11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
Day 1: Intro to PowerShell DSC and Con�guring Your First Pull Server Cloud, DevOps, Powershell
WHO’S ONLINE There are no users currently online
by Pete Zerger on August 2nd, 2014
Welcome to Day 1 of the “100 Days of DevOps with PowerShell”! For background on our goals in this series, see Announcing the “100 Days of DevOps with PowerShell” Series here on SCC. Today, I am going to introduce you to PowerShell Desired State Con�guration (DSC) and demonstrate how it enables DevOps through a hands-on example. I’ll endeavor to be thorough for those who are
MOST BOOKMARKED POST Updated MP: SQL Server
(6)
build on this foundation through varied (and sometimes more complex)
Download All Microsoft
(4)
examples as the series continues.
Management Packs for
relatively new to PowerShell DSC, but also very brief, so you can easily work through the concepts and example in a few minutes time. We will
I submit for your review, PowerShell DSC concepts and pull server in less than 2,000 words.
What is PowerShell DSC? Desired State Con�guration (DSC) is a feature in PowerShell 4.0 and Windows Server 2012 R2 that helps Windows administrators manage and deploy software services’ con�guration data and the environment the
SCOM 2007, R2 and 2012 in Bulk with PowerShell How to Enable Automated
(3)
CSV-Import On-Demand in SCSM 2012 with Orchestrator
services run in. DSC provides a set of PowerShell language extensions, cmdlets and a process called declarative scripting. The goal of DSC is to provide
Use SharePoint Wiki as
(2)
SCOM Knowledge Base
administrators with a method for maintaining consistent con�guration sets across computers or devices. You can write an expression describing
VSAE – Management Pack
a system con�guration, and the system will evaluate and apply the
Template Groups
(2)
con�guration. Common use cases for PowerShell DSC include (but are not limited to):
(2)
Enabling or disabling server roles and features (like IIS) Deploying new software Deploy an IIS website (including the site content) Managing registry settings Running Windows PowerShell scripts Managing �les and directories Starting, stopping, and managing processes and services Managing groups and user accounts Managing environment variables Fixing a con�guration that has drifted away from the desired state
ROI for RBA: Considerations
(2)
and Best Practices for Runbook Automation Planning (1st Draft) How to create a Two-State
(2)
PowerShell Script Monitor using the Authoring Console (Part 1)
Discovering the actual con�guration state on a given node The bottom line is PowerShell DSC enables IT Pros to support consistent, standardized con�guration and continuous deployment, both core goals
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
OpsMgr 2012: Update
(2)
agent failover settings from
1/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central of DevOps.
How PowerShell DSC Works (high level) With DSC, you start by writing a con�guration script in Windows PowerShell. This script doesn’t do anything. It doesn’t install, con�gure, provision, or anything else. It simply lists the elements you want
a spreadsheet via PowerShell [sample script] Import-Module failed in
(1)
ManagementPack Script
con�gured, and how you want them con�gured. The con�guration also speci�es the machines to which it applies. When you run the con�guration, PowerShell produces a Management Object Format (MOF) �le for each targeted machine, or node. MS chose the MOF format in part
MY BOOKMARKS
because it’s a widely accepted standard, you can create them with a
You must be logged in to view
variety of tools…even Notepad (but don’t create MOF �les in Notepad).
your bookmarks.
1. Write a con�guration script in PowerShell. 2. Run that script, which creates one or more MOF �les, depending on how many machines (called nodes). If your con�guration is written to target multiple nodes, you’ll get a MOF �le for each one. Machines with the same con�guration (like members of a web farm) can use the same MOF �le and DSC con�guration ID. 3. MOF �les are distributed to the machines (nodes) for which they are intended. Each node can have only one MOF �le. 4. Nodes start con�guring themselves to match what is de�ned in the MOF �le. There are two ways to distribute the �les to the nodes (step 3): Push mode is basically a manual �le copy via Windows Remote Management (WinRM) remoting Pull mode con�gures nodes to check in to a special web server (called a pull server) retrieve their MOF con�guration �les automatically every few minutes. And once con�gured, the node will recheck its con�guration every few minutes to ensure its con�guration matches the settings in the MOF �le. Pull mode is the way the vast majority of enterprises in the real world will use DSC and thus is the method we will typically use in this series. When you use the pull server method, the nodes will not only recheck their con�guration every few minutes, but they will also check the pull server for an updated MOF �le to ensure they checking for your current intended con�guration.
