MCSA 2016 - 70-740 Install, Upgrade and Migrate Part 4

Adam Tyler

Hello, I am working through the Pull Server config out of "MCSA 2016 - 70-740 Install, Upgrade and Migrate Part 4" and it looks like I don't have access to this same sample script shown in the class. After installing the "xPSDesiredStateConfiguratoin" module, the folder" C:\Program Files\WindowsPowerShell\Modules\xPSDesiredStateConfiguration\8.0.0.0\Examples" folder has these two scripts:

Sample_xDscWebServiceRegistration.ps1
Sample_xDscWebServiceRegistrationWithSecurityBestPractices.ps1

When I attempt to run the first one I get the following errors:
Resource 'xDSCWebService' requires that a value of type 'Boolean' be provided for property 'UseSecurityBestPractices'

When I run the second, I get this error:
.Cannot validate argument on parameter 'certificateThumbPrint'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.

Looks like the command or script may have changes some since the original episode was finished.. Any idea where I've gone wrong here?

Mike Rodrick

Hello Adam,

Yep, things have definitely changed since we shot that episode. I believe we used version 3 of the script, now it's version 8 :)

I'm setting up a test environment, I will let you know once I have an answer for you.

I would like to see the commands you used to execute the script (what parameters you used), can you post those?

Mike

Mike Rodrick

Hey Adam,

Looks like the first script, Sample_xDscWebServiceRegistration.ps1, needs an additional parameter. Modify the code as follows:

    xDscWebService PSDSCPullServer
    {
        Ensure                  = "Present"
        EndpointName            = "PSDSCPullServer"
        Port                    = 8080
        PhysicalPath            = "$env:SystemDrive\inetpub\PSDSCPullServer"
        CertificateThumbPrint   = $certificateThumbPrint
        ModulePath              = "$env:PROGRAMFILES\WindowsPowerShell\DscService\Modules"
        ConfigurationPath       = "$env:PROGRAMFILES\WindowsPowerShell\DscService\Configuration"            
        State                   = "Started"
        DependsOn               = "[WindowsFeature]DSCServiceFeature" 
        RegistrationKeyPath     = "$env:PROGRAMFILES\WindowsPowerShell\DscService"   
        AcceptSelfSignedCertificates = $true
        Enable32BitAppOnWin64   = $false
        UseSecurityBestPractices = $false
    }

Note the new line:

UseSecurityBestPractices = $false

Seems like the module requires this parameter, they haven't updated the sample script to reflect this change.

Let me know if this works for you.

Mike Rodrick

Hey Adam,

For the second one, it depends on how you executed the script.

If you run the script and provide the parameters, it should work as expected, like:

Sample_xDscWebServiceRegistrationWithSecurityBestPractices -RegistrationKey 2dd30223-3bcf-408c-8292-90036543bce2 -certificateThumbPrint 92FC2D86CC658E4547AF18E2DF54BA21B031B3F3

But if you try to use their code to generate the thumbprint and registration key, it fails because of a variable name mismatch. Under the first arguments block, the variable name is "$thumbprint", but in the configuration block, the variable name is "$certificateThumbPrint"

# ======================================== Arguments ======================================== #
$thumbprint = (New-SelfSignedCertificate -Subject "TestPullServer").Thumbprint
$registrationkey = [guid]::NewGuid()
# ======================================== Arguments ======================================== #

# =================================== Section DSC Client =================================== #
configuration Sample_xDscWebServiceRegistrationWithSecurityBestPractices
{
    param 
    (
        [string[]]$NodeName = 'localhost',

        [ValidateNotNullOrEmpty()]
        [string] $certificateThumbPrint,

        [Parameter(HelpMessage='This should be a string with enough entropy (randomness) to protect the registration of clients to the pull server.  We will use new GUID by default.')]
        [ValidateNotNullOrEmpty()]
        [string] $RegistrationKey # A guid that clients use to initiate conversation with pull server
    )

Change $thumbprint to $certificateThumbPrint, and the script should execute successfully.

Note that with this script, you do not have to generate a certificate and registration key ahead of time, it generates them when you run the script. If you want to use your generated certificate and registration key...

Change these lines

# ======================================== Arguments ======================================== #
$certificateThumbprint = (New-SelfSignedCertificate -Subject "TestPullServer").Thumbprint
$registrationkey = [guid]::NewGuid()

to use your information

# ======================================== Arguments ======================================== #
$certificateThumbprint = 92FC2D86CC658E4547AF18D2DF54BA21B031B3F3
$registrationkey = 2dd30223-3bcf-408c-8192-90036543bce2

Let me know if this helps!

Adam Tyler

Mike, thanks for your effort here! I will give this a shot over the weekend and let you know how things go.

Regards,
Adam Tyler

Adam Tyler

Okay, had a chance to test this while I was at the office... So I am using this script:

C:\Configs\Sample_xDscWebServiceREgistrationWithSecurityBestPractices.ps1

I made the following changes.

