PowerShell Desired State Configuration was just released with PowerShell v4.0 and\or Windows Server 2012 R2 and Windows 8.1.
First off if you are not already familiar with DSC please take a look at Windows
PowerShell Desired State Configuration Overview. PowerShell Desired State Configuration or DSC for short can be used to either setup or keep a specified configuration
Add-WindowsFeature Dsc-Service
Defining $ConfigurationData
I started my Script off by defining $ConfigurationData [Shown Below]. This is where you can specify the computer names you want the pull server to create .MOFs for. Everything listed after NodeName will automatically installed on the given server and will be constantly monitored at any specified interval Fifteen minutes or above. So by just adding ,"Server-Gui-Shell" to the inside of any NodeName bracket you can install server graphical shell. You could also prevent server graphical shell and ensure it doesn't get installed for more than Fifteen minutes, but that come later.
001
002
003
004
005
006
007
008
009
010
011
012
013
014 | $ConfigurationData = @{
AllNodes = @(
@{NodeName = "MKDC-02";Role="AD-Domain-Services","DHCP","DNS","Server-Gui-Shell","Server-Gui-Mgmt-Infra"},
@{NodeName = "SERVER2012R2-01";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "SERVER2012R2-02";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "SERVER2012R2-03";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "PSDSCPULLSERVER";Role="DSC-Service","Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "MKDFS-01";Role="Web"},
@{NodeName = "MKDFS-02";Role="FileShare"},
@{NodeName = "RODC";Role="Web","AD-Domain-Services"},
@{NodeName = "MKPSWA";Role="FileShare","Server-Gui-Shell","Server-Gui-Mgmt-Infra","WindowsPowerShellWebAccess"}
@{NodeName = "PSWAW12";Role="FileShare","Server-Gui-Shell","Server-Gui-Mgmt-Infra","WindowsPowerShellWebAccess"}
)
} |
Defining LCM
Next I defined my Local Configuration Manager, which is more or less the brains of the operation by telling all client computers where to retrieve their .MOF configuration files from. This is also where you specify the intervals and setting that are needed while configuring a PS DSC Server. I created a pull server which basically means I'll have a Server 2012R2 or maybe a Windows 8.1 box hosting the .MOF configuration files for all the servers to go reach out to. This will happen at the time specified in the ConfigurationModeFrequencyMins variable.
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022 | Configuration Copy_PowerShell_Scripts {
Node $AllNodes.NodeName
{
file "PowerShell_PROFILE_script"
{
Ensure = "Present"
type = "File"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts\profile.ps1"
MatchSource = "$True"
DestinationPath = "$PROFILE"
}
file "Copy_\\PSDSCPULLSERVER\DSC_Configurations\PowerShellScripts__TO__$env:USERPROFILE\Desktop\PowerShell"
{
Ensure = "Present"
type = "Directory"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts"
MatchSource = "$True"
Recurse = "$True"
DestinationPath = "$env:USERPROFILE\Desktop\PowerShell"
}
}
} |
Defining Configuration 1 of 3
Next is to define all Configurations. I've included 3 configurations within my script. The first Configuration is used to ensure my saved PowerShell Profile script is copied to $PROFILE on all servers and that my saved PowerShell Scripts directory(including contents) are copied to all servers as well.
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022 | Configuration Copy_PowerShell_Scripts {
Node $AllNodes.NodeName
{
file "PowerShell_PROFILE_script"
{
Ensure = "Present"
type = "File"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts\profile.ps1"
MatchSource = "$True"
DestinationPath = "$PROFILE"
}
file "Copy_\\PSDSCPULLSERVER\DSC_Configurations\PowerShellScripts__TO__$env:USERPROFILE\Desktop\PowerShell"
{
Ensure = "Present"
type = "Directory"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts"
MatchSource = "$True"
Recurse = "$True"
DestinationPath = "$env:USERPROFILE\Desktop\PowerShell"
}
}
} |
Defining Configuration 2 of 3
In the Configuration below I set the following services to automatically start a boot [wuauserv, WinRm, EventLog, and VSS] Not only will those services bet set to start at boot -- they will also be check at the interval you configure in you LCM
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083 | Configuration Configure_Services {
Node $AllNodes.NodeName
{
Service wuauserv
{
Name = "wuauserv"
State = "Running"
StartupType = "Automatic"
}
Service WinRM
{
Name = "WinRM"
State = "Running"
StartupType = "Automatic"
}
Service EventLog
{
Name = "EventLog"
State = "Running"
StartupType = "Automatic"
}
Service winmgmt
{
Name = "winmgmt"
State = "Running"
StartupType = "Automatic"
}
Service VSS
{
Name = "VSS"
State = "Running"
StartupType = "Automatic"
}
switch ($Node.Service)
{
"BITS"
{
Service BITS
{
Name = "BITS"
State = "Running"
StartupType = "Automatic"
}
}
"IISADMIN"
{
Service IISADMIN
{
Name = "IISADMIN"
State = "Running"
StartupType = "Automatic"
}
}
"vmms"
{
Service vmms
{
Name = "vmms"
State = "Running"
StartupType = "Automatic"
}
}
"msexchange"
{
Service msexchange
{
Name = "msexchange"
State = "Running"
StartupType = "Automatic"
}
}
"cryptsvc"
{
Service crypysvc
{
Name = "cryptsvc"
State = "Running"
StartupType = "Automatic"
}
}
}
}
} |
Defining Configuration 3 of 3
In this Configuration called "Add_Features" I start off by ensuring the following features (FilSharing, PowerShell and PowerShell_ISE) are installed on all servers specified under $AllNodes.NodeName which will is all servers listed in my $ConfigurationData array. However for the rest of the WindowsFeatures will not be installed unless they are called out within $ConfigurationData as shown with my Domain Controller MKDC-02 below.
