getting started with powershell desired state configuration...

Getting Started with PowerShell Desired State Configuration (DSC) Jump Start

Q&A Log

Live Event Date: February 25, 2015 of 23 DISCLAIMER: This information is provided to you for informational purposes only and is provided “as is.” Microsoft has not reviewed the information and it may contain inaccuracies. You bear the risk of using it. Microsoft makes no warranties, express or implied, as to the information.

08:36:36 PST

Question: Good morning! or well, its 6 in the evening here in DK

Answer: hi, I am in DK too

08:51:04 PST

Question: Will the session be recorded ? One of my colleagues can no longer attend but wanted to. If so, how much

of a delay ? Answer: yes it is indeed

08:51:56 PST

Question: Should there be any video at this point? I just see a spinning circle. Using Firefox Answer: yes there are some slides showing, no audio yet - starting in 8 mins

08:52:45 PST

Question: Can we get an audio check just to make sure we have sound. Answer: there is music - can you hear it?

08:58:02 PST

Question: Do we get some kind of timeschedule to be able to plan the evening/night? Answer: yes, see the Schedule tab NeXT to the FAQ tab

09:13:15 PST

Question: Already dreading figuring out polling intervals? Answer: it's in meta configuration, configuration for the DSC engine. Jeffery will cover it soon

09:19:11 PST

Question: Is there a benefit to booting a server with almost no services started and then kicking off DSC to bring

everything up in the most efficient manner? Answer: Absolutely... It can be very useful to boot a server directly into DSC.. When you do this, you "know" what the

system is from the very beginning. We show cases where we want to bring up servers more securely. In those cases we use DSC to lock everything down; then only open up particular capabilities. Since it is "enforced" regularly it substantially reduces errors and risk.

09:19:16 PST

Question: If a virus makes changes to a system config is there an alert we can set to let the admin know that a

particular configuration has changed too much many times to trigger deeper troubleshooting? Answer: we don't have it right now, but that's an interesting scenario to consider


Q&A Log


09:26:13 PST

Question: will there be any information to compare / contrast this against the Compliance Settings abilities of System

Center Configuration Manager Answer: SCCM is mostly focused on enterprise client management. PowerShell DSC is more focused on Cloud OS

Servers. SCCM is more of a solution. DSC is first and foremost a platform. Similar to PowerShell Cmdlets, we expect overtime for more and more Microsoft and external products to layer over the DSC platform.

09:27:46 PST

Question: With DSC for Linux, I have hopes rising Answer: DSC on Linux raises all our hopes! Of course, we are just really beginning to embrace Linux as a company

at Microsoft. I expect to see many good things come of this.

09:30:36 PST

Question: Can we practice with exercises during the session? Answer: Jeffrey shared info and it will be shared again on where you can get the scripts and install WMF5 to follow

along.

09:31:24 PST

Question: Talking of inter interoperability, I would love to see the PowerShell Linux implementation (PASH) getting

some love. Answer: Linux will be covered (in some capacity) later in the course.

09:31:56 PST

Question: Linux and Network switches, (routers?) I hope to see it on all platforms. Answer: stay tuned. cool stuff on network switches....

09:37:28 PST

Question: Are maintenance windows planned? That's really going to be important in our architecture. Answer: The latest WMF preview introduces some new capabilities for other tools that leverage DSC resources.

Even if the built-in functionality doesn't support maintenance windows, you can potentially get that from another tool such as Chef.

09:41:56 PST

Question: It sounds like DSC will replace some use cases for Group Policy, but across platforms. Ex.: services

on/off. Is the Windows Server strategy to go to DSC instead of Group Policy? Answer: GP is a highly used (i.e. successful in terms of benefit and reuse) AD-based solution to manage enterprise

client settings. PowerShell DSC is still more focused on servers. DSC is about making it much simpler to manage many servers in a consistent way without depending on AD.


Q&A Log


09:42:24 PST

Question: I'm just learning DSC. When setting up a configuration script can it tab-complete items within

WindowsFeature? It seems to be able to tab-complete the Properties, but not the names of the properties. Answer: it should be able to tab complete using recent WMF's

09:44:58 PST

Question: Can you create a local repository? If we have our own software and we wanted to deploy this per server. Answer: You will be able to create a local repository; that is you will be able to point psget to a local repository. in this

way you can host your own set of resources and go there directly.

09:46:41 PST

Question: i just wish the wmf was available for win 7

Answer: Keep asking... you may eventually get what you want... of course WinServer 2008 R2 might come first

on the list

09:48:25 PST

Question: I don't see a way to download the MVA Modules. When I attempt to sign in, it says that I need to send an

email to get added. Answer: Use the Install-Module command on a system that has the WMF 5 Preview.

09:50:51 PST

Question: Are there any best practises available that describes how to do "nested configurations"? Let's say we have

a "standard server baseline", but some other servers have the IIS aswell and therefor needs the "IIS baseline addon" on top of that. Is there a way to nest these configurations in a simple and manageable way rather than just copy/paste the same config multiple times to generate the MOFs? Answer: you can use composite configuration, I think Jeffery will cover them later

09:53:23 PST

Question: ah, it wants a restart after the WMF Preview 5. I will lose the video. Answer: you can re-join

09:53:24 PST

Question: is DSC capable of configuring bios/uefi settings for our many clients ? or maybe this will already be

covered in this jumpstart Answer: It is a functionof the RESOURCE providers that people write. I don't think that I've seen those.

