GPOZaurr/Private/ConvertTo-XMLRegistryDefenderOnReport.ps1

function ConvertTo-XMLRegistryDefenderOnReport {
    <#
    .SYNOPSIS
    Converts Defender-related raw registry settings from the RegistrySettings report.

    .DESCRIPTION
    This function is used as a fallback for Defender settings that are not exposed as
    policy categories but are still present in RegistrySettings output.

    .PARAMETER GPO
    RegistrySettings report object generated by ConvertTo-XMLRegistrySettings -SingleObject.
    #>
    [cmdletBinding()]
    param(
        [PSCustomObject] $GPO
    )

    [Array] $RegistrySettings = @()
    if ($GPO.Settings) {
        $RegistrySettings = $GPO.Settings
    } elseif ($GPO.DataSet) {
        # This path supports direct use from dictionary code where RegistrySettings is not requested explicitly.
        [Array] $DataSet = $GPO.DataSet
        if ($DataSet.Count -gt 0 -and (
                $DataSet[0].PSObject.Properties.Name -contains 'Properties' -or
                $DataSet[0].PSObject.Properties.Name -contains 'Registry' -or
                $DataSet[0].PSObject.Properties.Name -contains 'Collection'
            )
        ) {
            $RegistrySettings = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
        }
    }

    $UsedNames = [System.Collections.Generic.List[string]]::new()
    $CreateGPO = [ordered] @{
        DisplayName = $GPO.DisplayName
        DomainName  = $GPO.DomainName
        GUID        = $GPO.GUID
        GpoType     = $GPO.GpoType
    }
    $DefenderSettings = 0

    foreach ($Registry in $RegistrySettings) {
        if ($Registry.Key -like 'SOFTWARE\Microsoft\Windows Defender*') {
            $DefenderSettings++
            $SettingName = if ($Registry.Name) { $Registry.Name } else { $Registry.Key }
            $PropertyName = Format-ToTitleCase -Text $SettingName -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'

            if ($PropertyName -in $UsedNames) {
                $UsedNames.Add($PropertyName)
                $TimesUsed = ($UsedNames | Group-Object | Where-Object { $_.Name -eq $PropertyName }).Count
                $PropertyName = -join ($PropertyName, "$TimesUsed")
            } else {
                $UsedNames.Add($PropertyName)
            }

            $SettingValue = $Registry.Value
            if ($null -eq $SettingValue -or "$SettingValue" -eq '') {
                $SettingValue = $Registry.Name
            }
            $CreateGPO[$PropertyName] = $SettingValue

            # Some Defender data can be encoded in either value or value-name depending on setting type.
            if ($Registry.Name -and "$SettingValue" -ne "$($Registry.Name)") {
                $CreateGPO["$($PropertyName)ValueName"] = $Registry.Name
            }
            if ($Registry.Key) {
                $CreateGPO["$($PropertyName)RegistryKey"] = $Registry.Key
            }
        }
    }

    if ($DefenderSettings -gt 0) {
        $CreateGPO['Linked'] = $GPO.Linked
        $CreateGPO['LinksCount'] = $GPO.LinksCount
        $CreateGPO['Links'] = $GPO.Links
        [PSCustomObject] $CreateGPO
    }
}