You may need to identify VMware ESX Hosts and VMs that use Secure Boot in your environment.  This can be helpful for a number of reasons:

• Environment Audit – are there any assets that should be using Secure Boot –  but are not?
• Inventory list – Having a list of assets that are using Secure Boot can help build a reference list should the need arise to make updates to the Secure Boot configuration

There are two primary means to do this:

• Aria Operations / VCF Operations – With a little work and help from an open-source management pack you can build a dashboard that will identify these assets
• PowerCLI – PowerCLI  can be used to quickly and easily extract this information and format it in any way you like

Aria Operations / VCF Operations

Brock Peterson has written an excellent article on how to use Operations to list VMs and Hosts using Secure boot.  It uses an open-source management pack called vCommunity Management Pack.  I won’t repeat his work; but do want to highlight some considerations:

• VCF Operations 9.x can display information about both Host and VM Secure Boot configurations
• If you are still on Aria Operations 8.x – you will only see VM Secure Boot status.  This version of Operations does not have the Host properties required to detect Secure Boot.
• The properties are disabled by default in both versions of Operations.  You will need to enable them before use.

PowerCLI

PowerShell can use any recent version of the PowerCLI module to list out Secure Boot configurations for both ESX Hosts and VMs.

Below are two minimal PowerShell snippets that illustrate the properties you will need.  You can modify this code to export the data to a CSV or any format that is useful to you.

Get Host Secure Boot Status

Connect-VIServer -Server your.vcenter.fqdn -Force
# Get all hosts
$hosts = Get-VMHost
write-host "Found " $hosts.count " ESX hosts."
write-host ""
write-host "The following ESX host(s) use Secure boot:"

foreach ($vmhost in $hosts) {
    # Connect to esxcli for the host
    $esxcli = Get-EsxCli -VMHost $vmhost -V2
    $secureBoot = $esxcli.system.settings.encryption.get.Invoke() | Select -ExpandProperty RequireSecureBoot

    if ($secureBoot -eq "true") {write-host $vmhost}
}

Get VM Secure Boot Status

Connect-VIServer -Server your.vcenter.fqdn -Force
$vms = Get-VM
write-host "Found " $vms.count " virtual machines."

foreach ($vm in $vms) {
   $vmView = $vm | Get-View
   if ($vmView.Config.BootOptions.EfiSecureBootEnabled) {
      Write-Host "$($vm.Name) has Secure Boot Enabled"
   }
}