Le blog technique

$IsCompliant = $true
$FailureReason = @()

# STEP 1: Secure Boot
try {
    if (-not (Confirm-SecureBootUEFI)) {
        $IsCompliant = $false
        $FailureReason += "SecureBootDisabled"
    }
}
catch {
    $IsCompliant = $false
    $FailureReason += "LegacyBIOS"
}

# STEP 2: Secure Boot CA 2023
$SBCA2023 = "NOTPresent"
try {
    $db = Get-SecureBootUEFI -Name db -ErrorAction Stop
    $dbText = [System.Text.Encoding]::ASCII.GetString($db.Bytes)
    if ($dbText -match "Windows UEFI CA 2023") {
        $SBCA2023 = "Present"
    }
}
catch {}

if ($SBCA2023 -ne "Present") {
    $IsCompliant = $false
    $FailureReason += "SBCA2023Missing"
}

# STEP 3: Registry
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing"
$UEFIStatus = "UNKNOWN"
$UEFICapableMeaning = "Unknown"
$UEFIError = "NotPresent"
$UEFIErrorEvent = "NotPresent"

if (Test-Path $regPath) {
    $props = Get-ItemProperty $regPath -ErrorAction SilentlyContinue
    $UEFIStatus = $props.UEFICA2023Status
    $UEFIError = $props.UEFICA2023Error
    $UEFIErrorEvent = $props.UEFICA2023ErrorEvent

    switch ([int]$props.WindowsUEFICA2023Capable) {
        0 { $UEFICapableMeaning = "CA2023NOTInDB" }
        1 { $UEFICapableMeaning = "CA2023InDB" }
        2 { $UEFICapableMeaning = "BootedWith2023" }
    }
}

if ($UEFIStatus -ne "Updated") {
    $IsCompliant = $false
    $FailureReason += "UEFICA2023NotUpdated"
}

# STEP 4: TPM Event 1808
$Event1808 = "NotPresent"
$event = Get-WinEvent -FilterHashtable @{LogName='System'; ID=1808} -MaxEvents 1 -ErrorAction SilentlyContinue
if ($event) {
    $Event1808 = "Present"
} else {
    $IsCompliant = $false
    $FailureReason += "TPM1808Missing"
}

# STEP 5: BIOS
$BIOSVersion = (Get-CimInstance Win32_BIOS).SMBIOSBIOSVersion
$BIOSMan = (Get-CimInstance Win32_BIOS).Manufacturer

# FINAL OUTPUT (IMPORTANT)
$result = [PSCustomObject]@{
    Compliance                   = $IsCompliant
    SBCA2023                     = $SBCA2023
    UEFICA2023Status             = $UEFIStatus
    TPMEvent1808                 = $Event1808
    WindowsUEFICA2023Capable     = $UEFICapableMeaning
    UEFICA2023Error              = $UEFIError
    UEFICA2023ErrorEvent         = $UEFIErrorEvent
    BIOSVersion                  = $BIOSVersion
    BIOSMan                      = $BIOSMan
    FailureReason                = ($FailureReason -join ",")
}

$result | ConvertTo-Json -Compress

if ($IsCompliant) { exit 0 } else { exit 1 }