09:53:56 PST

Question: How soon will these sessions be posted for viewing later? Answer: as soon as possible... we'll let you know. (usually in a couple of weeks)


Q&A Log


09:56:19 PST

Question: Who is the artist for this music? Answer: one of the leading elevator musack artists of 2014.

09:57:34 PST

Question: after installing vmf5.0 still can not find install-module Answer: VERYIF that $PSVERSIONTABLE shows 5.0.10008.0

09:59:19 PST

Question: Sorry if this is a dumb question (I'm totally new to this), but drifting was mentioned: once everyone is more

familiar with DSC, do we imagine that drifting will occur within DSC itself or is there auditing or some other method to prevent that? Answer: there is auditing that can be used as well as a central storage of DSC configs - to prevent drift.

10:00:10 PST

Question: Says this Gallery is under limited preview Answer: you are correct - it is in preview.

10:02:36 PST

Question: Thank you to all of our moderators today. Thumbs up!

Answer: we're trying... you want to help? look me up in the GAL (rclaus)

10:03:00 PST

Question: ok, think I have day 1 installed, what do I do next?

Answer: wait for the guys to talk about stuff that references it.

10:05:15 PST

Question: DSC is slated for the Common Engineering Core, if I recall correctly? If this is the case, are there plans to

ensure DSC Resources are made down level compatible? When standardizing on a configuration management platform, the ability to configure all systems is incredibly important... Yet I see occasional DSC Resources using OS-Specific Cmdlets that could have been written with down-level compatibility... Would love to see this practice nixed. Answer: this is a great point

10:08:25 PST

Question: What was the DEVOPS term Jeff said in the beginning RESPECT something? Answer: reality


Q&A Log


10:09:23 PST

Question: sent to Team: We need a statement from Jeffrey for SCCM / SystemCenter and DSC... NO FUTURE

LOOKING STATEMENTS, but it has come up. Answer: Will do

10:20:10 PST

Question: Is there a way to install Visual Studio 2012 Premium via PowerShell? I know Chocolatey has some

modules to install a trial, but I have not seen anything else. Answer: do you mean installing using DSC? current it need some extra work because DSC is running in system

context and installing VS need a user profile so you have to create customer resource to do it

10:22:21 PST

Question: can dsc create a config based on current system/role/feature setup? like if someone changed something

(for the better) but didn't say what, can dsc detect what it is? Answer: DSC can't create a configuration based on a current system state and it will only detect changes to

components defined in the current DSC Config, so if a change is made to a component that you haven't defined in the Config, it is not detected.

10:23:48 PST

Question: In v4 dependencies on composite resources don't work, for one Answer: yes, it should be working in WMF now, otherwise, please open a connect bug. thanks

10:25:19 PST

Question: Does anyone have the powershell commands to grab those modules shown earlier? Answer: Find-Module mva | Install-Module

10:27:07 PST

Question: Where can I download the scripts that Jason is working with? Answer: you can get the content from the powershell gallery located

here https://www.powershellgallery.com/packages?q=mva ...

10:32:15 PST

Question: DSC is really cool, but many of the modules are marked x-perimental. Will they be supported in the

future? And WMF5 is preview as well for a while, will it be officialy released with windows server 10? Fully supported makes it easier to 'sell' to my boss Answer: In the past Jeffrey has said that some will get moved to final in the next release, others will remain

experimental.

10:32:36 PST

Question: Solution for 8.1-pro was to install en-US lang pack, now I can do install Answer: great info

https://www.powershellgallery.com/packages?q=mva


Q&A Log


10:34:21 PST

Question: You can also easily create ISE snippets for DSC

resources http://www.powershellmagazine.com/2014/03/25/pstip-create-your-own-dsc-resource-snippets-in-powershell-ise/ Answer: Thanks, Alexandair.

10:34:48 PST

Question: That Get-WindowsFeature | ogv is a great tip. Much easier to view. Nice tip.

Answer: +1000000000

10:34:55 PST

Question: Can you wildcard Insure Absent, to say that you explicitly don't want any feature not set to Insure Present? Answer: it doesn't support wildcard right now

10:36:47 PST

Question: Is s1 a remote computer on premise or can it be on cloud? Answer: it can be any computer as far as you can reach it using cimsession, we have used it in azure extensively

10:37:07 PST

Question: how to get the powershellGet on the WIn2012R2 fresh installed ? Answer: PowerShellGet is installed with WMF 5.0 Preview. You would need to install this onto your fresh install,

however please remember this is not supported in Production just yet!

