This is an issue we are solving simply by rebooting the WINPE instance if Secure Boot is not detected as active on the device that our Desktop Techs are working on. Admittedly we only have this issue due to some inadvertent user troubleshooting but still making it a requirement for Windows Imaging would save a lot of OSDCloud users the same headache.
here is our script example for this:
# Test for Secure Boot Status.
$GeneralSecureBootSetting = Confirm-SecureBootUEFI
if ($GeneralSecureBootSetting -ne $true) {
$SecureBootExceptions = 'Virtual Machine','VMware7,1','AHV' #VSphere VMs do not have a secure boot setting, so we're excluding VMs from this requirement
if($Machine -notin $SecureBootExceptions) {
Add-Type -AssemblyName PresentationCore, PresentationFramework
$response = [system.windows.messagebox]::show('Secure Boot is not enabled. Please enable it in the BIOS:','Enable Secure Boot','OK')
wpeutil reboot
}
}