Expanded Encrypted Volume Report (UEFI Boot / SecureBoot Status)

[PeterJG]

I've created report that shows Boot Mode (UEFI / BIOS) if SecureBoot is Enabled/Disabled and if System Drive is Bitlocker Encrypted or Not.


In order for this report to work it requires a custom registry scan configured as follows:

Rootkey: HKEY_LOCAL_MACHINE
RegPath: SYSTEM\CurrentControlSet\Control\SecureBoot\State
RegValue: UEFISecureBootEnabled

Select Top 1000000 tsysAssetTypes.AssetTypeIcon16 As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblEncryptableVolume.DriveLetter,
  Case
    When tblEncryptableVolume.ProtectionStatus = 0 Then 'OFF'
    When tblEncryptableVolume.ProtectionStatus = 1 Then 'ON'
    Else 'UNKNOWN'
  End As BitLocker,
  Case
    When tblRegistry.Value = 0 Then 'DISABLED'
    When tblRegistry.Value = 1 Then 'ENABLED'
    Else 'UNKNOWN'
  End As SecureBoot,
  Case
    When tblRegistry.Value Is Null Then 'BIOS'
    Else 'UEFI'
  End As [Boot Mode],
  tblEncryptableVolume.LastChanged,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.IPAddress,
  tblAssets.Description,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tblAssetCustom.Location,
  tsysIPLocations.IPLocation,
  tsysOS.OSname As OS,
  tblAssets.SP As SP,
  tblAssets.Firstseen,
  tblAssets.Lastseen
From tblEncryptableVolume
  Inner Join tblAssets On tblEncryptableVolume.AssetId = tblAssets.AssetID
  Inner Join tsysAssetTypes On tblAssets.Assettype = tsysAssetTypes.AssetType
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
  Left Join tsysIPLocations On tblAssets.LocationID = tsysIPLocations.LocationID
  Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
Where
  tblRegistry.Regkey Like
  'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State' And
  tblRegistry.Valuename = 'UEFISecureBootEnabled'
Order By tblAssets.AssetName

[PeterJG]

Added Partition Type of System Drive

Select Top 1000000 tsysAssetTypes.AssetTypeIcon16 As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tblEncryptableVolume.DriveLetter,
  Case
    When tblDiskPartition.Type = 'Installable File System' Then 'MBR'
    When tblDiskPartition.Type = 'GPT: System' Then 'GPT'
    Else 'UNKNOWN'
  End As [System Partition],
  Case
    When tblEncryptableVolume.ProtectionStatus = 0 Then 'OFF'
    When tblEncryptableVolume.ProtectionStatus = 1 Then 'ON'
    Else 'UNKNOWN'
  End As BitLocker,
  Case
    When tblRegistry.Value = 0 Then 'DISABLED'
    When tblRegistry.Value = 1 Then 'ENABLED'
    Else 'UNKNOWN'
  End As SecureBoot,
  Case
    When tblRegistry.Value Is Null Then 'BIOS'
    Else 'UEFI'
  End As [Boot Mode],
  tblEncryptableVolume.LastChanged,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Description,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysIPLocations.IPLocation,
  tsysOS.OSname As OS,
  tblAssets.SP As SP,
  tblAssets.Firstseen,
  tblAssets.Lastseen
From tblEncryptableVolume
  Inner Join tblAssets On tblEncryptableVolume.AssetId = tblAssets.AssetID
  Inner Join tsysAssetTypes On tblAssets.Assettype = tsysAssetTypes.AssetType
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
  Left Join tsysIPLocations On tblAssets.LocationID = tsysIPLocations.LocationID
  Inner Join tblRegistry On tblAssets.AssetID = tblRegistry.AssetID
  Inner Join tblDiskPartition On tblAssets.AssetID = tblDiskPartition.AssetID
Where (tblDiskPartition.Type = 'GPT: System' Or tblDiskPartition.Type =
    'Installable File System') And
  tblRegistry.Regkey Like
  'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\State' And
  tblRegistry.Valuename = 'UEFISecureBootEnabled'
Order By tblAssets.AssetName