GPOZaurr/Private/ConvertTo-XMLRegistryDefenderOnReport.ps1

function ConvertTo-XMLRegistryDefenderOnReport {
    <#
    .SYNOPSIS
    Converts Defender-related raw registry settings from the RegistrySettings report.

    .DESCRIPTION
    This function is used as a fallback for Defender settings that are not exposed as
    policy categories but are still present in RegistrySettings output.

    .PARAMETER GPO
    RegistrySettings report object generated by ConvertTo-XMLRegistrySettings -SingleObject.
    #>
    [cmdletBinding()]
    param(
        [PSCustomObject] $GPO
    )

    [Array] $RegistrySettings = @()
    if ($GPO.Settings) {
        $RegistrySettings = $GPO.Settings
    } elseif ($GPO.DataSet) {
        # This path supports direct use from dictionary code where RegistrySettings is not requested explicitly.
        [Array] $DataSet = $GPO.DataSet
        if ($DataSet.Count -gt 0 -and (
                $DataSet[0].PSObject.Properties.Name -contains 'Properties' -or
                $DataSet[0].PSObject.Properties.Name -contains 'Registry' -or
                $DataSet[0].PSObject.Properties.Name -contains 'Collection'
            )
        ) {
            $RegistrySettings = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
        }
    }

    foreach ($Registry in $RegistrySettings) {
        if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
            [PSCustomObject] [ordered] @{
                DisplayName    = $GPO.DisplayName
                DomainName     = $GPO.DomainName
                GUID           = $GPO.GUID
                GpoType        = $GPO.GpoType
                FallbackSource = 'RegistrySettings'
                Hive           = $Registry.Hive
                Key            = $Registry.Key
                Name           = $Registry.Name
                Type           = $Registry.Type
                Value          = $Registry.Value
                Changed        = $Registry.Changed
                Filters        = $Registry.Filters
                Linked         = $GPO.Linked
                LinksCount     = $GPO.LinksCount
                Links          = $GPO.Links
            }
        }
    }
}