UPDATE 7/28/2017: Microsoft released Configuration Manager CB 1706 which now collects both UEFI and Secure Boot inventory by default when clients are running CB 1706 or later. UEFI only inventory was first included in CB 1702.

Now that Windows 10 has been released, you are probably starting to take a closer look at the new OS and the related security benefits that it has to offer.  Secure Boot is a supported security feature in Windows 10 that secures the boot process by only allowing the loading of drivers and boot loaders that are signed with a trusted signature.  The first versions of Windows to support Secure Boot were Windows 8 and Windows Server 2012.  Secure Boot requires computer systems to be running UEFI 2.3.1 (or later).  Legacy ROMs or compatibility support modules (CSM) must be disabled in order to enable Secure Boot.

In this blog, I will show you how to extend the Configuration Manager hardware inventory so that you can report on the state of Secure Boot in your environment.  This will not only tell you which systems have Secure Boot enabled or disabled, but it will also help you detect systems that are not currently running UEFI (the ones running in BIOS mode).  Identifying these systems will be helpful when determining the deployment method that you will select when moving to Windows 10.  If it is a requirement of your security team that all systems running Windows 10 must also be running Secure Boot, it will give you an idea on how much effort will be involved during the deployment process.

Now, for the systems that are running in BIOS mode, it will not show which ones are UEFI capable.  However, most enterprise class systems purchased in the last three years are UEFI capable.  In a later post, I will show how you can use OEM specific tools that will help you determine which systems are UEFI capable.  If the desire is to ‘take the hit’ and change all of the BIOS systems to UEFI as part of the Windows 10 deployment, then this will require the disks to be completely re-partitioned so that it can boot UEFI.  This is a destructive process, meaning that anything on the disk will be lost and any data that needs to be retained needs to be backed up to another location (like a network share, State Migration Point, external storage, or even a peer system – like Nomad Peer Backup Assistance).  Note that it is not necessary to convert to UEFI in order to upgrade to Windows 10.  Windows 10 supports systems that are currently running in BIOS mode, but you cannot take advantage of the security features in Windows 10 – like Secure Boot, Device Guard and Credential Guard.

The inventory extension is actually pretty simple and it will not add that much additional data to the hardware inventory scan.  Since I am keying off of a registry key, this extension uses the registry property provider and requires an addition to the configuration.mof file.  This file can be found in the .\inboxes\clifiles.src\hinv directory where Configuration Manager is installed on the Primary Site Server.  Add in the following section (also provided below in a file called UEFI_SECUREBOOT_CONFIGURATION.mof) at the end of file in between the // Added extensions start and // Added extensions end lines:

// ==================================================================
// START SECTION
// Custom UEFI Secure Boot Settings
// ==================================================================

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("SecureBootState", NOFAIL)
[DYNPROPS]
Class SecureBootState
{
	[key] string KeyName;
	Uint32 UEFISecureBootEnabled;
};

[DYNPROPS]
Instance of SecureBootState
{
	KeyName="Secure Boot Settings";
	[PropertyContext("Local|HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot\\State|UEFISecureBootEnabled"),Dynamic,Provider("RegPropProv")] UEFISecureBootEnabled;
};

// ==================================================================
// Custom UEFI Secure Boot Settings
// END SECTION
// ==================================================================

Next, save the following text to a file called UEFI_SECUREBOOT_SMS_DEF.mof (or download the file below):

// ==================================================================
// START SECTION
// Custom UEFI Secure Boot Settings
// ==================================================================

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("SecureBootState", NOFAIL)
[SMS_Report(TRUE),
SMS_Group_Name("Secure Boot State"),
SMS_Class_ID("UEFI|SecureBootState|1.0")]
Class SecureBootState: SMS_Class_Template
{
[SMS_Report(TRUE),key] string KeyName;
[SMS_Report(TRUE)] Uint32 UEFISecureBootEnabled;
};

// ==================================================================
// Custom UEFI Secure Boot Settings
// END SECTION
// ==================================================================

I typically make a backup of each file on the Primary Site Server in a folder called Custom MOF Extensions so that they can be backed up as part of a DR plan and so other team members know what custom inventory extensions were done.

Following this, navigate to the Default Client Settings in the Configuration Manager Console and select the Hardware Inventory section.  Once open, click on the Set Classes … button:

On the Hardware Inventory Classes screen, click the Import button and browse to the location where the UEFI_SECUREBOOT_SMS_DEF.mof file was saved earlier and leave the default selected (Import both hardware inventory classes and hardware inventory class settings) when prompted:

You should now see the new class listed and it will be enabled.  If you would rather inventory this class on a specific collection of systems (like workstations), then un-select it from in the following screen.

Once systems start processing the new inventory extension, you will see a new Hardware Inventory category in Resource Explorer called Secure Boot State.  If a system is running in UEFI mode, it will have a 1 in the column UEFI Secure Boot enabled for systems that have Secure Boot enabled:

For systems that do not have Secure Boot enabled but are running in UEFI mode, the value will be 0, and for those systems not running in UEFI (i.e. ones running in BIOS mode), the value will be null.

Files:

UEFI_SECUREBOOT_CONFIGURATION.mof

UEFI_SECUREBOOT_SMS_DEF.mof

Originally posted on http://miketerrill.net