Secure Boot Status

[Query_Admin]

Description: Checks status of Secure Boot.

What The Data Shows:Secure Boot is important b/c it helps prevent malicious applications from loading at startup.

SQL: 

WITH sb1 AS
  (
  SELECT COUNT(*) AS cnt,

         1 AS one

  FROM registry

  WHERE PATH='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\UEFISecureBootEnabled'
  ),

     sb2 AS
  (
  SELECT COUNT(*) AS cnt,

         1 AS one

  FROM registry

  WHERE PATH='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\UEFISecureBootEnabled'

    AND DATA = 1 
)

SELECT 
  CASE

    WHEN sb1.cnt = 0 THEN "NON-UEFI"

    WHEN sb2.cnt = 1 THEN "ENABLED"

    WHEN sb2.cnt = 0 THEN "DISABLED"

  END SECUREBOOT_STATUS

FROM sb1

JOIN sb2 USING(one);

[NadavK]

Hi All,

Is this query still valid? 

Tried it on both a computer with Secure Boot Enabled and Secure Boot Disabled and I'm getting no results. 

Please assist :) 

[jnelson]

@NadavK thanks for pointing this out. It had been updated in the product, but not here. I have since updated this post with the new query.

[NadavK]

Hi @jnelson ,

Thank you for updating this query!

Can you please explain what is the "NON-UEFI" Case means? 

I've encountered a computer that is running with UEFI + Secure Boot enabled and returns this result.

Also encountered this result on a computer that has no Secure Boot enabled.

Thanks!

[NadavK]

The query within CB Response does not work properly.

Changed the above query to this query and it worked with no issues:

WITH sb1 AS (
  SELECT COUNT(*) AS cnt,
         1 AS one
  FROM registry
  WHERE PATH='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\UEFISecureBootEnabled'
  ),
sb2 AS (
  SELECT COUNT(*) AS cnt,
         1 AS one
  FROM registry
  WHERE PATH='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\UEFISecureBootEnabled'
    AND DATA = 1
)
SELECT CASE
    WHEN sb1.cnt = 0 THEN 'NON-UEFI'
    WHEN sb2.cnt = 1 THEN 'ENABLED'
    WHEN sb2.cnt = 0 THEN 'DISABLED'
  END SECUREBOOT_STATUS
FROM sb1
JOIN sb2 USING(one);

[jnelson]

@NadavK on systems with UEFI the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\UEFISecureBootEnabled should be present. In the NON-UEFI case this key is not present.

Can you please provide the content of the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State\ and tell me what the Windows version is?