DESIRED STATE CONFIGURATION FOR DELL COMMAND POWERSHELL PROVIDER

Transcription

1 DESIRED STATE CONFIGURATION FOR DELL COMMAND POWERSHELL PROVIDER Leveraging the adaptability of Desired State Configuration for managing the BIOS settings of Dell client systems ABSTRACT Desired State Configuration is a framework of choice among IT Administrators for efficient system administration. The framework provides an advanced method to monitor and maintain the configuration settings of client systems. This prevents settings drift that may occur across several systems in a large network. Dell Command PowerShell Provider provides functionality to get and set the BIOS settings of Dell client systems. Dell Command PowerShell Provider 1.2 and later supports the Desired State Configuration framework to manage the BIOS settings.

2 TABLE OF CONTENTS EXECUTIVE SUMMARY...3 KEY CONCEPTS OF DSC...3 DELL COMMAND POWERSHELL PROVIDER RESOURCES...4 PUSH MODEL...4 PULL MODEL...5 ADDITIONAL INFORMATION ON SECURE PASSWORD...8 CONCLUSION...8 2

3 EXECUTIVE SUMMARY Desired State Configuration (DSC) is a configuration management framework provided by Windows PowerShell. DSC provides functionalities that enable IT Administrators to monitor and maintain the configuration of client systems in a corporate network. KEY CONCEPTS OF DSC The following is a summary of the key concepts of DSC: Standard Resources: The DSC framework contains a versatile set of built-in configuration resources. You can directly use the standard resources without scripting extensively. Custom Resources: Custom Resources make DSC accessible so that it can be integrated with any other product by using the DSC pipeline for configuration management. This is the typical use case by which Dell Command PowerShell Provider leverages the capabilities of DSC to maintain and monitor the BIOS settings of Dell client systems. The functionality of DSC can be leveraged by Dell Command PowerShell Provider through custom resources. DSC is used through PowerShell scripting. This is known as declarative programming wherein the end-user defines the requirement without specifying the process. When using DSC for configuring the BIOS settings with Dell Command PowerShell Provider, a key-value pair is defined based on the BIOS attribute and the desired value of the attribute. When this declaration is passed onto client systems, an intelligent agent ensures that the system configurations are not drifted and takes appropriate measures to restore the settings. The key terminologies that are associated with DSC scripting are as follows: Configuration: Configuration is a keyword that is used to define DSC functions. The syntax for defining the function is the keyword Configuration followed by a suitable identifier. IT Administrators declaratively define the management constraints on Dell client systems by using the Configuration function. Resource: Resources are accessed through the names for a block definition and they represents a set of relevant properties. In case of Dell Command PowerShell Provider, each category of the BIOS settings is referred to as a resource that is accessed through a user-friendly name and each attribute in that category is referred to as a property. For example, POSTbehavior is a category and Numlock is one of the properties in that category. Node: Nodes are target systems on which the IT Administrator enforces certain configuration settings. In case of Dell Command PowerShell Provider, a Node is a Dell client system on which certain BIOS settings are enforced. A key component in this process is Local Configuration Manager (LCM). LCM is the agent that runs on all systems having WMF 4.0 or later. Through a periodic check on the client systems, LCM ensures that the configuration settings have not drifted away and takes appropriate measures such as restoring the settings or logging the changes. Note: Dell recommends that you update to Windows Management Framework 5.0 (WMF 5.0) or later available at Microsoft.com. The workflow to enforce certain configuration constraints on client systems, involves authoring, staging, and enactment. Authoring: Authoring is the process of writing DSC scripts. The scripts use configuration, resource, and node. The scripts are saved in a.ps1 format. Staging: Staging involves a two-step process in which the script is run first. Running the script makes the Configuration function available at the command line interface. After running the script, the configuration name (a user defined identifier for the configuration function) is invoked at the command line interface. When the configuration name is invoked, a MOF file is created. The final consumable to the LCM is the current.mof file that is located at C:\Windows\System32\Configuration on every client system. The current.mof file is used by LCM for configuration management. 3

4 Enactment: Enactment is the process of delivering the final consumable MOF file to the LCM on client systems. The final consumable MOF file is pushed onto client systems from a server in push mode. The client systems poll a server for changes and pull a configuration from the server if changes are detected in pull mode. The following sections provide detailed information on push and pull modes from the perspective of Dell Command PowerShell Provider. Dell Command PowerShell Provider Resources Dell Command PowerShell Provider Resources are stored in the DSCResources folder in the same physical path where the module resides. Each category of BIOS attributes which Dell Command PowerShell Provider provides has a relevant folder within DSCResources which stores the MOF and PSM1 files, typical of a custom resource. The schema MOF file is a definition of the configurable properties and the PSM1 file is the implementation or the code that does the actual work specified by a configuration for the resource. Push Model In the push model the final consumable MOF file is pushed onto client systems from a server. The LCM on the client systems performs the job by perusing the current.mof file. Generally, push model is not an industry standard for deploying DSC, but a knowledge of the Push model helps understand DSC. The following figure shows a script for enforcing a simple configuration. Figure 1. Configuration script The Configuration block is followed by the Resource block (POSTBehavior) and the definition of the Node ( ). By default, Dell Command PowerShell Provider custom resources are available along with the Dell Command PowerShell Provider package in the standard folder named DSCResources. NOTE: While using Dell Command PowerShell Provider resources, the Category property is mandatory for all resource blocks. The Category property must define the category provided by Dell Command PowerShell Provider. In the example show in Figure 1, the IT Administrator enforces the settings of the Keypad to EnabledByNumLock, PowerWarn to Disabled and Numlock to Disabled. The attribute settings shown in Figure 1 are for illustration purposes only. Depending on the business requirement, an IT Administrator can set appropriate values for the required attributes. When this script is saved in a.ps1 format and run, the POSTBehaviorConfiguration function becomes active. When you run the POSTBehaviorConfiguration function, it generates a MOF file. During the Enactment stage, the IT Administrator uses the cmdlet Start-DscConfiguration to push the MOF file onto the target node(s) or system(s). DSC uses WinRM as the communication channel and all systems (server and client) in scope of DSC should be in the same Active Directory domain. In the push model, during the enactment stage, the server requires the local administrator credentials of the client system. The credentials are passed as a parameter along with Start-DscConfiguration cmdlet. 4