001 | @{NodeName = "MKDC-02";Role="AD-Domain-Services","DHCP","DNS","Server-Gui-Shell","Server-Gui-Mgmt-Infra"}, |
So MKDC-02 will be configured with the following features (FS-FileServer, PowerShell, PowerShell-ISE
AND AD-Domain-Services, DHCP, DNS,Server-Gui-Shell, and Server-Gui-Mgmt-Infra)
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089 | Configuration Add_Features {
Node $AllNodes.NodeName
{
WindowsFeature FS-FileServer
{
Name = "FS-FileServer"
Ensure = "Present"
}
WindowsFeature PowerShell
{
Name = "PowerShell"
Ensure = "Present"
}
WindowsFeature PowerShell-ISE
{
Name = "PowerShell-ISE"
Ensure = "Present"
#Source = "wim:d:\sources\install.wim:2"
}
switch ($Node.Role)
{
"SNMP"
{
WindowsFeature snmp
{
Name = "SNMP-Service"
Ensure = "Present"
}
}
"Web-Server"
{
WindowsFeature Web-Server
{
Name = "Web-Server"
Ensure = "Present"
}
}
"DHCP"
{
WindowsFeature DHCP
{
Name = "DHCP"
Ensure = "Present"
}
}
"DNS"
{
WindowsFeature DNS
{
Name = "DNS"
Ensure = "Present"
}
}
"Server-Gui-Shell"
{
WindowsFeature Server-Gui-Shell
{
Name = "Server-Gui-Shell"
Ensure = "Present"
}
}
"Server-Gui-Mgmt-Infra"
{
WindowsFeature Server-Gui-Mgmt-Infra
{
Name = "Server-Gui-Mgmt-Infra"
Ensure = "Present"
#Source = "wim:d\sources\install.wim:2"
}
}
"AD-Domain-Services"
{
WindowsFeature AD-Domain-Services
{
Name = "AD-Domain-Services"
Ensure = "Present"
}
}
"DSC-Service"
{
WindowsFeature DSC-Service
{
Name = "DSC-Service"
Ensure = "Present"
}
}
}
}
} |
Creating the .MOFs
The next step in my script was to move to the folder that IIS is hosting as this is where the .MOFs need to be created.
Set-Location "C:\Program Files\WindowsPowerShell\DscService"
NOTE: instead of moving to the directory you can specify the -OutputPath Parameter.
The following creates the .MOF file for the Local Configuration Manager
DSC_LCM -ConfigurationData $ConfigurationData -OutputPath .\DSC_LCM
The below Creates the .MOF file for the corresponding "Configuration"
001
002
003
004
005
006
007
008
| ## Creates the .MOF file for the Local Configuration Manager
DSC_LCM -ConfigurationData $ConfigurationData -OutputPath .\DSC_LCM
## Creates the .MOF file for the corresonding "Configuration"
Add_Features -OutputPath .\Add_Features -ConfigurationData $ConfigurationData
Configure_Services -OutputPath .\Configure_Services -ConfigurationData $ConfigurationData
Copy_PowerShell_Scripts -OutputPath .\Copy_PowerShell_Scripts -ConfigurationData $ConfigurationData
|
"Make it so"
001
002
003
004
005 | Set-DscLocalConfigurationManager -Path .\DSC_LCM -ComputerName $AllNodes -ErrorAction SilentlyContinue
## runs the desired .MOF configuration file
Start-DscConfiguration -Path .\Copy_PowerShell_Scripts -ComputerName $AllNodes -ErrorAction SilentlyContinue
Start-DscConfiguration -Path .\Add_Features -ComputerName $AllNode -ErrorAction SilentlyContinue
Start-DscConfiguration -Path .\Configure_Services -ComputerName $AllNodes -ErrorAction SilentlyContinue |
My thoughts on DSC -- Setup can be a little time consuming
but now I can boot up any number of servers and have them configure with any number of roles or features installed with very little modification.
