I'm having a little bit of a hard to trying to decipher what the best approach is when creating configurations based off Powershell DSC.

It appears that partial configurations are meant to allow multiple people/teams create configurations for their own policies/configurations. This makes sense, but I have seen people taking this approach to create and essentially create modules to structure their code so it's not so monolithic. This is a valid approach?

As far as as composite resources and roles, it seems like maybe you would use these two implementation methods together. You could build a composite resource to say build a web server and then assign a role to a node to apply the web server resource. Would this be the correct approach?

Is there some kind of scaffolding that is common to build out something like this?

I've looked at https://github.com/Microsoft/DscScaffolding and https://github.com/gaelcolas/DscInfraSample, but as far as I can tell, the DSCScaffolding repo doesn't use roles and the DscInfraSample seems like it uses roles, but I couldn't really get it to build, so wasn't able to really to see what it's actually doing.

My main question is, what is the best way to approach Powershell DSC and how do you best organize your configurations for the real world so that it is maintainable?


I use it in my job to apply configurations to Linux (CentOS) and Windows Servers. I use the push configuration method and the 'ApplyAndMonitor' mode.

Basically I build a module called DSCTools, and a separate configuration function that has the actual configurations in it.

DSCTools does the following: -takes a Computer Name parameter -checks against Active Directory, or manual typing, to get the attributes of that computer. (ie, is it a Linux SFTP server, is it a Windows File Server) -checks if modules need to be installed on the remote computer before applying the configuration -creates the MOF file -pushes the configuration

the Config is basically a giant function that, in my work, is a PS1 file that is about 3000 lines long. I use Visual Studio Code and code folding to collapse it (Ctrl+K and Ctrl+0), and then at a high level I can see all the different types of servers.

By keeping it all in the same config, I can have statements like 'All Nodes that are not AD servers get this' and 'All Nodes that are AD servers get this'.

In the future, I plan to separate the Linux and Windows Configurations into two separate files because they don't share much in common. Also keep in mind Linux does not support partial configurations yet.

For Windows, multiple configurations can be helpful. Like you could have a 'baseline' config that all servers receive, and then a separate 'Security' config that has your CIS/DISA-STIG compliance configurations.

then I have a seperate logging tool that checks Powershell DSC Operational logs for failures. that will let me know exactly what setting I specified is not in compliance. For example, perhaps a developer went in and deleted a configuration file or a registry setting.

I also do versioning using a basic file share repository and I'm able to see how the configuration has changed over time.

I spent the last 2-3 years learning Powershell, and DSC, and it's super helpful in my job to manage everything and a lot faster.

  • that's interesting. I do like the idea of using active directory to pull information. I've seen articles where people create databases to pull information into their scripts to do this. It may not be so bad to use active directory as your database for this and just modify the schema. Do you use something to check if modules need to be installed or something custom made? This is one thing that really bugs me with DSC. – Matt Feb 26 '19 at 3:42
  • Yeah when I do push configuration I have a function that parses the Import-Resource commands at the top of the Config function, and then does a compare-object against what's on the server already to determine what's missing. I could send you the function, or the whole Module I wrote. I use Active Directory and the Computer Name itself to determine the role.... for example 'Server-FS1' I configure to have a property of 'FileServer' and use that in my config. – ErikW Feb 26 '19 at 5:17
  • Yeah, I found an article that created a custom database to basically put all that information in there. So that you can assign roles based on a node. Although, it seems like you want to assign GUIDs to nodes so that you can treat them as cattle and not pets. I'm still looking further into that, but makes sense. – Matt Feb 26 '19 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.