Boot Environment Audit

Purpose

The goal of this solution is to audit the boot environment and security posture of Windows Workstations and Servers—collecting data on Secure Boot status, UEFI CA 2023 certificate enrollment, BIOS firmware readiness, pending OEM driver updates, cumulative update compliance, boot configuration anomalies, and telemetry settings—and store the results in a custom table for fleet-wide reporting and compliance tracking.

Associated Content

Scripts

Content	Type	Function
Boot Environment Audit	Script	Runs the audit against each device, collects all boot environment data, and stores the results in the custom table.
OverFlowedVariable - SQL Insert - Execute	Script	Helper script used to handle and insert overflowed data into the custom database table.

Monitor

Content	Type	Function
Execute Script - Boot Environment Audit	Internal Monitor	Executes the audit script once per week against all Windows Workstations and Servers.

Alert Template

Content	Type	Function
△ Custom - Execute Script - Boot Environment Audit	Alert Template	Executes the Boot Environment Audit script against the machines detected by the internal monitor.

Data and Reporting

Content	Type	Function
pvl_boot_environment_details	Custom Table	Stores the boot environment audit data collected from each device.
Boot Environment Audit	Dataview	Displays the boot environment audit results for fleet-wide review and compliance reporting.

Implementation

1. Import the associated scripts, internal monitor, dataview, and alert template from the ProSync plugin.

2. Execute the Boot Environment Audit script on any online Windows device with the SetEnvironment parameter set to 1. This creates the required pvl_boot_environment_details custom table.
   

3. Reload the system cache (Ctrl + R) and verify the custom table was created successfully.

4. Configure the solution as follows:

   • Navigate to Automation → Monitors within the CWA Control Center and set up the following:
     • Execute Script - Boot Environment Audit
       • Configure with the alert template: △ Custom - Execute Script - Boot Environment Audit
       • Right-click and Run Now to start the monitor.

Changelog

2026-05-06

• Initial version of the document.
• Deprecated content:
  • Solution: Windows Secure boot Audit
  • Role: Windows Secure Boot
  • Role: Windows Telemetry
  • Role: Windows DB Certificate
  • Role: Windows KEK Certificate
  • Dataview: Windows Secure Boot Audit [Role]