Skip to main content

Boot Environment Audit

Purpose​

The goal of this solution is to audit the boot environment and security posture of Windows Workstations and Servers.

It collects data on:

  • Secure Boot status
  • UEFI CA 2023 certificate enrollment
  • BIOS firmware readiness
  • Pending OEM driver updates
  • Cumulative update compliance
  • Boot configuration anomalies
  • Telemetry settings

The audit results are stored in a custom table for fleet-wide reporting and compliance tracking.

This solution also supports optional automated remediation for Secure Boot CA2023 compliance. The Boot Environment Audit dataview exposes computed remediation columns, and the Secure Boot CA2023 Autofix Targets internal monitor can automatically target problematic devices for remediation using the Remediate SecureBootCompliance2026 script. When ticketing is enabled, the remediation script reports each run as a ConnectWise ticket, so your team always knows which devices need action.

Associated Content​

Alert Templates are documented as part of this solution. Standalone Alert Template documents are not created.

Auditing​

ContentTypeFunction
Boot Environment AuditScriptRuns the audit against each device, collects boot environment and Secure Boot compliance data, and stages the results for database import.
OverFlowedVariable - SQL Insert - ExecuteScriptHelper script used to handle and insert overflowed audit data into the custom database table.
Execute Script - Boot Environment AuditInternal MonitorExecutes the audit script on a scheduled basis against Windows Workstations and Servers.
△ Custom - Execute Script - Boot Environment AuditAlert TemplateExecutes the Boot Environment Audit script against machines detected by the audit internal monitor.
pvl_boot_environment_detailsCustom TableStores the boot environment audit data collected from each device.
Boot Environment AuditDataviewDisplays audit results for fleet-wide review and compliance reporting. Includes computed Problematic, RemediationAction, and RemediationReason columns for Secure Boot CA2023 remediation targeting.

Automation​

Import the Automation content only when automated remediation is required or has been explicitly requested.

ContentTypeFunction
Remediate SecureBootCompliance2026ScriptUses the agnostic script Remediate-SecureBootCompliance2026 to remediate UEFI Secure Boot compliance for Windows 2026. It validates Secure Boot, checks KEK and DB certificate enrollment, configures Microsoft-managed certificate updates, monitors servicing status, writes the Boot_Environment_Remediation script state to prevent repeated execution, and reports the result as a ConnectWise ticket when ticketing is enabled.
Secure Boot CA2023 Autofix TargetsInternal MonitorIdentifies Windows devices that require Secure Boot CA2023 remediation and are eligible for automated remediation. It excludes devices that are already compliant, have Secure Boot disabled, are in a reboot-required servicing state, have recently received remediation, or already have the Boot_Environment_Remediation script state set to Applied.
△ Custom - Autofix - Secure Boot CA2023 Autofix TargetsAlert TemplateExecutes the Remediate SecureBootCompliance2026 script against machines detected by the Secure Boot CA2023 autofix internal monitor.

Implementation​

Auditing​

  1. Import the associated auditing scripts, internal monitor, dataview, and alert template from the ProSync plugin.
  2. Execute the Boot Environment Audit script on any online Windows device with the SetEnvironment parameter set to 1. This creates the required pvl_boot_environment_details custom table.
  3. Reload the system cache, Ctrl + R, and verify the custom table was created successfully.
  4. Navigate to Automation → Monitors within the CWA Control Center and configure the following monitor:
  5. Configure the monitor with the alert template:
    • △ Custom - Execute Script - Boot Environment Audit
  6. Right-click the monitor and select Run Now to start the audit cycle.

Automation​

Import and enable the Automation content only when automated remediation is required or has been explicitly requested.

  1. Import the automation script, internal monitor, and alert template from the ProSync plugin.

  2. Navigate to Automation → Monitors within the CWA Control Center and configure the following monitor:

  3. Configure the monitor with the alert template:

    • △ Custom - Autofix - Secure Boot CA2023 Autofix Targets

  4. Right-click the monitor and select Run Now to begin targeting problematic devices.

  5. The monitor uses audit data stored in pvl_boot_environment_details and the remediation logic exposed by the Boot Environment Audit dataview to identify devices requiring Secure Boot CA2023 remediation.

  6. The Remediate SecureBootCompliance2026 script writes the following script state after remediation has been processed:

    VariableValue
    Boot_Environment_RemediationApplied

  7. This script state prevents the autofix monitor from repeatedly running remediation against the same device.

  8. If remediation needs to be run again on a device, remove or reset the Boot_Environment_Remediation script state for that computer.

  9. Optionally, control ticket alerts with the script's global parameters: FailureTicket (default True) creates tickets for blocked devices, and RebootRequiredTicket (default False) creates tickets for devices waiting on a restart or certificate delivery. See the script document for the full ticket reference.

Changelog​

2026-08-11​

  • Updated Remediate SecureBootCompliance2026 to support ConnectWise ticketing when enabled, so remediation runs can create, update, or close tickets based on the device compliance state.

2026-08-04​

  • Added Secure Boot CA2023 autofix automation components.
  • Added internal monitor: Secure Boot CA2023 Autofix Targets.
  • Added alert template: △ Custom - Autofix - Secure Boot CA2023 Autofix Targets.
  • Updated Remediate SecureBootCompliance2026 to write the Boot_Environment_Remediation script state.
  • Updated Boot Environment Audit dataview with Problematic, RemediationAction, and RemediationReason columns.
  • Reorganized Associated Content into Auditing and Automation tables.
  • Added note that Automation content should be imported only when required or explicitly requested.

2026-06-19​

  • Added the remediation for the secure boot compliance in it, as it can change the audit data and is completely related to this solution.

2026-05-06​

  • Initial version of the document.

Deprecated content:

  • Solution: Windows Secure boot Audit
  • Role: Windows Secure Boot
  • Role: Windows Telemetry
  • Role: Windows DB Certificate
  • Role: Windows KEK Certificate
  • Dataview: Windows Secure Boot Audit [Role]