# ======================================== Arguments ======================================== #
$certificateThumbPrint = "AD45081CCC1564FA06AA39F760BC3D01888CC381"
$registrationkey = "74d16e84-5bd4-4c7a-80d2-b438fb29d0c9"
# ======================================== Arguments ======================================== #

# =================================== Section DSC Client =================================== #
configuration Sample_xDscWebServiceRegistrationWithSecurityBestPractices
{
    param 
    (
        [string[]]$NodeName = 'localhost',

        [ValidateNotNullOrEmpty()]
        [string] $certificateThumbPrint,

        [Parameter(HelpMessage='This should be a string with enough entropy (randomness) to protect the registration of clients to the pull server.  We will use new GUID by default.')]
        [ValidateNotNullOrEmpty()]
        [string] $RegistrationKey # A guid that clients use to initiate conversation with pull server
    )
    
    Import-DSCResource -ModuleName xPSDesiredStateConfiguration

    Node $NodeName
    {
        WindowsFeature DSCServiceFeature
        {
            Ensure = "Present"
            Name   = "DSC-Service"            
        }

        xDscWebService PSDSCPullServer
        {
            Ensure                  = "Present"
            EndpointName            = "PSDSCPullServer"
            Port                    = 8080
            PhysicalPath            = "$env:SystemDrive\inetpub\wwwroot\PSDSCPullServer"
            CertificateThumbPrint   = $certificateThumbPrint         
            ModulePath              = "$env:PROGRAMFILES\WindowsPowerShell\DscService\Modules"
            ConfigurationPath       = "$env:PROGRAMFILES\WindowsPowerShell\DscService\Configuration"            
            State                   = "Started"
            DependsOn               = "[WindowsFeature]DSCServiceFeature" 
            RegistrationKeyPath     = "$env:PROGRAMFILES\WindowsPowerShell\DscService"   
            AcceptSelfSignedCertificates = $true
            UseSecurityBestPractices = $true
        }

        File RegistrationKeyFile
        {
            Ensure          = 'Present'
            Type            = 'File'
            DestinationPath = "$env:ProgramFiles\WindowsPowerShell\DscService\RegistrationKeys.txt"
            Contents        = $RegistrationKey
        }
    }
}
Sample_xDscWebServiceRegistrationWithSecurityBestPractices -RegistrationKey $registrationkey -certificateThumbPrint $certificateThumbPrint
# =================================== Section Pull Server =================================== #

# =================================== Section DSC Client =================================== #
[DSCLocalConfigurationManager()]
configuration Sample_MetaConfigurationToRegisterWithSecurePullServer
{
    param
    (
        [ValidateNotNullOrEmpty()]
        [string] $NodeName = 'localhost',

        [ValidateNotNullOrEmpty()]
        [string] $RegistrationKey, #same as the one used to setup pull server in previous configuration

        [ValidateNotNullOrEmpty()]
        [string] $ServerName = 'localhost' #node name of the pull server, same as $NodeName used in previous configuration
    )

    Node $NodeName
    {
        Settings
        {
            RefreshMode        = 'Pull'
        }

        ConfigurationRepositoryWeb CONTOSO-PullSrv
        {
            ServerURL          = "https://$ServerName`:8080/PSDSCPullServer.svc" # notice it is https
            RegistrationKey    = $RegistrationKey
            ConfigurationNames = @('ClientConfig')
        }   

        ReportServerWeb CONTOSO-PullSrv
        {
            ServerURL       = "https://$ServerName`:8080/PSDSCPullServer.svc" # notice it is https
            RegistrationKey = $RegistrationKey
        }
    }
}

Now, if I run this script from a PowerShell window using zero options/switches, I end up with a new folder path:

C:\Configs\Sample_xDscWebServiceREgistrationWithSecurityBestPractices\localhost.mof

So it looks like the script completed without any errors. Here was the output I got when running.

PS C:\Configs> .\Sample_xDscWebServiceRegistrationWithSecurityBestPractices -outputpath c:\Configs\PullServer
WARNING: The configuration 'Sample_xDscWebServiceRegistrationWithSecurityBestPractices' is loading one or more built-in resources without
explicitly importing associated modules. Add Import-DscResource –ModuleName 'PSDesiredStateConfiguration' to your configuration to avoid this
message.


    Directory: C:\Configs\Sample_xDscWebServiceRegistrationWithSecurityBestPractices


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       12/22/2017  12:13 PM           5402 localhost.mof


PS C:\Configs> .\Sample_xDscWebServiceRegistrationWithSecurityBestPractices -outputpath c:\Configs\PullServer

So that's good stuff. No errors this time around. I'm a little confused as to why it created the folder under configs... Did I not use the "outputpath" switch correctly?

Regards,
Adam Tyler

Mike Rodrick

Glad it worked. I'm not sure why it didn't use your specified OutputPath. You are using the option correctly. I tried to recreate the issue, folders that don't exist, etc. and it always creates the specified folder structure. Maybe permissions? Does the account you are running the script with have write permissions over the destination?

Adam Tyler

Thanks for your response Mike. I actually deployed a new domain in a lab just to play with this. Currently just using the default domain\Administrator account to play around. Just checked and the PowerShell session I used to run this script is in the "Administrator: Windows PowerShell" Context... Hmm.

What happened in your environment when you tried to re-create this? At this stage I am just creating the script to deploy this "server" side of Desired State Configuration.. So I don't really need to store the MOF for reference and continual execution correct? That's more for the next phase when the clients are configured to check in with this web service.....?

In your example you had a pretty clean folder structure that looked like this for your client:
c:\Configs\TargetNodes\WindowsBackup\

I believe the MOF and the hash would go here for clients to continually check in. Why the "WindowsBackup" subfolder though? Could you not put all MOFs in the TargetNodes folder directly? Is this folder path called out somewhere within the server configuration? How does IIS know to serve this folder path up for DSC requests?

Regards,
Adam Tyler