10:38:09 PST

Question: Is it also a requirement to have IIS installed on the client servers? Answer: IIS is only required on the DSC Pull Server, the DSC Clients do not need IIS

10:38:15 PST

Question: Is Get-TargetResource ever used? Answer: Only with Get-DSCConfiguration

10:38:40 PST

Question: Is it possible to get the ise scripts they are using? Answer: all available on the PSGallery name = MVA*

10:39:07 PST

Question: What happens if a configuration change does need a reboot? Especially when using ApplyAndAutocorrect

? Answer: if you allow auto reboot then DSC will reboot

http://www.powershellmagazine.com/2014/03/25/pstip-create-your-own-dsc-resource-snippets-in-powershell-ise/

http://www.powershellmagazine.com/2014/03/25/pstip-create-your-own-dsc-resource-snippets-in-powershell-ise/


Q&A Log


10:39:33 PST

Question: Is it recommended to run WMF5 in production or should we wait until there will be a final version? we have

some internal discussions on whatever to begin and use it in a large production environment or wait... Answer: WMF 5.0 is not currently supported in Production. Please wait for the final release before deploying to

Production Servers.

10:41:33 PST

Question: My company block access to Oneget.org, is there another way to get the nugget binary required for

powershellget to work? Answer: NuGet is only downloaded if it is not already present on the system, you should be able to download and

install the client another way first so PowerShell doesn't try to do so

10:45:05 PST

Question: Am I the only one buffering like crazy? Answer: My steam is fine on the east coast of US.

10:45:11 PST

Question: no matter what I do on my Win 8.1 Pro box I can't bet WMF 5.0 Preview to install. Getting The update is

not applicable to your computer (WindowsBlue-KB3037315-x64.msu) what am I doing wrong Answer: Please ensure you have the .NET Framework 4.5 installed first

10:45:45 PST

Question: If we have existing CM servers that aren't running IIS, can you still do pull configs? Or does Pull config

require IIS? Answer: the pull server we shipped requires IIS, however it is just simple REST request and you can implement

custom pull server, but that requires more work

10:47:44 PST

Question: Can you please let me know what is the ultimate objective of DSC and all scripts, is it for local deployment

of VMs on on Hyper-V or is it more than this, I have already asked 3 questions till now no response. I would like to understand in which DevOps scenario/context all this stuff can be useful Answer: you can use DSC for multiple VMs, so it can be used as a platform for DevOps to do testing/deployment

and release managment

10:49:42 PST

Question: What about legacy OS's, Windows 7 and Windows Server 2008 R2 for example. Will DSC be able to push

to those environments? Answer: These OS today can use WMF 4.0. Later WMF 5.0 will be available for them.


Q&A Log


10:51:09 PST

Question: vNiklas, I'm in sweden too, sadly I have to keep swapping between hq and sq to get it to start again after

stopping :/ Answer: have not had any issues yet..

10:52:29 PST

Question: Yes! I needed to hear WMF 5 would be available for Windows 2008 R2. It's not like we want to run old

OS's forever, but we have our own internal upgrade cycle to deal with. And in the mean time it's good to hear that DSC can be leveraged to its full capability. Answer: Listen to the PowerScripting Podcast with Jeffrey Snover a couple months back. He discusses this

specifically.

10:55:26 PST

Question: Ashley your powershell video with AD forensics was amazing Answer: Thanks. We had fun doing it. http://aka.ms/MVAPSAD

10:56:14 PST

Question: My understanding from that podcast was yes WMF 5.0 would run on Win7 / 2008-R2 Answer: ...eventually. Not during the preview to my knowledge.

11:02:18 PST

Question: Coud someone say when WMF will be released? is it weeeks, months, days? ) Answer: It will be released along with Windows 10, which isn't set in stone yet but should be this Autumn ish.

11:03:18 PST

Question: Can I deploy a DSC configuration with MDT LTI from media? Answer: Yes, you can deploy a DSC Config from Media using LTI (I have done this with some customers

previously), this would be a Script step in the task sequence and would be a Push operation.

11:05:48 PST

Question: I know that this is designed more for devops and server configuration, but would it also be possible to use

DSC for client computers in your company? Any intention of adding the "WindowsFeature" for windows 8.1 moving forward? Answer: Yes, Clients are a great candidate for DSC! Especially as it allows you to reset the configuration if the user

messes with it. Any windows machine with Windows Management Framework 4.0 or above can apply a DSC Configuration.

11:09:38 PST

Question: wooot Swedish chef on stage Answer: Yah sure - you betcha

http://aka.ms/MVAPSAD


Q&A Log


11:17:04 PST

Question: "x" = this means this configuration is experimental... correct? Answer: yes, the x means that the resource still might change before being shipped. You can use them at work, but

expect them to change.

11:19:10 PST

Question: Bugs / feedback for experimental resources goes in Connect, right? Answer: Yes, post those here. And vote up other things you want to get

attention! http://connect.microsoft.com/powershell

11:23:33 PST

Question: Are the MOF documents encrypted similar to securestring with powershell which is tied to the generating

user/system key pair, or something different? Answer: The credentials get encrypted using the certificate private key. Stay tuned...

11:38:37 PST

Question: I can not imagine not support window 7 from WMF5.0. WMF4 support that. Do keep in mind, mojarity of

enterprise will stay with window 7 for long time. Answer: @John - Yes, we intend to support WMF5.0 on Windows 7 and Windows Server 2008-R2.

11:39:15 PST

Question: When will this recording be posted? I am missing most of this right now (Internet issues) Answer: Recordings are posted about 3 weeks after the event

11:40:26 PST

Question: Does this support 3rd party certs as well? Jason mentioned a PKI server, but if this is supposed to be able

to work with any OS, I assume the answer is yes to 3rd party certs. Answer: Yes. Just need to be able to verify the cert.

