{"id":264,"date":"2023-03-14T20:11:15","date_gmt":"2023-03-14T20:11:15","guid":{"rendered":"https:\/\/www.digitalsaviour.co.uk\/blog\/?p=264"},"modified":"2023-03-14T20:24:08","modified_gmt":"2023-03-14T20:24:08","slug":"the-mystery-of-secure-boot-intune-compliance","status":"publish","type":"post","link":"https:\/\/www.digitalsaviour.co.uk\/blog\/2023\/03\/14\/the-mystery-of-secure-boot-intune-compliance\/","title":{"rendered":"The mystery of Secure Boot Intune compliance"},"content":{"rendered":"\n

Intune compliance is a fantastic tool \u2013 if done right \u2013 but it has it\u2019s gotchas. Today I\u2019m going to talk about a particular bugbear of mine which is Secure Boot compliance.<\/p>\n\n\n\n

When setting up a compliance policy you can set the standard policy up to check for Secure Boot being enabled however if you have older devices in your estate then you may be heading for a fall. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In simple terms some chipsets will report Secure Boot<\/strong> as being non-compliant even if it\u2019s enabled! This is primarily devices that have TPM 1.2 only. It seems that the check is done in a way that \u201csome\u201d TPM 1.2 devices just don\u2019t know how to handle.<\/p>\n\n\n\n

With this in mind I set out to find why this is the case and come up with a solution.<\/p>\n\n\n\n

No-one knows what the MS compliance settings are actually looking for or HOW <\/em>they are doing it and herein lies the problem. If you find one of these archaic devices and blow the years of dust off the keyboard then fire up PowerShell there is a command that will tell you what\u2019s actually happening.<\/p>\n\n\n\n

Confirm-SecureBootUEFI<\/p><\/blockquote><\/figure>\n\n\n\n

The return from this is True <\/strong>or False<\/strong> for the most part \u2013 if it\u2019s True it means it\u2019s enabled, false means that it\u2019s not \u2013 there\u2019s a third result which is Cmdlet not supported on this platform<\/strong>. Now that\u2019s a bit easier right? The below only cares about True or False although you could easily adapt it for the third option if you wanted.<\/p>\n\n\n\n

OK so now we know that this returns a REAL result that works on all devices we just need a Custom Compliance policy<\/a><\/strong> right? Yeah\u2026 let\u2019s do this.<\/p>\n\n\n\n

So first we need the detection script. Simple enough right? The return value from the above is a boolean but I prefer to work with strings to create my JSON. So here we go\u2026<\/p>\n\n\n\n

$status = Confirm-SecureBootUEFI
$hash = @{ SecureBoot = \"$status\" }
return $hash | ConvertTo-Json -Compress<\/code><\/pre>\n\n\n\n
Super simple. Get the result, create the hash and convert to compressed JSON.<\/p>\n\n\n\n
Now what do we do with that? In Endpoint Manager go to Devices \/ Compliance Policies then navigate to Scripts. You need to add the above as a script (Give it a good name that makes sense). Once you have done that you can create your custom compliance policy. But to get it to work you have to also supply a JSON. This is as simple as it gets.<\/p>\n\n\n\n
{\n\"Rules\":[ \n    { \n       \"SettingName\":\"SecureBoot\",\n       \"Operator\":\"IsEquals\",\n       \"DataType\":\"String\",\n       \"Operand\":\"True\",\n       \"MoreInfoUrl\":\"https:\/\/www.bing.com\/ck\/a?!&&p=a296d37f56e80087JmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0yYThiYTc1My01NjgwLTZkOWQtMGI2YS1iNTljNTczYjZjYjImaW5zaWQ9NTIxOQ&ptn=3&hsh=3&fclid=2a8ba753-5680-6d9d-0b6a-b59c573b6cb2&psq=secureboot+microsoft&u=a1aHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL21lbS9pbnR1bmUvdXNlci1oZWxwL3lvdS1uZWVkLXRvLWVuYWJsZS1zZWN1cmUtYm9vdC13aW5kb3dz&ntb=1\",\n       \"RemediationStrings\":[ \n          { \n             \"Language\":\"en_US\",\n             \"Title\":\"SecureBoot not enabled.\",\n             \"Description\": \"BIOS needs to have SecureBoot enabled\"\n          }\n       ]\n    }\n ]\n}<\/code><\/pre>\n\n\n\n
The URL can be anything. I chose to link directly to a BING search that was related to it \u2013 just because.<\/p>\n\n\n\n
Now deploy this to your devices and you will see more accurate results. If Secure Boot is enabled then it will show as compliant. If it\u2019s not compliant then there\u2019s a reason \u2013 most likely thing is that it\u2019s not enabled. Once you get the list of non-compliant devices you can find out if they will ever show as compliant eg. it\u2019s so damned old that Secure Boot is not a thing and exclude them from the policy so that they don\u2019t get checked \u2013 oh and then of course go and see the purse holder and tell them to pay up and upgrade these devices.<\/p>\n\n\n\n
And finally, disable that built-in Secure Boot check. It\u2019s not fit for purpose. It lies and no-one likes it when tech lies.<\/p>\n\n\n\n
Why will Microsoft not fix this?<\/strong> They don\u2019t want you using old hardware. They especially don\u2019t want you using TPM 1.2 because it\u2019s not compatible with Windows 11 (natively) and they want you to buy into Windows 11 don\u2019t they? Eventually Win 10 will be deprecated and then those old devices will be doorstops.<\/p>\n<\/body>","protected":false},"excerpt":{"rendered":"
Intune compliance is a fantastic tool \u2013 if done right \u2013 but it has it\u2019s gotchas. Today I\u2019m going to talk about a particular bugbear of mine which is Secure Boot compliance. When setting up a compliance policy you can set the standard policy up to check for Secure Boot being enabled however if you […]<\/p>\n","protected":false},"author":1,"featured_media":27,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[24,23],"tags":[],"class_list":["post-264","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-intune","category-powershell"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t