PowerShell/Secure Boot Assesment.ps1 at main · blazcode/PowerShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Define your vCenter Server
$vCenterServer = "vc01.lab.blaz.tech"

# ----------------------------------------------------

Write-Host "Connecting to vCenter: $vCenterServer..." -ForegroundColor Cyan
Connect-VIServer -Server $vCenterServer -WarningAction SilentlyContinue

Write-Host "`nGathering ESXi Host Secure Boot Settings..." -ForegroundColor Yellow
$hostResults = @()
$vmHosts = Get-VMHost

foreach ($vmhost in $vmHosts) {
    try {
        $esxcli = Get-EsxCli -VMHost $vmhost -V2
        $encSettings = $esxcli.system.settings.encryption.get.Invoke()
        $tpmMode = $encSettings.Mode

        # Only works on 8.0 U3+
        $secureBoot = ((Get-VMHost).ExtensionData.Capability).UefiSecureBoot
    } catch {
        $secureBoot = "Unsupported/Error"
        $tpmMode = "Unsupported/Error"
    }

    $hostResults += [PSCustomObject]@{
        HostName          = $vmhost.Name
        Version           = $vmhost.Version
        RequireSecureBoot = $secureBoot
        TPMMode           = $tpmMode
    }
}

Write-Host "`nGathering Virtual Machine Secure Boot Settings..." -ForegroundColor Yellow
$vmResults = @()
$vms = Get-VM

foreach ($vm in $vms) {
    # Extract Secure Boot and Firmware settings from the VM's ExtensionData
    $secureBootEnabled = $vm.ExtensionData.Config.BootOptions.EfiSecureBootEnabled

    # Handle null values if the setting has never been touched
    if ($null -eq $secureBootEnabled) {
        $secureBootEnabled = $false
    }

    $vmResults += [PSCustomObject]@{
        VMName            = $vm.Name
        PowerState        = $vm.PowerState
        SecureBootEnabled = $secureBootEnabled
        Firmware          = $vm.ExtensionData.Config.Firmware
    }
}

# --- Output the Results ---

Write-Host "`n==========================================" -ForegroundColor Cyan
Write-Host " ESXi Host Secure Boot Settings" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan
$hostResults | Format-Table -AutoSize

Write-Host "`n==========================================" -ForegroundColor Cyan
Write-Host " Virtual Machine Secure Boot Settings" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan
$vmResults | Format-Table -AutoSize

# Optional: Export to CSV
# $hostResults | Export-Csv -Path "C:\temp\Host_SecureBoot_Report.csv" -NoTypeInformation
# $vmResults | Export-Csv -Path "C:\temp\VM_SecureBoot_Report.csv" -NoTypeInformation

# Disconnect from vCenter
Disconnect-VIServer -Server $vCenterServer -Confirm:$false -WarningAction SilentlyContinue
Write-Host "Disconnected from vCenter." -ForegroundColor Cyan