A few weeks ago, during our Secure Boot 2026 community course, we received several questions about community solutions for using ConfigMgr to inventory and track progress of UEFI 2023 certificate installations. At the time, I wasn’t aware of any, but this week during Office Hours, my good friend Andrew Johnson found a great solution from Eric Schloss.
Even better, Eric turned out to be one of the course attendees and decided to build and share his solution with the community. Thank you, Eric!
Secure Boot Inventory Data in Configuration Manager – By Eric Schloss
https://adminnexus.blogspot.com/2026/04/secure-boot-inventory-data-in.html
Note #1: This solution depends on WinCsFlags.exe, so make sure your test machines are reasonably up to date (they should be anyway for security reasons). For Windows 11, the utility was introduced in the October 2025 cumulative update. For other operating systems, it was added slightly later. As of the April 2026 cumulative update, the utility is available on all currently supported operating systems, including those covered by ESU.
Note #2: The sample scripts are not signed, so you either need to sign them yourself or relax the default PowerShell execution policy in the ConfigMgr client settings.
Video Guide
Based on Eric’s blog, I recorded a quick video showing how to set it up: https://www.youtube.com/watch?v=Q9aPUM9yQ0U
In the video, I walk through the following steps:
- Reviewing Eric’s blog post and downloading the scripts
- Modifying the WMI class name used for Secure Boot inventory
- Validating the scripts on a client in your environment and reviewing the created WMI class
- Creating a Configuration Item and Baseline with the scripts, and deploying it to a test collection
- Verifying the Configuration Baseline on a client
- Trigger the Configuration baseline to run immediately on all test clients
- Configuring and deploying ConfigMgr client settings to extend hardware inventory with the new WMI class
- Reviewing dataldr.log on the site server
- Triggering Machine Policy Retrieval and Hardware Inventory cycles on the client
- Reviewing InventoryAgent.log on a client
- Reviewing MP_Hinv.log and dataldr.log on the site server
- Reviewing the Secure Boot inventory data using SQL Server Management Studio