2
votes

Linux has tools like puppet to enforce configuration on a server. Also, they tend to rely on text files that can be thrown into svn, git, etc.

What tools are there for windows servers that allow me to:

  • define the configuration of several servers (I can define app servers, email servers, etc)
  • determine if the rookie changed anything without letting me know
  • blast config onto a new VM or box when we need to add a new server to the farm?

3 Answers 3

3
votes

System Center Configuration Manager has a couple excellent tools for this (Operating System Deployment [OSD] and Desired Configuration Manager [DCM]). There is significant administrative overhead in building such a system.

OSD will allow you to do intelligent system imaging. This is very useful as it is fairly simple to maintain once properly built. There are people who's entire professional duties revolve around this so it can get very complex and in depth depending on what you are trying to do.

DCM will allow you to create various Baselines which consist of Configuration Items which further consist of Settings. Each setting can be thought of as something to test on the machine. BY best practice and normal usage it is important that you test the Configuration of something rather than the State of something (i.e. test that a service is not disabled instead of testing that the service is running). DCM is useful in that you can continually add to and refine your Baselines and Config Items and reuse them in other baselines. DCM also evaluates each agent against every assigned baseline on a daily basis by default (can be changed to any interval). A side benefit of DCM is that there are published baselines from Microsoft that help evaluate compliance for various regulations (HIPPA, SOX, PCI, etc). Finally, for resolution of configuration changes, SCCM Collections can be built based on compliance with any DCM Configuration Item, allowing you to build a package that can resolve the DCM Compliance issue in an automatic fashion.

2
votes

The built-in solution is Group Policy http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx. It allows you to enforce configuration of thousands of settings, and you can apply any combination of settings to any combination of servers and clients. Most policies prevent users (even those with administrative credentials) from changing the affected settings, and the settings are reapplied at system boot or user logon (depending on whether the setting is a per-computer or per-user setting). Group Policies can even install programs that are provided as Windows Installer packages. For automated operating system installation, see if Windows Deployment Services meets your needs: http://technet.microsoft.com/en-us/library/cc772106.aspx.

If you need Group Policy change management features, investigate the Microsoft Desktop Optimization Pack's (MDOP's) Advanced Group Policy Management (AGPM) component. MDOP is an add-on subscription to Software Assurance on the Windows Client (Vista or 7).

MDOP: http://www.microsoft.com/windows/enterprise/products/mdop.aspx

Software Assurance: http://www.microsoft.com/licensing/software-assurance/default.aspx. Contact your reseller for purchasing information.

1
vote

Group Policy will enforce and re-enforce settings as needed. However, if you're looking for overall configuration management, there are numerous tools like:

  • Altiris
  • System Center (formerly SMS)

As far as new systems, Ghost is an option to build an image that you redeploy. With VMware, you can build a VM, set it up, apply sysprep, and then you simply copy it.

Not the answer you're looking for? Browse other questions tagged .