Forum Discussion

SteveCox's avatar
SteveCox
Brass Contributor
Feb 08, 2022

new content after last match of a Pattern in XML file

Hi I am trying to use Powershell to add content to an XML file after the last match of a pattern 

I need to add the content from $OutTemp txt file 

"<!-- steve.cox - test3 -02/02/2022 11:01:36 -->
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_2.0&amp;REV_PMAP\5B8207000061&amp;0</InstancePathId>
<!-- steve.cox - test4 - -02/02/2022 11:01:36 -->
<InstancePathId>USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_SILICON-POWER&amp;REV_PMAP\MSFTNAKTM1070837BA061C1622&amp;0</InstancePathId>"

 

To below the last </InstancePathId> line of the USB-Groups.XML File 

<Groups>
<Group Id="{9b28fae8-72f7-4267-a1a5-685f747a7146}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b9b28fae8-72f7-4267-a1a5-685f747a7146%7d/GroupData -->
<MatchType>MatchAny</MatchType>
<DescriptorIdList>
<PrimaryId>RemovableMediaDevices</PrimaryId>
<PrimaryId>CdRomDevices</PrimaryId>
<PrimaryId>WpdDevices</PrimaryId>
</DescriptorIdList>
</Group>
<Group Id="{65fa649a-a111-4912-9294-fb6337a25038}">
<MatchType>MatchAny</MatchType>
<DescriptorIdList>
<InstancePathId>USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_SILICON-POWER&amp;REV_PMAP\MSFTNAKTM10708466023196668&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_2.0&amp;REV_0000\408D5C1EF726102179650693&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_3.0&amp;REV_PMAP\60A44C42651BB2A04626FC36&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_SANDISK&amp;PROD_CRUZER_EDGE&amp;REV_1.26\20043514001B91029E82&amp;0</InstancePathId>
</DescriptorIdList>
</Group>
</Groups>"

 

If I use 

"

Function WritetoXML {

$NewLines = Get-Content -Path $OutTemp | ?{$_.Trim() -ne ""}

$New = Get-Content -Path $XMLPath |
ForEach-Object {
$_
If($_-match ('</InstancePathId>'))
{
$NewLines
}
}

$New | Out-File -FilePath $XMLPath -Force
Remove-Item $OutTemp
}"

 

it writes after each instance of '</InstancePathId>' but cannot work out how to get this to write to only after the last instance 

 

 

Windows Defender
  • farismalaeb's avatar
    farismalaeb
    Feb 12, 2022
    Glad it help.
    Kindly mark the answer as best response.
    For the XML, I need to check it, and also you can start a new post as it also be better in the search engines.

    Thanks
  • farismalaeb's avatar
    farismalaeb
    Steel Contributor
    Feb 09, 2022

    SteveCox 

    Hi

    I think this should help

     

    $NewLines = Get-Content -Path C:\Users\f.malaeb\OutTemp.txt | ?{$_.Trim() -ne ""}
[System.Collections.ArrayList]$New = Get-Content -Path C:\Users\f.malaeb\XML.xml 
$IndexNumber=(($new | Select-String "<InstancePathId>").LineNumber)[-1]
$new.Insert($IndexNumber,$NewLines)

$new

    The Expected output is 

    <Groups>
<Group Id="{9b28fae8-72f7-4267-a1a5-685f747a7146}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b9b28fae8-72f7-4267-a1a5-685f747a7146%7d/GroupData -->
<MatchType>MatchAny</MatchType>
<DescriptorIdList>
<PrimaryId>RemovableMediaDevices</PrimaryId>
<PrimaryId>CdRomDevices</PrimaryId>
<PrimaryId>WpdDevices</PrimaryId>
</DescriptorIdList>
</Group>
<Group Id="{65fa649a-a111-4912-9294-fb6337a25038}">
<MatchType>MatchAny</MatchType>
<DescriptorIdList>
<InstancePathId>USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_SILICON-POWER&amp;REV_PMAP\MSFTNAKTM10708466023196668&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_2.0&amp;REV_0000\408D5C1EF726102179650693&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_3.0&amp;REV_PMAP\60A44C42651BB2A04626FC36&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_SANDISK&amp;PROD_CRUZER_EDGE&amp;REV_1.26\20043514001B91029E82&amp;0</InstancePathId>
<!-- steve.cox - test3 -02/02/2022 11:01:36 -->
<InstancePathId>USBSTOR\DISK&amp;VEN_KINGSTON&amp;PROD_DATATRAVELER_2.0&amp;REV_PMAP\5B8207000061&amp;0</InstancePathId>
<!-- steve.cox - test4 - -02/02/2022 11:01:36 -->
<InstancePathId>USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_SILICON-POWER&amp;REV_PMAP\MSFTNAKTM1070837BA061C1622&amp;0</InstancePathId>
</DescriptorIdList>
</Group>
</Groups>

     

    • SteveCox's avatar
      SteveCox
      Brass Contributor
      Feb 10, 2022
      Hi yes thanks for the help worked perfectly, still had an issue with the Encoding of the XML output being Created as UTF-16 LE BOM so wouldn't Parse correctly so fixed this with this line to save a UTF-8 "[IO.File]::WriteAllLines($XMLPath, $BOMFile)" and also found that Defender doesn't Like Comments in the "Descriptor ID" so have removed them and created change log in a different Location So if anyone is trying to Use Scripts to Edit the XML Files for Defender USB Blocking watch out for Encoding and Comments Thanks again for the assistance
      • farismalaeb's avatar
        farismalaeb
        Steel Contributor
        Feb 12, 2022
        Glad it help.
        Kindly mark the answer as best response.
        For the XML, I need to check it, and also you can start a new post as it also be better in the search engines.

        Thanks

Resources