11:49:54 PST

Question: Do we have to change WSMan MaxProcessesPerShell to support high number of parallelism for DSC?

[[REPLY:]No - that is an inbound control not an outbound one

11:50:02 PST

Question: Any support for time travel in PS6? Answer: We all hope very very much

http://connect.microsoft.com/powershell


Q&A Log


11:51:28 PST

Question: engineers that don't know powershell juts know it as something very powerful and its scary to

management.. manager sees benefits.. but scared about the power lol its strange dynamic Answer: Just tell them that I said it was OK to use.

11:52:07 PST

Question: When is this nonsense of having to zip up modules and move to the right location on a pull server going to

go away? Automate it! Answer: That is exactly what a product would do.

11:52:23 PST

Question: I would settle for Get-Lamp Answer: I love lamp!

12:00:04 PST

Question: I understand that you need to set the execution policy and enable remoting on the servers you want to

push the DSC configuration. What happens if you want to bootstrap a configuration to a newly created VM in Hyper-V? For example, in Azure, before you create a VM you can assign it a DSC extension so that it will have that desired configuration after the installation. I also have some questions about networking (if I use a private or internal switch) and how do I preinstall DSC modules on those VMs ... Answer: @Razvan - You can inject the configuration (and related resources) in the VHD or setup the meta-

configuration (LCM engine setting) to talk to a pull server and schedule a boot-up task

12:00:33 PST

Question: > Quoted question: I understand that you need to set the execution policy and enable remoting on the servers you want to push the DSC configuration. What happens if you want to bootstrap a configuration to a newly created VM in Hyper-V? For example, in Azure, before you create a VM you can assign it a DSC extension so that it will have that desired configuration after the installation. I also have some questions about networking (if I use a private or internal switch) and how do I preinstall DSC modules on those VMs ... > Quoted answer: @Razvan - You can inject the configuration (and related resources) in the VHD or setup the meta-configuration (LCM engine setting) to talk to a pull server and schedule a boot-up task Answer: Link to the blog post for the same - http://blogs.msdn.com/b/powershell/archive/2014/02/28/want-to-

automatically-configure-your-machines-using-dsc-at-initial-boot-up.aspx

12:06:16 PST

Question: You guys are rocking it! Answer: Thanks!

12:15:42 PST

Question: Kickstarter campaign to get Jason some new neurons. Answer: LOVE IT

http://blogs.msdn.com/b/powershell/archive/2014/02/28/want-to-automatically-configure-your-machines-using-dsc-at-initial-boot-up.aspx

http://blogs.msdn.com/b/powershell/archive/2014/02/28/want-to-automatically-configure-your-machines-using-dsc-at-initial-boot-up.aspx


Q&A Log


12:16:25 PST

Question: Thank you for the answer! I have one more question, please. So, after you defined a new configuration,

you are calling it using the -ComputerName parameter. This generates a .mof file for each of those computers. After that, if you want to push the configuration, you run Start-DSCConfiguration which points to those .mof files but you also specify a -ComputerName parameter. So that last command uses .mof files for different computers, but you also specify on which computers to push the configuration. What is the right procedure here ? Or what is the connection between these two computer lists ? Answer: Start-DscConfiguration takes a path to a folder containing mof files. If you don't specify any computername

to Start-DscConfiguration, it will apply all the mofs to appropriate computers (file names are <computername>.mof). By specifying -computername, you are picking a specific file from that folder.

12:18:14 PST

Question: so computername should not have any dots in it, right? Answer: Jason put his clothes back on so not much

12:20:12 PST

Question: I've been away for 10 minutes, what did I miss? Answer: You only missed how Snover showed how he could use only his mind (no keyboard) to create a new

PowerShell DSC script.

12:22:59 PST

Question: How Apply and Auto Correct react ? Answer: @Chen - Apply and autocorrect will continue to apply the mof present on the system. It will write to windows

event log of its action. In your case, it will continue to fail. In WMF5, you have Get-DscConfigurationSTatus cmdlet which will also tell you that configuration is failing every time consistency check is run

12:25:12 PST

Question: let me explain in detail I create a MOF for installing IIS and some one make MOF for Un-installing IIS -

How Auto Correct Works declarative? Answer: In a configuration, you CAN NOT have both IIS install and uninstall. There cannot be 2 resource instance

with same key property - WindowsFeature key property is Name

12:34:12 PST

Question: is there a test-dscchecksum cmdlet planned for the future? Answer: Good feedback. Please file the request through connect site http://connect.microsoft.com/PowerShell.

12:34:20 PST

Question: is there a test-dscchecksum cmdlet planned for the future? Answer: We have a GET-FILEHASH which you could use to write a TEST-CHECKSUM

http://connect.microsoft.com/PowerShell


Q&A Log


12:35:05 PST

Question: can you set multiple repositories Answer: YES

12:35:33 PST

Question: Why HTTP and not HTTPS... you want to send the config info and content sent in the clear?? Answer: Just for a lab, you'd use HTTPS for real

12:36:32 PST

Question: Why doesn't running config not create a checksum automatically ? Answer: Because checksums are only used in a pull scenario.

