Windows Firewall rules to XML format.

    .DESCRIPTION
    This function converts Windows Firewall rules to XML format for easier management and analysis.

    .PARAMETER GPO
    Specifies the Group Policy Object (GPO) containing the firewall rules to be converted.

    .PARAMETER SingleObject
    Indicates whether to convert a single firewall rule object.

    .EXAMPLE
    ConvertTo-XMLWindowsFirewallRules -GPO $GPOObject -SingleObject
    Converts all firewall rules in the specified GPO to XML format.

    .EXAMPLE
    ConvertTo-XMLWindowsFirewallRules -GPO $GPOObject
    Converts all firewall rules in the specified GPO to XML format without creating a single object.

    #>
    [cmdletBinding()]
    param(
        [PSCustomObject] $GPO,
        [switch] $SingleObject
    )
    if ($SingleObject) {
        $CreateGPO = [ordered]@{
            DisplayName = $GPO.DisplayName
            DomainName  = $GPO.DomainName
            GUID        = $GPO.GUID
            GpoType     = $GPO.GpoType
            #GpoCategory = $GPOEntry.GpoCategory
            #GpoSettings = $GPOEntry.GpoSettings
            Count       = 0
            Settings    = $null
        }
        [Array] $CreateGPO['Settings'] = foreach ($Rule in $GPO.DataSet) {
            [PSCustomObject] @{
                Version           = $Rule.Version
                Type              = if ($Rule.Dir -eq 'In') { 'Inbound' } elseif ($Rule.Dir -eq 'Out') { 'Outbound' } else { $Rule.Dir }
                Name              = $Rule.Name
                Action            = $Rule.Action
                Enabled           = if ($Rule.Active -eq 'true') { $true } else { $false }
                Profile           = $Rule.Profile
                Svc               = $Rule.Svc
                LocalAddressIPv4  = $Rule.LA4
                LocalAddressIPv6  = $Rule.LA6
                RemoteAddressIPV4 = $Rule.RA4
                RemoteAddressIPV6 = $Rule.RA6
                LocalPort         = $Rule.LPort
                RemotePort        = $Rule.RPort
                Description       = $Rule.Desc
                EmbedCtxt         = $Rule.EmbedCtxt
                Edge              = $Rule.Edge
                IFType            = $Rule.IFType
                Security          = $Rule.Security
                App               = $Rule.App
                Protocol          = $Rule.Protocol
                RMAuth            = $Rule.RMAuth
                RUAuth            = $Rule.RUAuth
                ICMP4             = $Rule.ICMP4
                LocalName         = $Rule.LocalName

            }
        }
        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
        $CreateGPO['Linked'] = $GPO.Linked
        $CreateGPO['LinksCount'] = $GPO.LinksCount
        $CreateGPO['Links'] = $GPO.Links
        [PSCustomObject] $CreateGPO
    } else {
        foreach ($Rule in $GPO.DataSet) {
            [PSCustomObject]@{
                DisplayName       = $GPO.DisplayName
                DomainName        = $GPO.DomainName
                GUID              = $GPO.GUID
                GpoType           = $GPO.GpoType
                Version           = $Rule.Version
                Type              = if ($Rule.Dir -eq 'In') { 'Inbound' } elseif ($Rule.Dir -eq 'Out') { 'Outbound' } else { $Rule.Dir }
                Name              = $Rule.Name
                Action            = $Rule.Action
                Enabled           = if ($Rule.Active -eq 'true') { $true } else { $false }
                Profile           = $Rule.Profile
                Svc               = $Rule.Svc
                LocalAddressIPv4  = $Rule.LA4
                LocalAddressIPv6  = $Rule.LA6
                RemoteAddressIPV4 = $Rule.RA4
                RemoteAddressIPV6 = $Rule.RA6
                LocalPort         = $Rule.LPort
                RemotePort        = $Rule.RPort
                Description       = $Rule.Desc
                EmbedCtxt         = $Rule.EmbedCtxt
                Edge              = $Rule.Edge
                IFType            = $Rule.IFType
                Security          = $Rule.Security
                App               = $Rule.App
                Protocol          = $Rule.Protocol
                RMAuth            = $Rule.RMAuth
                RUAuth            = $Rule.RUAuth
                ICMP4             = $Rule.ICMP4
                LocalName         = $Rule.LocalName
                Linked            = $GPO.Linked
                LinksCount        = $GPO.LinksCount
                Links             = $GPO.Links
            }
        }
    }
}
<#
Version   : 2.30
Action    : Allow
Name      : @%SystemRoot%\system32\firewallapi.dll,-37303
Dir       : In
App       : %SystemRoot%\system32\svchost.exe
Svc       : dnscache
Profile   : Public
RA4       : LocalSubnet
RA6       : LocalSubnet
LPort     : 5353
Protocol  : 17
Desc      : @%SystemRoot%\system32\firewallapi.dll,-37304
Active    : true
EmbedCtxt : @%SystemRoot%\system32\firewallapi.dll,-37302


Version : 2.30
Action  : Allow
Name    : TEST APP
Dir     : In
App     : C:\Test\exe.exe
Active  : true

Version : 2.30
Action  : Block
Name    : Blo
Dir     : Out
App     : dfdff
Active  : true

Version   : 2.30
Action    : Block
Name      : @FirewallAPI.dll,-36012
Dir       : Out
App       : %SystemRoot%\system32\svchost.exe
Svc       : Qwave
Profile   : {Private, Public}
RPort     : 2177
Protocol  : 17
Desc      : @FirewallAPI.dll,-36013
Active    : true
EmbedCtxt : @FirewallAPI.dll,-36001
#>