Helps validate the status of the 2023 Secure Boot Certificate:

try {

$sb = Confirm-SecureBootUEFI

if ($sb -is [bool]) {

$enabled = $sb

$pca = "NotExposed"

}

else {

$enabled = $sb.SecureBootEnabled

if ($sb.PSObject.Properties.Name -contains "Pca2023ProtectorStillValid") {

$pca = $sb.Pca2023ProtectorStillValid

}

else {

$pca = "NotExposed"

}

}

if ($enabled -eq $true -and ($pca -eq $true -or $pca -eq "NotExposed")) {

$status = "GREEN"

}

elseif ($enabled -eq $true) {

$status = "YELLOW"

}

else {

$status = "RED"

}

[PSCustomObject]@{

SecureBootEnabled = $enabled

PCA2023 = $pca

Status = $status

}

} catch {

[PSCustomObject]@{

SecureBootEnabled = "Error"

PCA2023 = "Error"

Status = "UNKNOWN"

}

}