12:55:21 PST

Question: do you have to have wmf 5 to use install-module? Answer: Yes

13:02:03 PST

Question: How about a switch that will generate the checksum file with the MOF? Answer: Switch on what cmd?

13:05:25 PST

Question: Where is the PowerShellCookBook? Not on my box. Answer: Install-Module PowerShellCookbook

13:08:24 PST

Question: First Question: Will the next version of sccm (vnext) leverage powershell dsc? Second Question: Is

Microsoft planing to release a tool for DSC like chef or puppet. Answer: No Announcements today.

13:08:42 PST

Question: I'm assuming the powershellcookbook was made by a Chef proponent. Answer: Can't really say how Lee feels about Chef, but PowerShell Cookbook is a book written by Lee Holmes, one

of the developers of PowerShell.

13:09:09 PST

Question: Curious if there are any plans for WMF5 to be supported on Win7/2008r2? Answer: No promises but that is the intent


Q&A Log


13:10:18 PST

Question: Can I please have the URL for the slides and code? I just missed it Answer: https://www.powershellgallery.com/packages?q=mva

13:10:30 PST

Question: I would use HTTPS in a lab too. Wouldn't you want to know how the configuration works before deploying

it for real? Answer: Totally agree -- but I want to make sure people can setup an easy way. Not everyone is good with the PKI

stuff

13:10:58 PST

Question: is the WMF 5 work on Win10TP ? Answer: Nope. Most of the functions are already on W10TP

13:11:06 PST

Question: WMF-Feb isn't supported on Win10? Answer: Nope. Most of the functions are already on W10TP

13:11:20 PST

Question: will there be any information to compare / contrast this against the Compliance Settings abilities of System

Center Configuration Manager (SCCM 2012 R2) Answer: No

13:11:21 PST

Question: Can you combine multiple DSC configs to create a composite configuration? The output of which would be

a MOF? I haven't made the connection yet how a node can have more than 1 duty assigned Answer: There are two approaches you can take here. WMF 5 is introducing a new feature called "Partial

Configurations", which allows the LCM to process multiple MOF documents. (Some details on that here:http://www.powershellmagazine.com/2014/10/02/partial-dsc-configurations-in-windows-management-framework-wmf-5-0/ ). Alternatively, you can write your configuration script so that it has logic to figure out which resources get applied to which nodes, and it'll just compile all of the necessary MOF files for you. (So rather than merging MOFs, you compile copies that have the various combinations of resources included in a single file.)

13:11:52 PST

Question: where i can take those slides, if possible? Answer: You will be able to download them from the MVA site -- or you can get both the slides and scripts from the

powershell gallery

13:12:12 PST

Question: And ability to run DSC against Win7/2008r2? Answer: Intent is there but the code isnt'

https://www.powershellgallery.com/packages?q=mva

http://www.powershellmagazine.com/2014/10/02/partial-dsc-configurations-in-windows-management-framework-wmf-5-0/

http://www.powershellmagazine.com/2014/10/02/partial-dsc-configurations-in-windows-management-framework-wmf-5-0/


Q&A Log


13:13:01 PST

Question: Me self and the Swedish chef will have to leave now for some sleep.. Thanks for a great show/session so

far! Answer: Thanks

13:13:05 PST

Question: got an error when going for the install-module, so i too need the WMF5? Answer: yes

13:13:15 PST

Question: What was the name of the module of tools that was just imported? Answer: Import-module PowerShellCookBook

13:13:58 PST

Question: when the .mof is generated by the powershell, generate the checksum at the same time Answer: I see. That's a good idea.

13:15:54 PST

Question: Have you talked about distributing the resource to nodes next? I see the comment above that there is a

way to automate other than zipping it and put it where the MOFs are manually. (My case SMB Pull) I am not sure if you already touch that topic. (I am at work...) Answer: There will be much more on this in tomorrow MVA

13:17:46 PST

Question: In order to have DSC work, should we have PowerShell 5.0 on all nodes? or the node that pushing in

other nodes? Answer: v4.0 or above on all nodes -- however many of the new features you are seeing are currently only in the v5

feb preview release

13:19:13 PST

Question: So far a great jump-start. Thank you, guys. Staying alive for more than 14 hours already, but can't leave

without a Linux part Answer: Good! -- but remember there is also going to be a recording and I'll give you all the code -- but it will be

worth hanging out

13:19:17 PST

Question: Can we expect to get Show-Object as a built-in cmdlet? Answer: As PSGET makes things easier to pull from galleries, you'll see more things delivered and updated faster

that way than included in the box.


Q&A Log


13:19:53 PST

Question: is DSC meant to replace workflow? Answer: No. Most sophisticated multi-machine configurations require both to succeed.

13:20:10 PST

Question: I've written a blog series of Azure Pack VM roles utilizing web DSC pull service with client auth certificate

authentication and MOF sensitive data encryption. PKI, WAPack, PSDSC. Step by step explanation and setup. See:http://www.hyper-v.nu/archives/bgelens/2015/02/integrating-vm-role-with-desired-state-configuration-part-1-introduction-and-scenario/

Answer: This is awesome by the way!

