How to Monitor Changes to the BootConfig File in Windows [PowerShell Script]

In the intricate world of IT, maintaining system integrity is of utmost importance. A pivotal component in the Windows operating system is the BootConfig file. Monitoring changes to this file is crucial for system administrators and IT professionals to ensure the system’s security and stability. This guide delves into a PowerShell script that checks for modifications in the BootConfig file, offering a proactive approach to system management.

Background

The BootConfig file in Windows is a foundational element that contains boot configuration data. It dictates how the system starts up, which OS versions to load, and other boot parameters. Given its role in the booting process, any unauthorized or unexpected changes can lead to system malfunctions or vulnerabilities. This makes it a prime target for malicious actors or malware. For IT professionals and Managed Service Providers (MSPs), having a tool that can detect these changes is invaluable. It aids in proactive system management and forensic analysis in case of security breaches.

The Script

#Requires -Version 5.1

<#
.SYNOPSIS
    Checks if the BootConfig file was modified from last run.
.DESCRIPTION
    Checks if the BootConfig file was modified from last run.
    On first run this will not produce an error, but will create a cache file for later comparison.
.EXAMPLE
    No parameters needed.
.OUTPUTS
    None
.NOTES
    Minimum OS Architecture Supported: Windows 10, Windows Server 2016
    Release Notes:
    Initial Release
By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#>

[CmdletBinding()]
param (
    # Path and file where the cache file will be saved for comparison
    [string]
    $CachePath = "C:ProgramDataNinjaRMMAgentscriptingTest-BootConfig.clixml"
)

begin {
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    }
}
process {
    if (-not (Test-IsElevated)) {
        Write-Error -Message "Access Denied. Please run with Administrator privileges."
        exit 1
    }

    # Get content and create hash of BootConfig file
    $BootConfigContent = bcdedit.exe /enum
    $Stream = [IO.MemoryStream]::new([byte[]][char[]]"$BootConfigContent")
    $BootConfigHash = Get-FileHash -InputStream $Stream -Algorithm SHA256

    $Current = [PSCustomObject]@{
        Content = $BootConfigContent
        Hash    = $BootConfigHash
    }

    # Check if this is first run or not
    if ($(Test-Path -Path $CachePath)) {
        # Compare last content and hash
        $Cache = Import-Clixml -Path $CachePath
        $ContentDifference = Compare-Object -ReferenceObject $Cache.Content -DifferenceObject $Current.Content -CaseSensitive
        $HashDifference = $Cache.Hash -like $Current.Hash
        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false
        if (-not $HashDifference) {
            Write-Host "BootConfig file has changed since last run!"
            Write-Host ""
            $ContentDifference | ForEach-Object {
                if ($_.SideIndicator -like '=>') {
                    Write-Host "Added: $($_.InputObject)"
                }
                elseif ($_.SideIndicator -like '<=') {
                    Write-Host "Removed: $($_.InputObject)"
                }
            }
            exit 1
        }
    }
    else {
        Write-Host "First run, saving comparison cache file."
        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false
    }
    exit 0
}
end {}

 

Detailed Breakdown

The provided script is a PowerShell script meticulously crafted to monitor modifications in the BootConfig file since its last run. Here’s a more detailed step-by-step breakdown:

1. Prerequisites: The script requires PowerShell version 5.1.
2. Elevation Check: Before diving into its main function, the script checks if it’s run with administrator privileges, essential for accessing certain system files and commands.
3. BootConfig Hashing: Using the bcdedit.exe /enum command, the script fetches the BootConfig content. It then creates a SHA256 hash of this content, which serves as a unique identifier for that specific content.
4. Cache Comparison: The script then looks for a previously saved cache file. If it exists, the script compares the current BootConfig content and hash with the cached version.
5. Output: If differences are detected, the script provides a detailed output of the changes, specifying what was added or removed. If it’s the script’s first run, it saves the current BootConfig data for future comparisons.

Potential Use Cases

• Routine System Checks: IT professionals like Alex can deploy this script across enterprise servers for routine checks, ensuring no unauthorized changes have occurred.
• Post-Software Installation: After installing new software or updates, the script can be run to verify that the BootConfig file remains unchanged, ensuring the software hasn’t tampered with critical boot data.
• System Configuration Changes: Before and after making significant system configuration changes, the script can be used to ensure the BootConfig file’s integrity remains intact.

Comparisons

While there are third-party tools and software that offer system monitoring capabilities, this script’s advantage lies in its simplicity and specificity. It’s lightweight, easy to deploy, and focuses solely on the BootConfig file, ensuring a targeted and efficient check.

FAQs

• Q: Can this script run on older versions of Windows?
  A: The script supports Windows 10 and Windows Server 2016 and newer.
• Q: What happens if the BootConfig file is unchanged?
  A: The script simply exits without any alerts, indicating no changes since the last run.

Security Implications

Detecting changes in the BootConfig file is not just about system stability but also security. Unauthorized changes could indicate a potential breach or malware activity. By monitoring this file, IT professionals can take a proactive stance against potential threats.

Recommendations

• Always run the script with administrator privileges to ensure accurate results.
• Schedule the script to run at regular intervals for continuous monitoring.
• Maintain backups of the BootConfig file to quickly restore in case of unauthorized changes.

Final Thoughts

In the realm of IT security and system management, tools like NinjaOne offer comprehensive solutions for various challenges. Monitoring critical system files, such as the BootConfig file in Windows, is a testament to the importance of proactive system management. With scripts like the one discussed, IT professionals can ensure system integrity, bolster security, and maintain operational efficiency.

Here are some additional resources that you may find helpful:

• The BootConfig File in Windows: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit
• PowerShell Scripting Tutorial: https://docs.microsoft.com/en-us/powershell/scripting/