New Microsoft procedure for Secure Boot Certificate Updates

🔒 Secure Bits 💡

𝗡𝗲𝘄 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗽𝗿𝗼𝗰𝗲𝗱𝘂𝗿𝗲 𝗳𝗼𝗿 𝗦𝗲𝗰𝘂𝗿𝗲 𝗕𝗼𝗼𝘁 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗲 𝗨𝗽𝗱𝗮𝘁𝗲𝘀

I tested the new Microsoft procedure I shared last time (link in comments).

I’ll be honest — I was a bit 𝗼𝘃𝗲𝗿𝘄𝗵𝗲𝗹𝗺𝗲𝗱 at first. There are multiple scripts, and I ran into a few “paper cuts”, so it’s still not as straightforward as the article makes it look.

This post covers 𝗣𝗵𝗮𝘀𝗲 𝟭: 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 & 𝗦𝘁𝗮𝘁𝘂𝘀 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 (enterprise level) — which, for many orgs, is already the most useful part: enable the process with GPO + get recurring monitoring you can trust.

⸻

✅ 𝗣𝗵𝗮𝘀𝗲 𝟭 — 𝘄𝗵𝗮𝘁 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗶𝘀 𝘁𝗿𝘆𝗶𝗻𝗴 𝘁𝗼 𝗮𝗰𝗵𝗶𝗲𝘃𝗲

Central monitoring of where your servers/clients are in the Secure Boot cert update process.

1️⃣ 𝗖𝗿𝗲𝗮𝘁𝗲 𝘁𝗵𝗲 𝗰𝗼𝗹𝗹𝗲𝗰𝘁𝗶𝗼𝗻 𝘀𝗵𝗮𝗿𝗲 + 𝗽𝗲𝗿𝗺𝗶𝘀𝘀𝗶𝗼𝗻𝘀

Run Microsoft’s script that creates the file share and sets ACLs.

2️⃣ 𝗣𝗿𝗲𝗽𝗮𝗿𝗲 𝘁𝗵𝗲 𝘀𝗰𝗿𝗶𝗽𝘁𝘀 𝗳𝗼𝗹𝗱𝗲𝗿

At minimum you’ll work with:

• Deploy-GPO-SecureBootCollection.ps1

• Detect-SecureBootCertUpdateStatus.ps1

3️⃣ 𝗥𝘂𝗻 𝗗𝗲𝗽𝗹𝗼𝘆-𝗚𝗣𝗢-𝗦𝗲𝗰𝘂𝗿𝗲𝗕𝗼𝗼𝘁𝗖𝗼𝗹𝗹𝗲𝗰𝘁𝗶𝗼𝗻.𝗽𝘀𝟭

I noticed mismatches in names/paths in the article + scripts. For example in the top part of the article the share path is referenced as SecureBootLogs, but the script creates SecureBootData.

👉 My recommendation: follow the bottom part of the article — it looked the most consistent/precise during my testing.

After running the script, you’ll be guided through prompts and it will create a new GPO called: SecureBoot-EventCollection

At first glance, it may look empty in GPMC — it’s not. This is what happens when settings are injected into the GPO via PowerShell.

To verify / “make it visible”:

Computer Configuration → Preferences → Control Panel Settings → Scheduled Tasks → SecureBoot-EventCollection

Open the task, click OK, refresh policy view — and you should see the settings appear.

(the script mentions “Complete the scheduled task configuration in GPMC (see instructions above)” — but there are none.

4️⃣ 𝗧𝗲𝘀𝘁 𝗼𝗻 𝗮 𝗳𝗲𝘄 𝗺𝗮𝗰𝗵𝗶𝗻𝗲𝘀

Run gpupdate /force on a few servers/clients and run the scheduled task manually. You should see a new task: SecureBoot-EventCollection

If it runs correctly, you’ll start seeing JSON files created on the file share.

5️⃣ 𝗔𝗴𝗴𝗿𝗲𝗴𝗮𝘁𝗲 𝘁𝗵𝗲 𝗿𝗲𝘀𝘂𝗹𝘁𝘀

Now test:

• Aggregate-SecureBootCertStatus.ps1

You’ll likely need to:

• adjust paths

• modify the Start-Process part (it didn’t work for me as-is)

After that, you should get the report.

⸻

𝗜’𝗹𝗹 𝗮𝗹𝘀𝗼 𝗰𝗼𝘃𝗲𝗿 𝗣𝗵𝗮𝘀𝗲 𝟮 — I already tested it, but I hit an error and I’m contacting Microsoft. Some of the script/path mismatches may be fixed by the time you read this (I’m communicating this in real-time).

Links to the official procedure + my field notes are in the comments.

#SecureBoot #SecureBits #HorizonSecured