5 Figure 2. Configuration script NOTE: If BIOS is configured with a secure password instead of the regular password, the SecurePassword and PathToKey attributes must be defined as shown in Figure 2. The PathToKey attribute defines the encryption key that is used and is optional. The SecurePassword attribute defines the encrypted password. The secure password can also be passed as a variable that is available a secure file. Pull Model The pull model is probably the de facto standard of deploying and using DSC. In this model, the client system(s) periodically poll a pull server to verify if there is a change in management constraints that have been defined by the IT Administrator. If a change is detected, the client(s) pull the consumable MOF file from the server. Pull model is a simple setup that functions as a handshake between the server and client machines. The following is a summary of the steps for setting up a pull model. 1. Set up a pull server. 2. Create a configuration MOF file. 3. Rename the MOF file with a suitable GUID name and place the MOF file at $env:programfiles\windowspowershell\dscservice\configuration 4. Create a checksum for the MOF file. 5. Set up the LCM on client systems to Pull mode using the meta-configuration properties of the web service and GUID information. A pull server is an Internet Information Services (IIS) web server that hosts the MOF files for the nodes. It also responds to requests from each node s Local Configuration Manager (LCM) to distribute configurations. The node requests the configuration file from the pull server, which returns the associated DSC resources. The advantage of the pull model is that the DSC resources are downloaded automatically from the pull server on each node. At regular intervals, the nodes send the status to the pull server to verify if there are any changes to the configuration. The pull server is a common repository for the MOF files and the DSC resources. A pull server can distribute the MOF files through two protocols: Server Message Block (SMB): This method uses the shared folders on a file server. Hypertext Transfer Protocol (http/https): This is the easiest way to manage systems located in different networks. It uses the http protocol and an IIS server for communications. To install a pull server, the Desired State Configuration and two web services are required. The first web service allows the nodes to download the configuration and the second is the Compliance Server that helps to avoid configuration drift on the nodes. Authoring of a configuration defines the BIOS settings that an IT Administrator enforces on client systems. The push model method is involved wherein Dell Command PowerShell Provider resources are leveraged and intuitively authored, but 5

6 differs the way it is deployed. When the script is authored and the MOF file is generated (by running the configuration function) a distinct process of creation of a GUID (Global Unique Identifier) is performed. A new GUID can be created by using the command shown in the following figure. Figure 3. Creating a new GUID A sample dereferencing of the variable displays the GUID as shown in the following figure. Figure 4. Dereferencing the variable The configuration MOF file must be renamed using the GUID that is created as shown in the following figure, where ADM01.mof is the name of configuration MOF file that is authored and staged. Figure 5. Renaming the MOF file To run the renamed MOF file, place the MOF file at $env:programfiles\windowspowershell\dscservice\configuration and run the following cmdlet: New-DSCCheckSum * This creates a checksum for the <GUID>.mof file as shown in the following figure. 6

7 Figure 6. Checksum file After setting up the steps, set the meta-configuration of the LCM on client systems by setting salient properties such as RefreshMode to Pull and ConfigurationID to the GUID that is generated. Use the following cmdlet to configure the LCM: Set-DscLocalConfigurationManager A sample meta-configuration of the LCM is shown in the following figure. Figure 7. Sample meta-configuration As shown in Figure 7, the other key properites are ConfigurationID, RefreshMode, and ServerUrl. NOTE: There are two meta-configuration properties, namely ConfigurationModeFrequencyMins and RefreshFrequencyMins, which define the frequency at which the LCM checks and updates the configuration. The definition and difference between the properties are as follows: ConfigurationModeFrequencyMins specifies how often (in minutes) LCM checks the client system to ensure that the configuration is in the desired state. RefreshFrequencyMins specifies how often (in minutes) LCM attempts to obtain the configuration from the pull server. If configuration on the pull server differs from the current configuration on the target node, it is copied to the pending store and then applied. 7

8 Additional information on secure password When you use the ConvertTo-SecureString and ConvertFrom-SecureString attributes without a key or SecureKey, PowerShell uses Windows Data Protection API (DPAPI) to encrypt or decrypt the strings. When you use a Key or SecureKey, the Advanced Encryption Standard (AES) encryption algorithm is used. Conclusion Desired State Configuration is a powerful, industry-standard tool that can be leveraged by IT Administrators to automatically monitor configuration drifts on Dell client systems in a large corporate network. 8