Sample Environment (for this tutorial) The sample environment used in this tutorial consists of two machines: Server1.contoso.com – A Windows Server 2012 R2 system with about 2 GB of ram (size A1 in Microsoft Azure) that we will con�gure as a Pull Server. Server2.contoso.com – Another Windows 2012 R2 system just like the �rst. This system will serve as a managed system (node) that will retrieve its con�guration �le from the pull server. NOTE: Yes, my machines are Azure VMs (IaaS), but yours do not have to be. You can use PowerShell DSC on physical or virtual machines, onpremises or in the cloud, running Windows or even Linux (more on this on day 2 of DevOps on Monday). Con�guring the pull server You can con�gure a pull server to use HTTP, HTTPS, or SMB. For ease of use in your �rst experience with DSC, we will use HTTP (keeping it simple on day 1). The easiest method for creating a pull server is probably the xPSDesiredStateCon�guration module, in the PowerShell DSC Resource Kit created by Microsoft and published to the TechNet Gallery. In this step, you are going to use a pre-created con�guration script that will
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
2/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central create a MOF �le to con�gure server1 as our pull server. You will then tell server1 to apply that MOF �le, e�ectively con�guring server1 as a DSC pull server.
Perform the following steps on Server1.contoso.com (or your equivalent) 1) Download the xPSDesiredStateCon�guration module from http://gallery.technet.microsoft.com/xPSDesiredStateCon�guratio417dc71d. Unzip the module to the %programfiles%\WindowsPowerShell\modules directory.
2) Use the Add Roles and Features Wizard to add the Windows PowerShell Desired State Con�guration feature.
When you check the box by the feature, the wizard will prompt you to accept installation of all the required components, which includes Windows Communication Foundation (WCF). Click Add Features and complete the wizard.
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
3/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
Notes: You will need the above on any system where you intend to author DSC con�gurations. You can also add this feature via PowerShell with this one-liner: AddWindowsFeature DscService 3) Enable a WS Management listener if not already enabled. winrm quickconfig This was not enabled by default in the standard Windows Server 2012 gallery images I used for this tutorial. If you don’t know, you can simply run the command and if already con�gured, you will receive a message to that e�ect. 4) Run the script to create the con�guration MOF �le for the pull server. This script creates a �le named server1.contoso.com.mof. NOTE: I ran the script below in the PowerShell ISE, but if you prefer, you could save it as a PowerShell script (.ps1) and run from a PowerShell prompt. configuration NewPullServer { param ( [string[]]$ComputerName = ‘localhost’ ) ImportDSCResource ModuleName xPSDesiredStateConfiguration Node $ComputerName { WindowsFeature DSCServiceFeature { Ensure = “Present”
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
4/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central Name = “DSCService” } xDscWebService PSDSCPullServer { Ensure = “Present” EndpointName = “PSDSCPullServer” Port = 8080 PhysicalPath = “$env:SystemDrive\inetpub\wwwroot\PSDSCPullServer” CertificateThumbPrint = “AllowUnencryptedTraffic” ModulePath = “$env:PROGRAMFILES\WindowsPowerShell\DscService\Modules” ConfigurationPath = “$env:PROGRAMFILES\WindowsPowerShell\DscService\Configuration” State = “Started” DependsOn = “[WindowsFeature]DSCServiceFeature” } xDscWebService PSDSCComplianceServer { Ensure = “Present” EndpointName = “PSDSCComplianceServer” Port = 9080 PhysicalPath = “$env:SystemDrive\inetpub\wwwroot\PSDSCComplianceServer” CertificateThumbPrint = “AllowUnencryptedTraffic” State = “Started” IsComplianceServer = $true DependsOn = (“[WindowsFeature]DSCServiceFeature”,”[xDSCWebService]PSDSCPullServer”) } } } #This line actually calls the function above to create the MOF file. NewPullServer –ComputerName server1.contoso.com The output of the con�guration script is the MOF �le mentioned above (and shown below).