13:20:20 PST

Question: (what cmd?) - It's hard to find the words for these things. You define a Configuration. When you invoke the

Configuration it generates the MOF. It would be nice to add -CheckSum. (Lol! It's not really a cmd) Answer: Good idea

13:20:36 PST

Question: I am from India unable to watch the event due to slow internet speed and it is late night. Have to go work

on day. Answer: THanks for joining us

13:20:58 PST

Question: We need Windows 7 support WMF 5.0. It is a Must !!!! =( Answer: I hear you. That is the intent.

13:21:23 PST

Question: can you install powershell cookbook module on other than WMF 5? Answer: YES. It goes way back

13:22:46 PST

Question: Speaking of PowerShell workflow, how is that connected with Windows WF? The two play together, right? Answer: PowerShell workflow is a PS authoring and hosting experience for Windows Workflow

13:23:36 PST

Question: hi, i may have missed the response if it was asked already, but is there a release date for WMF 5? Answer: We ship an active branch version every few months. It will also be included in the next versions of client and

server.

http://www.hyper-v.nu/archives/bgelens/2015/02/integrating-vm-role-with-desired-state-configuration-part-1-introduction-and-scenario/

http://www.hyper-v.nu/archives/bgelens/2015/02/integrating-vm-role-with-desired-state-configuration-part-1-introduction-and-scenario/


Q&A Log


13:24:43 PST

Question: when running the Start-DscConfiguration, does the target system require the WMF 5.0 as well? I am

assuming that it does... Answer: No - it just needs to implement the standards. We'll show that with the Linux support at the end of the day.

13:26:34 PST

Question: Is there a way with DSC to create the MOF and load it onto a computer by hand and run a powershell

script to setup the device based on the MOF or do I need use a seperate server? Answer: Yes - I think we cover this in tomorrows Advanced session. You can take a MOF and copy it to a machine in

Windows\System32\COnfiguration\Pending.Mof and LCM will run it.

13:27:52 PST

Question: Thanks Jeffery. So the "production" release will be with the next version of Windows? Answer: People are using the WMFs "in production" today. You just need to be aware of what will and won't change.

13:32:15 PST

Question: A good DSC book is also DSC Revealed by Ravikanth Chaganti Answer: agreed

13:43:11 PST

Question: Any insights on a good versioning system for the config files? in large production environments it's a must

to know how machines are configured and what the history was. can i intergrated it somehow with a sql database? Answer: That's where tooling on top of DSC will come into play. What we've been working on at my company is

integrating with Octopus Deploy (which we already use for other things); the DSC configuration becomes part of a NuGet package that Octopus manages, and that allows us to see what version is deployed to which environments (and also promote versions through dev / test / prod using the same mechanism as our custom applications.)

13:43:59 PST

Question: since the configuration keyword is similar to function, can you use logic structures to customize the mofs

generated? Answer: Yes! Great question! Configurations are just executable PowerShell code that happen to contain a few

DSC-specific keywords. You can have conditionals, loops, variables, whatever you need in order to make the configuration generate the proper settings in a MOF file.

13:45:39 PST

Question: Could you talk a little bit about encrypting password or do I need to use certificate signing script? A lot of

document showing with plain text but I have not seen the document of the best way to do it in production. Answer: Great question -- and we will in tomorrow advanced MVA


Q&A Log


13:46:16 PST

Question: @Sirirako: Password encryption has a few required steps. You have to install a certificate (with the private

key) on the node that's going to be configured; the certificate should be in Cert:\LocalMachine\My\ . You have to configure the LCM on that computer with the thumbprint of that certificate. Then, when compiling your MOF document, you need an exported (public only) copy of that certificate. You use the -ConfigurationData parameter, and in the configuration data, you need to set the "Thumbprint" and "CertificateFile" properties on the node's hashtable. When all of those requirements are met, the machine compiling the MOF file will automatically encrypt any PSCredential objects that are passed to the resources, using the public key of the certificate. The LCM will use the certificate's private key to decrypt those passwords when it applies the configuration. Answer: To add on to Daves comment -- we will be doing this tomorrow int eh advanced MVA

13:46:47 PST

Question: Is DSC Revealed good for DSC noobs? I've missed out on a lot of today so far because work got in the

way.. Answer: There will also be a recording of this event -- so it will be available soon!

13:48:04 PST

Question: As a fan of the series, I'm wondering.... any plans to make a "DSC in a Month of Lunches" book Jason I'm

looking at you.... Answer: No more books - publishing takes too long -- but PowerShell.ORg will have a new ebook that you will be

able to get -- better, faster, cheaper -

13:50:36 PST

Question: Jason, i think i missed a section today, how do i get the "Install-Module PowersshellCookbook" ? Answer: You will need the WMF 5 feb preview -- or, you can go tot he PowerShell Gallery website

13:50:52 PST

Question: you haven't scripted the book writing process yet? I am surprised LOL, jk

Answer: HA! I've tried

13:51:32 PST

Question: @Jason Helmick Ah, but will the ebook be updated?! Answer: Things have been moving fast with DSC -- wanted to get closer -- which I think we are -- so I'll get to it.

13:56:07 PST

Question: So when is System center going to provide us the tooling to create and manage DSC easily? Answer: No announcements.

13:56:58 PST

Question: If I have SCCM, may I still want to use PS DSC? Answer: DSC provides much greater control for a DevOps workflow for servers.


