Powershell DSC has a slightly steep learning curve – from the beginning, it is not that straight-forward to figure out how to read logs, how to trigger a consistency check or how to get updated configurations from the Pull server.
After building LCM.meta.mof file, you need to apply it to the machine – so that it enrolls itself with DSC PullServer and determines which configuration states to pull and apply. In fact, LCM is the heart of DSC on each node – and it requires some special treatment in order to deliver predictable results. So, to start with LCM, you need to point DSC engine to the folder where .meta.nof of LCM is stored and register it in the system. This works as follows:
Set-DscLocalConfigurationManager -Path PATH_TO_FOLDER
As far as I noticed, starting from Powershell 5.1 update, this command automatically pulls the resources from Pull server. Previously, it was necessary to trigger the resource update without waiting for the standard DSC consistency check interval – 15-30 minutes.
Update-DscConfiguration -Verbose -Wait
This command also comes handy when there was an update to resources in the server (a new configuration state was uploaded or a PS module version got updated).
When we want to start DSC consistency check (don’t mix it with Update-DscConfiguration, the latter only updates resources, it doesn’t run the consistency check) without waiting for the DSC scheduler to do it for us:
Start-DscConfiguration -UseExisting -Verbose -Wait
After updating resources, registering LCM and starting DSC check, we need to check the status. Here comes the trick – first we need to make sure that there is no consistency check in place – otherwise, we can’t get the status of LCM. So, we run:
Get-DscLocalConfigurationManager
This command returns a bunch of parameters – where we are mainly interested in LCMState.
Get-DscLocalConfigurationManager | Select-Object -ExpandProperty LCMState
It can be either “Idle”, “Busy” or report inconsistent configuration which leaves the LCM in a blocked state. When it is “Idle”, we are good to go – and check the actual result of applying a configuration State pulled from the Pull server.
Get-DscConfigurationStatus
The outputs are either “Failed” or “Success” – and this gives us an answer to the question whether the machine is in the desired state or something went terribly wrong.
And the last command – how to get rid of the DSC configuration:
Remove-DscConfigurationDocument -Stage Current,Previous,Pending
DSC stores two configurations for LCM – current (the last applied) and previous. When it ends up in the “pending” state, most likely, you have a problem with your LCM or State. After using this command for clean up, you may go and set updated LCM.
Cloud Application Security 
1 Comment