5) Next, run the following command, which tells server1 to apply the con�guration MOF �le, con�guring server1 as a pull server. StartDscConfiguration .\NewPullServer –Wait =============================================================== SIDEBAR: In my case, I actually received the error below on the �rst attempt:
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
5/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central “The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available.” I disabled IPv6 on server1.contoso.com (as it was not enabled elsewhere) and then re-attempted step 5, which ran successfully on the second attempt.
=============================================================== After the con�guration process reported as successful, I checked my pull server by �rst looking in IIS Manager
And then by checking the web service to ensure the pull server was responding as expected.
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
6/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central How that your pull server is ready, you are ready to test pulling a con�guration to a node (server2.contoso.com) to verify your pull server is functional.
Create a Con�guration for a Node 1) First, you will create a con�guration for server2. This very common sample ensures the IIS Web Server feature is enabled on a server. However, you will run this con�guration script from the pull server (server1 in this example) Configuration ContosoWebsite { param ($MachineName) Node $MachineName { #Install the IIS Role WindowsFeature IIS { Ensure = “Present” Name = “WebServer” } #Install ASP.NET 4.5 WindowsFeature ASP { Ensure = “Present” Name = “WebAspNet45” } } } ContosoWebsite –MachineName “server2.contoso.com” The snippet above creates a MOF �le named server2.contoso.com.mof in the c:\users\ \ContosoWebsite directory (c:\users\administrator\ContosoWebsite in my environment). 2) Generate the GUID that will be used to name the mof �le for server2.contoso.com [guid]::NewGuid()
3) Rename the �le above to .mof, where is your GUID from step 2. Then, copy the renamed �le to the folder below. \\server1\c$\program files\windowspowershell\dscservice\configuration You can accomplish steps 2 and 3 above with the following PowerShell code snippet: $Guid= [guid]::NewGuid() $source = “ContosoWebsite\server2.contoso.com.mof” $target= “\\server1\c$\program files\windowspowershell\dscservice\configuration\$Guid.mof”
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
7/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central copy $source $target 4) With the MOF in place, you now need to generate a checksum �le (for the server2.contoso.com.mof �le ) for the pull server. When computers attempt to pull their con�guration, they use the checksum to ensure the integrity of the mof �le. You create the checksum �le in the same PowerShell session with the one-liner: NewDSCChecksum $target The checksum �le should appear in the same folder as the mof �le, as shown below. The �le as the same name as the MOF, but with a .checksum on the end.
Test Pulling the Con�guration By default, Windows computers wait for you to push a con�guration to them, and then they re-check it every 15 minutes. We’re going to recon�gure server2.contoso.com to pull its con�guration (the one we just created) from our pull server using the default refresh interval of 30 minutes. To do that, we will use the pull server (server1) to create another con�guration �le: But before you do, logon to server2 and just verify that the IIS web server role is not already installed by running the following one-liner at a PowerShell prompt: GetWindowsFeature webserver If IIS is not installed, the Install State should show as Available.
Okay, return to server1 and perform the following steps: 1) Run the following script at a PowerShell prompt or in the ISE. Configuration SetPullMode { param([string]$guid) Node server2.contoso.com { LocalConfigurationManager { ConfigurationMode = ‘ApplyOnly’ ConfigurationID = $guid RefreshMode = ‘Pull’ DownloadManagerName = ‘WebDownloadManager’ DownloadManagerCustomData = @{ ServerUrl = ‘http://server1:8080/PSDSCPullServer.svc’; AllowUnsecureConnection = ‘true’ } }
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
8/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central } } SetPullMode –guid $Guid
SetDSCLocalConfigurationManager –Computer server2.contoso.com
Path ./SetPullMode –Verbose 2) Once the prompt returns success, verify the Web Server role is installed by running the following one-liner on server2 as you did before. GetWindowsFeature Name Webserver The the Install State should show as Installed.
Done! You have now successfully con�gured and tested your pull server to support PowerShell DSC.
Conclusion I hope you’ve found this article useful. Please post comments and errata in the comments below. Join us on Monday for Day 2 of the 100 Days of DevOps with PowerShell! Share this:
Facebook
Pocket
Infront LinkedIn
Twitter
Google
LinkedIn
Pinterest
Like this:
Like One blogger likes this.