Q&A Log


13:58:30 PST

Question: Is WMF 5 going to be "fully baked" when Win 10 is released? or not until Server 2016? Answer: Whatever we ship in the OS will be fully baked.

14:10:45 PST

Question: how do you get all those ps1's loaded again? Answer: If you are using WMF 5.0 Preview run: install-module mva*

14:18:02 PST

Question: Do we have DSC resource to create a folder and set NTFS permission? We are trying to do it ourselves

but ... Answer: file resource should do it it can create directory,

14:26:16 PST

Question: I'm asking b/c the command "PS> Install-Module -Name MVA_DSC_2015_DAY1 " is stated as the only

way to get the modules, but when I build my lab machines by default I don't allow global network access Answer: YOu can get them on one machine and copy them via a USB key to another

14:34:13 PST

Question: The biggest problem I've had with the script resource is that Get, Set, & TestScript requires a string and

not a script block. Answer: you can use script block for get/set/test, actually that is preferred, unfortunately we already support string so

don't want to remove the support

14:37:28 PST

Question: This is great, BTW! Love that the inventor is so "about the invention". Bow down, all hail Jeff Snow...Bow

down! How does this stack up (compare/what's the future) with Clustering? Answer: Clustering and DSC are orthogonal tools. One of the things you can do is configure clustering with DSC.

There are DSC resources in the Reskit (which we'll talk about in a minute) that do that.

14:41:16 PST

Question: @Keith Bankston: Cheers! Thanks for that. I actually meant about using DSC as a Clus monitoring tool... Answer: Tougher question, but similar answer. They are really separate tools that work together. DSC will monitor

the configuration of the system, Cluster will monitor the health of the set of systems that are in the cluster.

14:41:31 PST

Question: Are these waves cumulative? Answer: Yes.


Q&A Log


14:43:24 PST

Question: How do you update a reskit? Can it be automated? Answer: If you are talking about how to update your local copies of the resources in the Reskit, the BEST route is to

leverage Find-Module & the gallery.

14:48:47 PST

Question: (correcting slow fingers effect) Could anyone please be so kind to tell me/us where to find more details

about the PS ResKit that was just mentioned ? :-o Answer: Start here: https://gallery.technet.microsoft.com/DSC-Resource-Kit-All-c449312d

14:49:56 PST

Question: If you are authoring a resource and update the pull server, will the LCM get the latest version

automatically? Answer: Yes, LCM will retrieve the updated resources and configs.

14:51:02 PST

Question: what if you have an updated resource on the pull server, would the DSC pull in the new one? Answer: Yes. If you publish the updated resource module to the pull server, the nodes attached to it will get the

update.

14:51:38 PST

Question: sent to Team: Please clarify the "page fault" concept there, Jeffrey. Answer: Basically in a PUSH scenario if a resource is not on the target box but it's needed the resource will be

downloaded and installed from the download location.

14:52:06 PST

Question: only if a configuration document change is made witch was build with the new resource. configurations are

hard wired to resource versions Answer: Better answer than I gave - good point.

14:56:58 PST

Question: Btw, Some of your Reskit 10 resource scripts for DSC appear to not be signed.

Chrome/Firefox/IEEsc/UAC. Answer: The reskit resources are not signed. These have been published as open-source (MS-LPL license) &

experimental, so we are not signing them.

14:58:34 PST

Question: Ahh, I didn't realize they were open source. That makes much more sense then. Answer: One of the goals with these resources was to provide a huge amount of sample code for people to review &

reuse.

https://gallery.technet.microsoft.com/DSC-Resource-Kit-All-c449312d


Q&A Log


15:00:50 PST

Question: Are you going to cover Web.confg where each env has different settings? Answer: Can you expand on the question a bit so I know I'm answering the right thing? I don't think it's in the

agenda, but there are good TN articles on this area.

15:17:41 PST

Question: Can you create a string[] with the NodeNames and look through it to have one block of statement instead

of 4-10 blocks per node? Answer: There is a different way to do this using * as the NodeName. Any property defined that way will be added to

every entry that contains a NodeName

15:19:24 PST

Question: Can the configuration data be maintained in separate files and "included" or otherwise consumed from a

higher level configuration? The scenario might be for an application's vdir configuration (path, apppool, etc.) in IIS...I want to define it once and include it in dev, test and prod configurations? Answer: ConfigurationData is in essence a Hashtable - which can be constructed. So the answer is "yes"

15:19:44 PST

Question: Can the configuration data be maintained in separate files and "included" or otherwise consumed from a

higher level configuration? The scenario might be for an application's vdir configuration (path, apppool, etc.) in IIS...I want to define it once and include it in dev, test and prod configurations? Answer: Yes! You can even maintain a dev, test, prod set of Config data psd1 files that all use the same exact

configuration document.

15:21:14 PST

Question: Sorry, I meant for the other NodeName where Jeffrey was specifying the computer names and one other

property (I don't recall which). He then copy/pasted that block to have 10 blocks (VM1..VM10). Was wondering if a string[] and property[] would be acceptable for a loop block that would set the variables according to the arrays. Answer: For example, you can loop through configuration data from a CSV or database, and then dynamically create

the hashtable node data at scale.