Good-Bye Configuration Drift -- Good-Bye failed backups
What it looks like when it's running:
Here's my full Pull Server Configuration Script
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310 | <#
.CREATED BY:
Matthew A. Kerfoot
.CREATED ON:
07\14\2014
.UPDATED ON:
07/22/2014
.SYNOPSIS
Automating the world one line of code at a time.
.DESCRIPTION
This is a PowerShell Desired State Push Configuration.
.EXAMPLE
Run the script as an administrator PS:\>G\DSC\DSC.ps1
.NOTES
This is a PowerShell Desired State Push Configuration.
.NOTES
Version : 4.0
Author/Copyright : © Matthew Kerfoot - All Rights Reserved
Email/Blog/Twitter : mkkerfoot@gmail.com www.matthewkerfoot.com @mkkerfoot
Disclaimer : THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE RISK
OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
While these scripts are tested and working in my environment, it is recommended
that you test these scripts in a test environment before using in your production
environment
Matthew Kerfoot further disclaims all implied warranties including, without limitation, any
implied warranties of merchantability or of fitness for a particular purpose. The entire risk
arising out of the use or performance of this script and documentation remains with you.
In no event shall Matthew Kerfoot, its authors, or anyone else involved in the creation, production,
or delivery of this script/tool be liable for any damages whatsoever (including, without limitation,
damages for loss of business profits, business interruption, loss of business information, or other
pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation,
even if Matthew Kerfoot has been advised of the possibility of such damages
Assumptions : ExecutionPolicy of AllSigned (recommended), RemoteSigned or Unrestricted (not recommended)
Limitations : This is a Push Configuration which is limited compared to a pull configuration.
Ideas/Wish list : backupexec ; Veeam
Known issues : Some Paths have been hardcoded
Authors notes : This is my first attempt at DSC
##>
###################################################################################################
## # # # # # Variables that need to be edited # # # # # # ##
###################################################################################################
$ConfigurationData = @{
AllNodes = @(
@{NodeName = "MKDC-02";Role="DHCP","DNS","Server-Gui-Shell","Server-Gui-Mgmt-Infra"},
@{NodeName = "SERVER2012R2-01";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "SERVER2012R2-02";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "SERVER2012R2-03";Role="Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "PSDSCPULLSERVER";Role="DSC-Service","Server-Gui-Shell","Server-Gui-Mgmt-Infra";Service="BITS","vmms"},
@{NodeName = "MKDFS-01";Role="Web"},
@{NodeName = "MKDFS-02";Role="FileShare"},
@{NodeName = "RODC";Role="Web"},
@{NodeName = "MKPSWA";Role="FileShare","Server-Gui-Shell","Server-Gui-Mgmt-Infra","WindowsPowerShellWebAccess"}
@{NodeName = "PSWAW12";Role="FileShare","Server-Gui-Shell","Server-Gui-Mgmt-Infra","WindowsPowerShellWebAccess"}
)
}
$StartTime = (Get-Date) ## Begin the timer
Clear-Host ## Clears the screen
## Creates Logfile of all messages, verbose and host
Start-Transcript -Path "C:\Windows\Temp\DSC_$( get-date -f MM-dd-hh-mm ).log"
## moves to the newly created directory
Set-Location "C:\Program Files\WindowsPowerShell\DscService"
## Local Configuration Manager -- Sets all DSC intervals and settings
Configuration DSC_LCM {
Node $AllNodes.NodeName
{
LocalConfigurationManager
{
AllowModuleOverwrite = "$True"
ConfigurationID = "a9c09333-54f7-4a25-8a58-ebee9647e313";
DownloadManagerName = "WebDownloadManager"
DownloadManagerCustomData = @{ ServerUrl="http://PSDSCPULLSERVER.kerfoot.com:8080/PSDSCPullServer.svc" ; AllowUnsecureConnection= "True" }
RefreshMode = "PULL"
ConfigurationMode = "ApplyAndAutoCorrect"
RebootNodeIfNeeded = "$True"