← Highlights from the Road to the Cloud Webinar
How to Create a PowerShell Console Pro�le Baseline for the Entire Environment →
26 thoughts on “Day 1: Intro to PowerShell DSC and Con�guring Your First Pull Server” Anthony Chow August 2, 2014 at 6:20 am What happen if DSC con蝕�ict with group policy? I will assume one will take precedence. Is there documentation on this that I can lookup? thanks.
Je�rey Snover[MSFT] August 2, 2014 at 4:14 pm @Anthony – they’ll �ght like two racoons in a bag. Don’t do that.
Jose Saenz August 4, 2014 at 9:35 pm
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
9/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
I already performed all the steps, everything was executed without errors but con�guration is not being to “Server2” applied. Checking the scritps (speci�cally the last one) I’m a little lost there. At the end you call the con�guration piece with the following lines (by the way the second has an additional “-” before Computername parameter), and you speci�ed “$Guid” as parameter. 1 SetPullMode –guid $Guid
Set-DSCLocalConfigurationManager – –Computer
Where this variable was populated? where is taking the Guid? My guess is that this should be the Guid that we assigned to MOF �le, but I don’t see where is assigned. I just modi�ed the scripts to match the ServerNames in my lab.
Pete Zerger Post author
HOME
August 5, 2014 at 9:13 am
INFRONT UNIVERSITY
FORUMS
BLOG
DOWNLOADS
PACK CATALOGS
Hey Jose, looks like you have an extra dash (-) in front of -Computer. $Guid is
RESEARCHTHIS! populated here:
PODCASTS
WIKI
LOGIN
You can accomplish steps 2 and 3 above with the following PowerShell code snippet: $Guid = [guid]::NewGuid() $source = “ContosoWebsite\server2.contoso.com.mof” $target= “\\server1\c$\program files\windowspowershell\dscservice\configuration\$Guid.mof” copy $source $target
Maekee August 6, 2014 at 8:56 am What happened to Day 2?
Tommy Gunn August 6, 2014 at 9:25 am Day 2 – http://www.systemcentercentral.com/how-to-install-dsc-providers-forlinux-on-centos-6-2/ Day 3 – http://www.systemcentercentral.com/powershell-team-foundationserver-2013-getting-started/ day 4 comes today!
Maekee August 6, 2014 at 6:35 pm Thanks Tommy, is there a page where all the links for the days are Collector. Searching for the word “day” and only �nd Day 1.
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
10/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
Pete Zerger Post author August 7, 2014 at 12:16 am Running list of all articles in the series so far at http://www.systemcentercentral.com/100DaysOfDevOps/
Daryl Harrington August 10, 2014 at 4:36 am It looks like your con�guration script for the SetPullMode has an error in it that will cause it to fail. Set-DSCLocalCon�gurationManager …. should be on a separate line. SetPullMode –guid $Guid Set-DSCLocalCon�gurationManager –Computer server2.contoso.com ` -Path ./SetPullMode –Verbose
HOME INFRONT UNIVERSITY Thanks for the series. Looking forwardFORUMS to more. RESEARCHTHIS!
PODCASTS
WIKI
BLOG
DOWNLOADS
PACK CATALOGS
LOGIN
Tommy Gunn August 14, 2014 at 9:23 am Dayrl, the little tick (`) Pete has at the end of the line allows you to break up a long one-liner into two lines and have it still run.
Daryl Harrington August 20, 2014 at 4:58 am Quite aware of the tick and it’s use, however, not what I was referring to. There should be a space between $Guid and Set. The two words run together which fails.
Tommy Gunn August 20, 2014 at 11:12 am Assigned in this line above: $Guid= [guid]::NewGuid()
CNenad November 28, 2014 at 1:53 pm Hi Pete and thank you for good article. I need some info’s about lab setup for your DSC tutorial. I’ve used two azure vm with Win Svr Tech. preview. Should those vm’s have to be joined into domain (ie I need to setup also domain controller, how did you get them joined into contoso.com domain) ? In script NewPullCon�guration, in line: [string[]]$ComputerName = ‘localhost’ does need to be changed ‘localhost’ into name of my test vm – my localhost which will be pull server ?