15:28:11 PST

Question: Is the parameters sample in any of the demo scripts in the gallery? Answer: There's a good example from the Scripting Guy

here: http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/14/use-configuration-file-to-apply-powershell-dsc-to-multiple-servers.aspx

15:38:55 PST

Question: What about order for two things depending on the same thing (like IIS)? Second level? Answer: Two resources can depend on one. However there will be no guarantee of the order of those two resources

unless there is an explicit DependsOn

15:39:04 PST

http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/14/use-configuration-file-to-apply-powershell-dsc-to-multiple-servers.aspx

http://blogs.technet.com/b/heyscriptingguy/archive/2014/03/14/use-configuration-file-to-apply-powershell-dsc-to-multiple-servers.aspx


Q&A Log


Question: Great JumpStart: Thanks: My Question: Will you mention how to depend on resources on other

machines? Answer: The real approach is different, & covered in the Wait-For feature that's in WMF5. Looking for a link.

15:40:43 PST

Question:

> Quoted question: Great JumpStart: Thanks: My Question: Will you mention how to depend on resources on other machines? > Quoted answer: The real approach is different, & covered in the Wait-For feature that's in WMF5. Looking for a link. Answer: They're covering it now!

15:42:35 PST

Question: Link would still be nice! Answer: Found it - check this out: https://technet.microsoft.com/en-us/library/hh857339.aspx, search in the topic for

WaitForAll

15:43:15 PST

Question: I downloaded the DSC Resource Kit (All Modules) mentioned above, doing Get-DSCResource and I can

see all resources are there. I was not able to follow this course correctly, can you please point me to some tutorals or jump starts instructions on using those resources Answer: http://aka.ms/dscrk

15:44:16 PST

Question: In the future can we expect that when we buy Dynamics CRM or Exchange server or some other Microsoft

application instead of getting a 300 page installation guide we will get a 1 page flyer with a single line powershell command to do the deployment? Answer: That would be a great thing to ask the specific product group. We would love for that to be true. For

Exchange, you can check out the DSC Reskit resources, and the articles on it by Mike Hendrickson. For Dynamics, we don't have it yet.

15:48:59 PST

Question: Often when you add a role or feature there are dozens of updates that come down the next night as a

result of that feature. Is there a way to add the updates to the depends on so the feature is truly current before the next feature is added? Answer: I don't know that anyone has solved that in the way you asked. The way that's normally handled is people

either do not check for something that's auto-updated, or alternatively, they update the config to apply the new patch.

15:49:42 PST

Question: I can see a DSC Configdata file being the template where you just fill in a few boxes and hit run. Answer: That is a good way to think about it

https://technet.microsoft.com/en-us/library/hh857339.aspx

http://aka.ms/dscrk


Q&A Log


15:53:50 PST

Question: Will PS Classes provide for inheritance? Answer: (announcer voice) Tune in tomorrow!

15:57:24 PST

Question: @Bill Walter: One could probably build a custom script resource to leverage the Windows Update module Answer: Actually, the reskit has one: http://gallery.technet.microsoft.com/xWindowsUpdate-Module-with-5af00a7f

15:59:31 PST

Question: What's the solution if we can't make the DSC resources as Idempotence ? Answer: This is a commonly-asked question. Idempotence is important in a resource that gets used in a config that

is re-validated. Suggest a script resource. There's another approach described by our Exchange expert, will find a link.

16:00:48 PST

Question: @Keith, the only catch with xWindowsUpdate is that you have to know the list and have the sources. You

may be able to use the PSWindowsUpdate module from the Technet Gallery to build that list though. Answer: Sounds interesting, haven't tried it. Really good point though: the Gallery has everything the Reskit has, and

then some - USE IT.

16:08:28 PST

Question: Thanks @Keith, we can use Script resource but if my commands or actions are not repeatable, what

would be other best solutions? Answer: Speaking heresy for a moment: the way this has been done by Exchange is to use 2 configurations: 1 does

the non-repeatable stuff, the other is the ongoing-state validation. Mike Hendrickson has promised a blog on this, relating to running xExchJetStress.

16:22:44 PST

Question: So out of curiosity, while bits are still running. Does the OMI server need to be added to each linux box or

is it really just for a gateway to send DSC/config over, and can become the linux-side CM, which pushes/changes the configs to other linux systems? Answer: OMI needs to run on each box

16:25:44 PST

Question: If I use RedHat EL, CentOS examples should suffice correct? Answer: It should. The reason this code was open-sourced is if there are changes needed, you can make the

changes you need.

16:26:11 PST

Question: I assume you can set it up do access a pull config with a cronjob, instead of pushing each time? Answer: Currently Pull is not supported in DSC on OMI

http://gallery.technet.microsoft.com/xWindowsUpdate-Module-with-5af00a7f


Q&A Log


16:38:51 PST

Question: Please let me know if my question has been explained earlier. if yes, I will wait for the video. When I use

Update-DscConfiguration, I use -computerName. I just noticed, Jason uses -cimSession. Should I use -cimSession instead of -computerName? Answer: You can use either a computername or a cimsession to talk to a remote computer. When using

ComputerName there are certain assumptions like no SSL, default authentication mechanism, etc. If any of these have to change, then you create a CimSession and use them to communicate

16:42:30 PST

Question: What no Apple devices? Answer: Well, it IS open source. If you wanted to create that...

getting started with powershell desired state configuration...

Documents