GPOZaurr/Private/ConvertTo-XMLRegistryDefenderOnReport.ps1

function ConvertTo-XMLRegistryDefenderOnReport {
    <#
    .SYNOPSIS
    Converts Defender-related raw registry settings from the RegistrySettings report.

    .DESCRIPTION
    This function is used as a fallback for Defender settings that are not exposed as
    policy categories but are still present in RegistrySettings output.

    .PARAMETER GPO
    RegistrySettings report object generated by ConvertTo-XMLRegistrySettings -SingleObject.
    #>
    [cmdletBinding()]
    param(
        [PSCustomObject] $GPO
    )

    foreach ($Registry in $GPO.Settings) {
        if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
            [PSCustomObject] [ordered] @{
                DisplayName    = $GPO.DisplayName
                DomainName     = $GPO.DomainName
                GUID           = $GPO.GUID
                GpoType        = $GPO.GpoType
                FallbackSource = 'RegistrySettings'
                Hive           = $Registry.Hive
                Key            = $Registry.Key
                Name           = $Registry.Name
                Type           = $Registry.Type
                Value          = $Registry.Value
                Changed        = $Registry.Changed
                Filters        = $Registry.Filters
                Linked         = $GPO.Linked
                LinksCount     = $GPO.LinksCount
                Links          = $GPO.Links
            }
        }
    }
}