{"id":808448,"date":"2026-05-18T06:54:03","date_gmt":"2026-05-18T06:54:03","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=808448"},"modified":"2026-05-18T06:54:03","modified_gmt":"2026-05-18T06:54:03","slug":"monitor-changes-to-bootconfig-file-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/pt-br\/script-hub\/monitor-changes-to-bootconfig-file-powershell\/","title":{"rendered":"Como monitorar altera\u00e7\u00f5es no arquivo BootConfig no Windows [Script do PowerShell]"},"content":{"rendered":"

No intrincado mundo da TI, manter a integridade do sistema \u00e9 de extrema import\u00e2ncia. Um componente essencial do sistema operacional Windows \u00e9 o arquivo BootConfig. O monitoramento das altera\u00e7\u00f5es nesse arquivo \u00e9 fundamental para que os administradores de sistema e os profissionais de TI garantam a seguran\u00e7a e a estabilidade do sistema. Este guia se aprofunda em um script do PowerShell que verifica se h\u00e1 modifica\u00e7\u00f5es no arquivo BootConfig<\/strong>, oferecendo uma abordagem proativa para o gerenciamento do sistema.<\/p>\n

Hist\u00f3rico<\/h2>\n

O arquivo BootConfig no Windows \u00e9 um elemento fundamental que cont\u00e9m dados de configura\u00e7\u00e3o de inicializa\u00e7\u00e3o. Ele determina como o sistema \u00e9 iniciado, quais vers\u00f5es do sistema operacional devem ser carregadas e outros par\u00e2metros de inicializa\u00e7\u00e3o. Devido \u00e0 sua fun\u00e7\u00e3o no processo de inicializa\u00e7\u00e3o, qualquer altera\u00e7\u00e3o n\u00e3o autorizada ou inesperada pode resultar em mau funcionamento ou vulnerabilidades do sistema. Isso o torna um alvo principal para agentes mal-intencionados ou malware<\/a>. Para os profissionais de TI e os provedores de servi\u00e7os gerenciados (MSPs)<\/a>, ter uma ferramenta que possa detectar essas altera\u00e7\u00f5es \u00e9 inestim\u00e1vel. Ele ajuda no gerenciamento proativo do sistema e na an\u00e1lise forense em caso de viola\u00e7\u00f5es de seguran\u00e7a.<\/p>\n

O roteiro<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Checks if the BootConfig file was modified from last run.\r\n.DESCRIPTION\r\n    Checks if the BootConfig file was modified from last run.\r\n    On first run this will not produce an error, but will create a cache file for later comparison.\r\n.EXAMPLE\r\n    No parameters needed.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Path and file where the cache file will be saved for comparison\r\n    [string]\r\n    $CachePath = \"C:ProgramDataNinjaRMMAgentscriptingTest-BootConfig.clixml\"\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Get content and create hash of BootConfig file\r\n    $BootConfigContent = bcdedit.exe \/enum\r\n    $Stream = [IO.MemoryStream]::new([byte[]][char[]]\"$BootConfigContent\")\r\n    $BootConfigHash = Get-FileHash -InputStream $Stream -Algorithm SHA256\r\n\r\n    $Current = [PSCustomObject]@{\r\n        Content = $BootConfigContent\r\n        Hash    = $BootConfigHash\r\n    }\r\n\r\n    # Check if this is first run or not\r\n    if ($(Test-Path -Path $CachePath)) {\r\n        # Compare last content and hash\r\n        $Cache = Import-Clixml -Path $CachePath\r\n        $ContentDifference = Compare-Object -ReferenceObject $Cache.Content -DifferenceObject $Current.Content -CaseSensitive\r\n        $HashDifference = $Cache.Hash -like $Current.Hash\r\n        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n        if (-not $HashDifference) {\r\n            Write-Host \"BootConfig file has changed since last run!\"\r\n            Write-Host \"\"\r\n            $ContentDifference | ForEach-Object {\r\n                if ($_.SideIndicator -like '=>') {\r\n                    Write-Host \"Added: $($_.InputObject)\"\r\n                }\r\n                elseif ($_.SideIndicator -like '<=') {\r\n                    Write-Host \"Removed: $($_.InputObject)\"\r\n                }\r\n            }\r\n            exit 1\r\n        }\r\n    }\r\n    else {\r\n        Write-Host \"First run, saving comparison cache file.\"\r\n        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n    }\r\n    exit 0\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n
Acesse esse script e centenas de outros no NinjaOne Dojo<\/p>\n
Obter acesso<\/a><\/p>\n<\/div>\n
Detalhamento<\/h2>\n
O script fornecido \u00e9 um script do PowerShell meticulosamente criado para monitorar as modifica\u00e7\u00f5es no arquivo BootConfig desde sua \u00faltima execu\u00e7\u00e3o. Aqui est\u00e1 uma an\u00e1lise passo a passo mais detalhada:<\/p>\n
    \n
  1. Pr\u00e9-requisitos:<\/strong> O script requer a vers\u00e3o 5.1 do PowerShell<\/a>.<\/li>\n
  2. Verifica\u00e7\u00e3o da eleva\u00e7\u00e3o:<\/strong> Antes de mergulhar em sua fun\u00e7\u00e3o principal, o script verifica se foi executado com privil\u00e9gios de administrador, essenciais para acessar determinados arquivos e comandos do sistema.<\/li>\n
  3. Hashing de BootConfig:<\/strong> Usando o comando bcdedit<\/a>. exe \/enum, o script obt\u00e9m o conte\u00fado do BootConfig. Em seguida, ele cria um hash SHA256 desse conte\u00fado, que serve como um identificador exclusivo para esse conte\u00fado espec\u00edfico.<\/li>\n
  4. Compara\u00e7\u00e3o de cache:<\/strong> Em seguida, o script procura um arquivo de cache salvo anteriormente. Se existir, o script comparar\u00e1 o conte\u00fado e o hash do BootConfig atual com a vers\u00e3o em cache.<\/li>\n
  5. Sa\u00edda:<\/strong> Se forem detectadas diferen\u00e7as, o script fornecer\u00e1 uma sa\u00edda detalhada das altera\u00e7\u00f5es, especificando o que foi adicionado ou removido. Se for a primeira execu\u00e7\u00e3o do script, ele salvar\u00e1 os dados atuais do BootConfig para compara\u00e7\u00f5es futuras.<\/li>\n<\/ol>\n
    Casos de uso em potencial<\/h2>\n