RefreshFrequencyMins = "15"
ConfigurationModeFrequencyMins = "30"
}
}
}
## grabs the profile.ps1 file from $D_DSC and adds it to the logged in users PS $PROFILE
Configuration Copy_PowerShell_Scripts {
Node $AllNodes.NodeName
{
file "PowerShell_PROFILE_script"
{
Ensure = "Present"
type = "File"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts\profile.ps1"
MatchSource = "$True"
DestinationPath = "$PROFILE"
}
file "Copy_\\PSDSCPULLSERVER\DSC_Configurations\PowerShellScripts__TO__$env:USERPROFILE\Desktop\PowerShell"
{
Ensure = "Present"
type = "Directory"
SourcePath = "\\PSDSCPULLSERVER\DSC Configurations\PowerShellScripts"
MatchSource = "$True"
Recurse = "$True"
DestinationPath = "$env:USERPROFILE\Desktop\PowerShell"
}
}
}
Configuration Configure_Services {
Node $AllNodes.NodeName
{
Service wuauserv
{
Name = "wuauserv"
State = "Running"
StartupType = "Automatic"
}
Service WinRM
{
Name = "WinRM"
State = "Running"
StartupType = "Automatic"
}
Service EventLog
{
Name = "EventLog"
State = "Running"
StartupType = "Automatic"
}
Service winmgmt
{
Name = "winmgmt"
State = "Running"
StartupType = "Automatic"
}
Service VSS
{
Name = "VSS"
State = "Running"
StartupType = "Automatic"
}
switch ($Node.Service)
{
"BITS"
{
Service BITS
{
Name = "BITS"
State = "Running"
StartupType = "Automatic"
}
}
"IISADMIN"
{
Service IISADMIN
{
Name = "IISADMIN"
State = "Running"
StartupType = "Automatic"
}
}
"vmms"
{
Service vmms
{
Name = "vmms"
State = "Running"
StartupType = "Automatic"
}
}
"msexchange"
{
Service msexchange
{
Name = "msexchange"
State = "Running"
StartupType = "Automatic"
}
}
"cryptsvc"
{
Service crypysvc
{
Name = "cryptsvc"
State = "Running"
StartupType = "Automatic"
}
}
}
}
}
Configuration Add_Features {
Node $AllNodes.NodeName
{
WindowsFeature FileSharing
{
Name = "FS-FileServer"
Ensure = "Present"
}
WindowsFeature PowerShell
{
Name = "PowerShell"
Ensure = "Present"
}
WindowsFeature PowerShell-ISE
{
Name = "PowerShell-ISE"
Ensure = "Present"
#Source = "wim:d:\sources\install.wim:2"
}
switch ($Node.Role)
{
"SNMP"
{
WindowsFeature snmp
{
Name = "SNMP-Service"
Ensure = "Present"
}
}
"Web-Server"
{
WindowsFeature Web-Server
{
Name = "Web-Server"
Ensure = "Present"
}
}
"DHCP"
{
WindowsFeature DHCP
{
Name = "DHCP"
Ensure = "Present"
}
}
"DNS"
{
WindowsFeature DNS
{
Name = "DNS"
Ensure = "Present"
}
}
"Server-Gui-Shell"
{
WindowsFeature Server-Gui-Shell
{
Name = "Server-Gui-Shell"
Ensure = "Present"
}
}
"Server-Gui-Mgmt-Infra"
{
WindowsFeature Server-Gui-Mgmt-Infra
{
Name = "Server-Gui-Mgmt-Infra"
Ensure = "Present"
#Source = "wim:d\sources\install.wim:2"
}
}
"AD-Domain-Services"
{
WindowsFeature AD-Domain-Services
{
Name = "AD-Domain-Services"
Ensure = "Present"
}
}
"DSC-Service"
{
WindowsFeature DSC-Service
{
Name = "DSC-Service"
Ensure = "Present"
}
}
}
}
}
## Creates the .MOF file for the Local Configuration Manager
DSC_LCM -ConfigurationData $ConfigurationData -OutputPath .\DSC_LCM
## Creates the .MOF file for the corresonding "Configuration"
Add_Features -OutputPath .\Add_Features -ConfigurationData $ConfigurationData
Configure_Services -OutputPath .\Configure_Services -ConfigurationData $ConfigurationData
Copy_PowerShell_Scripts -OutputPath .\Copy_PowerShell_Scripts -ConfigurationData $ConfigurationData
## runs the desired .MOF configuration file
Set-DscLocalConfigurationManager -Path .\DSC_LCM -ComputerName $AllNodes -ErrorAction SilentlyContinue
Start-DscConfiguration -Path .\Copy_PowerShell_Scripts -ComputerName $AllNodes -ErrorAction SilentlyContinue
Start-DscConfiguration -Path .\Add_Features -ComputerName $AllNode -ErrorAction SilentlyContinue
Start-DscConfiguration -Path .\Configure_Services -ComputerName $AllNodes -ErrorAction SilentlyContinue
$EndTime = (Get-Date) ## Stops the timer
"Elapsed Time: $(($EndTime - $StartTime).totalseconds) seconds" ## Calculate amount of seconds your code takes to complete.
Set-Location "B:\DSC\"
Stop-Transcript -Verbose |