NLBaselineIntuneDeviceHardening

1.0.0

Private/Convert-BaselineToOmaSettings.ps1

<#
.SYNOPSIS
    Converts baseline JSON items to Intune OMA-URI settings.
.DESCRIPTION
    Maps registry-style baseline entries to omaSetting format for windows10CustomConfiguration.
#>
function Convert-BaselineToOmaSettings {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$BaselineItems
    )

    $omaSettings = [System.Collections.Generic.List[object]]::new()
    $seenUris = [System.Collections.Generic.HashSet[string]]::new()

    foreach ($item in $BaselineItems) {
        try {
            $keyName = $item.KeyName
            if ([string]::IsNullOrEmpty($keyName)) { continue }
            
            $valueName = $item.ValueName
            if ($valueName -and $valueName -match '^\*\*del\.') {
                Write-Verbose "Skipping delete operation: $valueName"
                continue
            }
            
            $regValue = $item.RegValue
            $type = if ($null -ne $item.Type) { [int]$item.Type } else { 1 }
            $hive = if ($null -ne $item.Hive) { [int]$item.Hive } else { 0 }
            $friendlyName = if ($item.FriendlyName) { $item.FriendlyName } else { $valueName }
            if ([string]::IsNullOrEmpty($friendlyName)) { $friendlyName = "Setting" }
            $desc = if ($item.URL) { $item.URL } else { "Baseline: $friendlyName" }

            $root = if ($hive -eq 1) { "HKCU" } else { "HKLM" }
            $path = $keyName -replace '\\\\', '\' -replace '\\', '/'
            $path = $path.ToLower()
            if ($path -notmatch '^software/|^system/') {
                $path = "Software/$path"
            }
            
            $pathEncoded = $path -replace ' ', '%20'
            
            $omaUri = "./Device/Vendor/MSFT/Registry/$root/$pathEncoded"
            if ($valueName -and -not [string]::IsNullOrEmpty($valueName)) {
                $valueNameEncoded = $valueName -replace ' ', '%20'
                $omaUri = "$omaUri/$valueNameEncoded"
            }
            
            if ($omaUri.Length -gt 500) {
                Write-Verbose "OMA-URI too long, skipping: $omaUri"
                continue
            }

            $oma = @{
                displayName = $friendlyName
                description = $desc
                omaUri      = $omaUri
            }

            if ($type -eq 4) {
                $oma["@odata.type"] = "#microsoft.graph.omaSettingInteger"
                $intVal = 0
                if ($null -ne $regValue -and $regValue -ne "") {
                    [int]::TryParse($regValue, [ref]$intVal) | Out-Null
                }
                $oma["value"] = $intVal
            }
            else {
                $oma["@odata.type"] = "#microsoft.graph.omaSettingString"
                $strVal = if ($null -ne $regValue) { [string]$regValue } else { "" }
                if ([string]::IsNullOrEmpty($strVal)) {
                    Write-Verbose "Skipping setting with empty value: $friendlyName"
                    continue
                }
                if ($strVal.Length -gt 10000) {
                    Write-Verbose "Value too long, truncating: $friendlyName"
                    $strVal = $strVal.Substring(0, 10000)
                }
                $oma["value"] = $strVal
            }
            
            if ($oma.displayName.Length -gt 256) {
                $oma.displayName = $oma.displayName.Substring(0, 256)
            }

            $uriKey = $omaUri.ToUpper()
            if ($seenUris.Contains($uriKey)) {
                Write-Verbose "Skipping duplicate OMA-URI: $omaUri"
                continue
            }
            $seenUris.Add($uriKey) | Out-Null

            $omaSettings.Add($oma)
        }
        catch {
            Write-Verbose "Skip baseline item: $_"
        }
    }

    return @($omaSettings)
}