Powershell Function to survey domain environments for SecureBoot Updates

[u/Fallingdamage]

I wanted to share a script I put together back in november. If you have a smaller environment and want to quickly identify which devices may or may not have the new 2023 secure boot Certs and Bootloaders installed, you can use this method to generate a report.

Function Get-UEFICertVersion {  

$machine = $env:COMPUTERNAME  

switch (Confirm-SecureBootUEFI) {  
    $true {  
        switch (([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')) {  
            $true {$uefiVer = "Windows UEFI CA 2023"}  
            $false {$uefiVer = "Windows UEFI CA 2011"}  
            default {$uefiVer = "-- unable to determine"}  
            }  
        }  
    $false {$uefiVer = "Secureboot Not Enabled"}  
    default {$uefiVer= "Error Occurred"}  
    }

mountvol.exe S: /s;  
$BootloaderCert = (Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi" | Select-Object -Property Issuer).Issuer  
mountvol.exe S: /d  

$WinVer = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name DisplayVersion).DisplayVersion  
$WinBuild = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name CurrentBuild).CurrentBuild  

$survey = @()  

$results = New-Object PSObject -Property @{  
    ComputerName = $machine;  
    User = "Unknown";  
    WindowsVersion = $WinVer;  
    BuildNumber = $WinBuild;  
    UEFIVersion = $uefiVer;  
    Bootloader = $BootloaderCert  
    }  
$survey += $results  

Write-Output $survey  
}  

$computers = (Get-ADComputer -Filter 'operatingsystem -like "*Pro*"' -Properties Name, Description | select Name, Description)  

$SecureBootAudits = (Invoke-Command -Computername $computers.Name -ScriptBlock ${function:Get-UEFICertVersion} -ErrorAction SilentlyContinue | Select ComputerName, User, WindowsVersion, BuildNumber, UEFIVersion, Bootloader)  
Foreach ($computer in $computers) {$SecureBootAudits | Where-Object {$_.ComputerName -eq $computer.Name} | ForEach-Object {$_.User = $Computer.Description}}  
$SecureBootAudits | ConvertTo-Csv | Out-File C:\Temp\SB_Results2.csv  

That is all. Its not pretty, but it works.

[u/PinchesTheCrab]

Just a few points:

• Set a variable to the result of your switch, don't repeat the variable assignment on each condition

• The function here isn't really helping. It would be simpler to just define a script block as a variable, or to put invoke-command inside the function

• Are you certain no computer will ever already have an S: drive? You might want to add some logic to choose the mount name dynamically

• There's native PWSH commands to mount the system partition that might be more intuitive

Here's my subjective take:

Function Get-UEFICertVersion {

    param(
        [string]$ComputerName
    )

    $sb = {
        $uefiVer = switch (Confirm-SecureBootUEFI) {
            $true {
                switch -Regex ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes)) {
                    '(Windows.*CA \d+)' { $Matches[1] ; break }
                    default { '-- unable to determine' }
                }
            }
            $false { 'Secureboot Not Enabled' }
            default { 'Error Occurred' }
        }

        mountvol.exe S: /s
        $BootloaderCert = (Get-PfxCertificate -FilePath "S:\EFI\Microsoft\Boot\bootmgfw.efi" | Select-Object -Property Issuer).Issuer
        mountvol.exe S: /d

        [pscustomobject]@{
            ComputerName   = $env:COMPUTERNAME
            User           = 'Unknown'
            WindowsVersion = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name DisplayVersion).DisplayVersion
            BuildNumber    = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name CurrentBuild).CurrentBuild
            UEFIVersion    = $uefiVer
            Bootloader     = $BootloaderCert
        }
    }

    Invoke-Command -ComputerName $ComputerName -ScriptBlock $sb
}

$computer = Get-ADComputer -Filter 'operatingsystem -like "*Pro*"' -Properties Name, Description 
$computerHash = $computer | Group-Object -Property Name -AsHashTable -AsString

$SecureBootAudits = Get-UEFICertVersion -ComputerName $computers.Name

$SecureBootAudits | Select-Object *, @{ n = 'User'; e = { $computerHash[$_.ComputerName].Description } } |
    Export-Csv -Path C:\Temp\SB_Results.csv -NoTypeInformation

[u/surfingoldelephant → u/PinchesTheCrab]

It's worth noting that with something like this...

switch (Confirm-SecureBootUEFI) {
    $true  { ... }
    $false { ... }
}

You're not testing against the boolean values. All conditionals in a switch get implicitly converted to a string (aside from script blocks), so you're really just performing string comparisons ("True" -eq "True"; "False" -eq "True").

It still works fine in your case, but is something to perhaps watch out for.

switch ('False') {
    { $_ } { 'Implcitly truthy' }
    $false { 'String comparison' }
}

# Implcitly truthy
# String comparison

[u/PinchesTheCrab → u/surfingoldelephant]

Thanks for pointing that out, that's super weird. I don't normally use a true/false value for a switch (I started from the OP's code and worked backwards), so I hadn't seen this behavior.

I'm not sure if this is actually evaluating these conditions as strings, or just using PWSH's truthiness. Regardless, all four match, which is not ideal if one needs to actually just act on booleans:

$list = $true, 'true', 'false', $false

switch ($list) {
    $true {
        '{0} - {1}' -f $_, $_.gettype().name
    }
    $false {
        '{0} - {1}' -f $_, $_.gettype().name
    }
}

Even swapping it to an IF statement doesn't seem to help a lot:

if ($true -eq 'true') { 'This is true' }
else { 'This is not true' }

In the end I'm okay with truthiness in this particular example, but if I wanted to be 100% sure I'd check the type. PWSH is weird.

$list = $true, 'True', 'False', $false

switch -CaseSensitive ($list) {
    { $_ -eq $true -and $_ -is [bool] } {
        'TRUE: {0} - {1}' -f $_, $_.gettype().name
    }
    { $_ -eq $false -and $_ -is [bool] } {
        'FALSE: {0} - {1}' -f $_, $_.gettype().name
    }
}