---
title: "Secure Boot Certificate Installation Instructions"
slug: "secure-boot-certificate-installation-instructions"
updated: 2026-10-06T14:03:23Z
published: 2026-10-06T14:03:23Z
canonical: "documentation.lakesidesoftware.com/secure-boot-certificate-installation-instructions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.lakesidesoftware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure Boot Certificate Installation Instructions

## Prerequisites

- Minimum Version: Requires SysTrack 11.4 or later.

## Notes

- After this DEX Pack is installed, it may take up to 24 hours for data to appear.
- If you update or reinstall this DEX Pack, you must reassign any Views created below to the SF_SecureBootCert Role and reapprove the SecureBootCert Action.

## Installation Steps

To install this DEX Pack, complete the following steps:

1. [Import the Kit](/documentation/docs/secure-boot-certificate-installation-instructions#import-kit).
2. [Enable the SecureBootCert Action](/documentation/docs/secure-boot-certificate-installation-instructions#enable-action).
3. [Create the SecureBootCert View](/documentation/docs/secure-boot-certificate-installation-instructions#securebootcert-view).
4. [Assign the SecureBootCert View to the SecureBootCert Role](/documentation/docs/secure-boot-certificate-installation-instructions#to-assign-the-new-view).
5. [Assign the SecureBootCert Role to Relevant Configurations](/documentation/docs/secure-boot-certificate-installation-instructions#sfsecurebootcert-role).
6. [Create the SecureBoot Needs Remediation Group](/documentation/docs/secure-boot-certificate-installation-instructions#create-a-remediation-group-optional).

### Import the Kit

There are two ways to import the DEX Pack to SysTrack:

- Import the pack directly from the Kits page in SysTrack. See the [Import Online Kits](/documentation/docs/import-online-kits) guide for more information.
- Import a local file downloaded from the [DEX and Kit Downloads](/documentation/docs/dex-packs-dex-and-kit-downloads) page. Click the **Download Kit** link for the pack and follow the [Import Local Kits](/documentation/docs/import-local-kits) guide to finish the import.

### Enable the SecureBootCert Action

1. Verify you have unlocked the tenant next to your username.
2. In **Configure**, click **Automations and Collection Extensions** on the left.
3. Select **Action Governance**, then click the **Pending Approval** tab.
4. Find the **SecureBootCert** Action and select the checkbox next to it.
5. Click **Approve**, then confirm. The Action moves to the **Actions** tab and is enabled automatically.

> [!NOTE]
> **NOTE**: In SysTrack Cloud, the user who imported the Kit may not be allowed to approve its actions. If the checkbox is unavailable, ask another user with Action Governance – Management permission to approve the action.

### Create the SecureBootCert View

The Secure Boot Certificate Dashboard requires you to make a View for the SF_SecureBootCert Role.

1. Go to **Configure** > **Views,**
2. Click the **padlock icon** in the upper-right to edit.
3. Click the **plus icon** to add a new View.
4. Enter the following **Settings**:
  1. **View Name: SecureBootCert**
  2. **Expires in: Never**
  3. **Existing Category: Custom**
  4. **When Expired: Overwrite Data**
  5. Do not check **when overdue by 1 day(s)**.
  6. Set the **Refresh** drop-downs to **Daily**, **Inside** **24x7**, and **Every Day**.
5. Copy the [SecureBootCert SQL Query](/documentation/docs/secure-boot-certificate-installation-instructions#securebootcert-sql-query2), and paste it under **SQL Selection > Generic**
6. Click **Test SQL**. A **Success** message should appear at the top of the screen. If the test fails, the query may have been copied incorrectly.
7. Click **Create View** at the top-right.

#### SecureBootCert SQL Query

```sql
SELECT
    T0.WGUID,
    T0.NextStep AS [NextStep],
    T0.Step1_BitLockerKeysBackedUp AS [Step1_BitLockerKeysBackedUp],
    T0.Step2_SecureBootUpdateTriggered AS [Step2_SecureBootUpdateTriggered],
    T0.Step3_SecureBootTaskRan AS [Step3_SecureBootTaskRan],
    T0.Step4_NewCertsStaged AS [Step4_NewCertsStaged],
    T0.Step5_Reboot1_ToApplyCerts AS [Step5_Reboot1_ToApplyCerts],
    T0.Step6_Reboot2_ToUpdateBootMgr AS [Step6_Reboot2_ToUpdateBootMgr],
    T0.Step7_SecureBootComplete AS [Step7_SecureBootComplete],
    T0.Step1_ViaSysTrack AS [Step1_ViaSysTrack],
    T0.Step2_ViaSysTrack AS [Step2_ViaSysTrack],
    T0.Step3_ViaSysTrack AS [Step3_ViaSysTrack],
    T0.SoonestMsCertExpiryDate AS [SoonestMsCertExpiryDate],
    T1.STRVALUE AS [SoonestMsCertExpiryName],
    T0.SoonestOemCertExpiryDate AS [SoonestOemCertExpiryDate],
    T2.STRVALUE AS [SoonestOemCertExpiryName],
    T3.STRVALUE AS [UpdateError]
FROM DYNI_SecureBootCertCheck AS T0
LEFT JOIN SASTR_DYN T1 ON T1.STRINGID = T0.SoonestMsCertExpiryName
LEFT JOIN SASTR_DYN T2 ON T2.STRINGID = T0.SoonestOemCertExpiryName
LEFT JOIN SASTR_DYN T3 ON T3.STRINGID = T0.UpdateError
```

### Assign the SecureBootCert View to the SecureBootCert Role

1. Navigate to **Configure** > **Roles.**
2. Use the drop-down at the top to select the **SF_SecureBootCert** Role.
3. Click **Views**, then check the box next to **SecureBootCert**.
4. Click **Save Changes** at the top-right.

### Assign the SecureBootCert Role to Relevant Configurations

The Secure Boot Certificate DEX Pack requires you to assign the SF_SecureBootCert Role to the relevant Configurations:

1. Navigate to **Configure** > **Configurations.**
2. Click the **padlock icon** in the upper-right to enable editing.
3. Use the drop-down at the top to select a relevant Configuration, or create a new Configuration.
4. Assign the **SF_SecureBootCert** Role to the Configuration by dragging it from **Available Roles** to **Assigned Roles**.
5. Click **Save Changes** at the top-right.
6. Repeat this process for any other relevant Configurations.

### Create the SecureBoot Needs Remediation Group

Create a dynamic computer group that automatically includes all devices that need remediation:

1. Go to **Configure** *>* **Groups.**
2. Click **+** to add a new group.
3. In **Group Name**, enter **SecureBoot Needs Remediation.**
4. In **Group Type**, select **Dynamic.**
5. Clear both **Group is enabled for Visualizer and Executive Insight** and **Group is enabled for real-time data** options.
6. Enter the following SQL:

```sql
SELECT T.WGUID
FROM RPT_VUSecureBootCert T
WHERE T.NEXTSTEP BETWEEN 2 AND 7
   OR (T.NEXTSTEP = 0 AND ISNULL(T.SOONESTMSCERTEXPIRYNAME, '') NOT LIKE '%2023%')
   OR (T.NEXTSTEP = 0 AND ISNULL(T.UPDATEERROR, '') <> '')
```
7. Click **Create**.

Use this group as a table filter, in **Prevent** > **Tools** for on-demand remediation, or in a Tool Schedule for automated remediation.