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
11/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
Thank you. Keep up good work. Best regards Nenad
Pete Zerger Post author November 29, 2014 at 7:35 pm CNenad, I appreciate the kind words….thank you! About localhost: I wrote the PowerShell snippets so all could be run from the DSC Pull Server. If you run them from elsewhere, make sure to replace localhost with the name of your Pull Server. Also, beware of “smart quotes” in the script, which are attributed to MS Word, but seem to pop up occassionally in WordPress code formatters. Basically, replace any occurrence of ’ with ‘. Let me know if you have trouble. Always happy to assist.
15. Pingback:INFRONT Solving the DSC Pull ChickenFORUMS and Egg problem « FoxDeploy.com HOME UNIVERSITY BLOG DOWNLOADS
RESEARCHTHIS!
PODCASTS
Benjamin Hagels
WIKI
PACK CATALOGS
LOGIN
February 18, 2015 at 5:55 pm Hi! I did every step of day 1 and all looks �ne. But when I set up the SetPullMode snippet nothing happens on my server2. Web-Server doesn´t install. Where can I have a look to �nd the error? Thanks for this great help to understand DSC =)
Benjamin Hagels February 18, 2015 at 6:42 pm Okay after an half our the web server is installed. Am I wrong or should the PullMode do it directly?
18. Pingback: Déploiement et con�guration en IAAS Azure | Nouvelles Chroniques d'Amethyste
19. Pingback: PowerShell DSC | Vincent
20. Pingback: Multiple team, component, environment deployment via DSC | ALM by Erick Segaar
21. Pingback: Day 1: Intro to PowerShell DSC and Con�guring Your First Pull Server – System Center Central | Soyka's Blog
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
12/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central Toby April 25, 2016 at 7:01 pm
The Pull con�guration was killing me ServerUrl = ‘http://server1:8080/PSDSCPullServer.svc’; AllowUnsecureConnection = ‘true’ } Should be: ServerUrl = ‘http://server1:8080/PSDSCPullServer/PSDSCPullServer.svc’; AllowUnsecureConnection = ‘true’ }
NN May 26, 2016 at 6:56 am Test Pulling the Con�guration : works �ne with script as below
HOME
INFRONT UNIVERSITY
Con�guration SetPullMode
RESEARCHTHIS! {
PODCASTS
FORUMS WIKI
BLOG
DOWNLOADS
PACK CATALOGS
LOGIN
Node server2.contoso.com { LocalCon�gurationManager { Con�gurationID = “e624ddc7-519e-4bbd-a7f7-4af4c76d9cbd” Con�gurationMode = “ApplyOnly” RefreshMode = “Pull” DownloadManagerName = “WebDownloadManager” DownloadManagerCustomData = @{ ServerUrl = “http://server1:8080/PSDSCPullServer.svc”; AllowUnsecureConnection = “true” ; } } } } SetPullMode Set-DSCLocalCon�gurationManager –Computer server2.contoso.com -Path .\SetPullMode –Verbose
daniel May 27, 2016 at 5:33 am Thanks, NN! Your revised script is clear on how the Con�gurationID (GUID) can be provided. Worked like a charm the �rst try.
daniel May 27, 2016 at 7:01 am In my case I noticed that IIS was not installing on the target server after waiting over an hour, yet the last script ran without error. On the target server I checked the event log for DSC entries: get-WinEvent -LogName “Microsoft-Windows-Dsc/Operational” | ft -Wrap There I found an entry stating:
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
13/14
11/4/2016
Day 1: Intro to PowerShell DSC and Configuring Your First Pull Server System Center Central
4160 Information Job {52D10F1B-23D5-11E6-80C0-00505698CA2F} : Registering the task with task scheduler after rebooting the machine I rebooted the machine and after about 20 minutes, IIS was installed on the target server.
dragon788 July 26, 2016 at 7:12 pm For anyone running into issues with this complaining about the IsCompliance portion, they appear to have removed it sometime around March of 2016 after version 3.8.0.0.
Leave a Reply You must be logged in to post a comment.
HOME
INFRONT UNIVERSITY
© 2013 System Center Central
RESEARCHTHIS!
PODCASTS
FORUMS WIKI
BLOG
LOGIN
DOWNLOADS
PACK CATALOGS
Terms of Use
http://www.systemcentercentral.com/day1introtopowershelldscandconfiguringyourfirstpullserver/
Privacy Policy
14/14
