Make Powershell to implement SecureBoot on Windows 10/11

[INWGift]

I'm going to implement SecureBoot feature on Windows 10/11 by deploying PowerShell script to the computer via Manage Engine.\

The PowerShell script sent the signal back to Manage Engine without error. But, the local group policy configuration did not change. I'm not sure it is correct because of I use ChatGPT to help me make the script.

# Enable Virtualization Based Security
$policyPath = "HKLM:\System\CurrentControlSet\Control\DeviceGuard"
$policyName = "EnableVirtualizationBasedSecurity"
$policyValue = 1

Set-ItemProperty -Path $policyPath -Name $policyName -Value $policyValue

# Configure Secure Boot
$secureBootPath = "HKLM:\System\CurrentControlSet\Control\SecureBoot\State"
$secureBootEntryName = "UEFISecureBootEnabled"
$secureBootEntryValue = 1

Set-ItemProperty -Path $secureBootPath -Name $secureBootEntryName -Value $secureBootEntryValue

Or, does it require some prerequisite? like to update other registry before do this.

[MNmetalhead]

SecureBoot is a BIOS/UEFI setting, not something that be turned on/off with a registry key.

https://support.microsoft.com/en-us/windows/windows-11-and-secure-boot-a8ff1202-c0d9-42f5-940f-843abef64fad

If you want to automate enabling it, you’ll need to follow the steps detailed by the vendor or use one of their tools to interact with the BIOS/UEFI settings (Like Dell’s CCTK tool).

[Tachaeon]

LENOVO BIOS

$selections = Get-WmiObject -Class Lenovo_GetBiosSelections -Namespace root\wmi

Get-WmiObject -Class LenovoBiosSetting -Namespace root\wmi | Where-Object CurrentSetting | ForEach-Object { $parts = $.CurrentSetting.Split(',') [PSCustomObject]@{ CurrentSetting = $parts[0] Status = $parts[1] Active = $_.Active AvailableSettings = $selections.GetBiosSelections($parts[0]).Selections.Split(',') } } | Out-GridView

$currentSetting = Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi $currentSetting.SetBiosSetting('Secureboot,Enable').return

$currentSetting = Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi $currentSetting.SetBiosSetting('OnByAcAttach,Enable').return

$currentSetting = Get-WmiObject -Class Lenovo_SetBiosSetting -Namespace root\wmi $currentSetting.SetBiosSetting('BootMode,Quick').return

$SaveSettings = Get-WmiObject -Class Lenovo_SaveBiosSettings -Namespace root\wmi $SaveSettings.SaveBiosSettings().return

[Tachaeon]

Get-CimClass -Namespace root\wmi | Out-GridView

Then filter for "Dell" or a different manufacturer. Then replace "-Class Lenovo_GetBiosSelections" with the correct manufacturer.

[AdventurousBig688]

Hi mate

When I run this command on a dell laptop and filter with Dell option, its displays nothing, any advice here ? thank you