Take a look at the following configuration:
$configurationData =
@{

AllNodes =

@(

    @{

        NodeName = 'S16-01'

        PsDscAllowPlainTextPassword = $true

        PSDscAllowDomainUser = $true                        

    }

)

}

Configuration DSCRunDemo
{

param (

    [pscredential] $Credential

)

Import-DscResource -ModuleName PSDesiredStateConfiguration


Node $AllNodes.NodeName

{

    Script DSCRunDemo1

    {

        SetScript = 

        { 

            Write-Verbose -Message $(whoami)

        }            

        TestScript = 

        {    

            return $false

        }        

        GetScript =

        {

            return @{}

        }

        PsDscRunAsCredential = $Credential

    }

    Script DSCRunDemo2

    {

        SetScript = 

        { 

            Write-Verbose -Message $(whoami)

        }            

        TestScript = 

        {    

            return $false

        }        

        GetScript =

        {

            return @{}

        }

    }                 

}

}

DSCRunDemo -ConfigurationData $configurationData -Credential (Get-Credential)

One instance of the script resource has PSDscRunAsCredential while the other does not. This compiles fine and then MOF looks good.

/
@TargetNode='S16-01'
@GeneratedBy=Administrator
@GenerationDate=08/22/2017 13:36:38
@GenerationHost=S16-JB
/

instance of MSFTCredential as $MSFTCredential1ref
{
Password = "Dell1234";
UserName = "psdsc\administrator";

};

instance of MSFTScriptResource as $MSFTScriptResource1ref
{
ResourceID = "[Script]DSCRunDemo1";
PsDscRunAsCredential = $MSFT_Credential1ref;
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::22::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of MSFTScriptResource as $MSFTScriptResource2ref
{
ResourceID = "[Script]DSCRunDemo2";
GetScript = "\n return @{}\n ";
TestScript = " \n return $false\n ";
SourceInfo = "::39::9::Script";
SetScript = " \n Write-Verbose -Message $(whoami)\n ";
ModuleName = "PSDesiredStateConfiguration";

ModuleVersion = "0.0";

ConfigurationName = "DSCRunDemo";

};
instance of OMI_ConfigurationDocument

                {

Version="2.0.0";

                    MinimumCompatibleVersion = "2.0.0";


                    CompatibleVersionAdditionalProperties= {"Omi_BaseResource:ConfigurationName"};

                    Author="Administrator";

                    GenerationDate="08/22/2017 13:36:38";

                    GenerationHost="S16-JB";

                    Name="DSCRunDemo";

                };

However, when we enact this configuration, it fails with the following message:

PS C:> Start-DscConfiguration -Path .\DSCRunDemo -Verbose -Wait -Force
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer S16-JB with user sid S-1-5-21-689661094-3032901192-2251061677-500.
VERBOSE: [S16-01]: LCM: [ Start Set ]
VERBOSE: [S16-01]: LCM: [ End Set ]
The resources ('[Script]DSCRunDemo1' and '[Script]DSCRunDemo2') have conflicting values of the following properties: 'PsDscRunAsCredential'. Ensure that their values match.

+ CategoryInfo          : ResourceExists: (root/Microsoft/...gurationManager:String) [], CimException

+ FullyQualifiedErrorId : MI RESULT 11

+ PSComputerName        : S16-01

VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 3.761 seconds

If this is by design, it is a wrong design. Think of adding registry configuration for multiple users on the same system using the same configuration document.

Votes from Connect: 17

Original Date Submitted: 8/13/2015 12:17:49 AM

Description:
Contact Information
Handle: PowerShellDon
Site Name: PowerShell
Feedback ID: 1659904

Problem Description:
Suggestion one:

Add maintenance window awareness to the Local Configuration Manager. Edited via metaconfig, it specifies times when configuration changes are acceptable, when automated reboots are acceptable. Further automates configuration maintenance especially when you're implementing changes vs. correcting drift.

Suggestion two:

Add universal "DoNotImplementBefore" and "ImplementBy" settings to DSC resources. Just as "Present=" specifies to add/remove something, these would indicate a date/time for the setting to become valid (e.g., "we want to implement a bunch of changes, but not before x date") and a deadline by which the setting just be implemented (e.g., "this has to happen by x date"). The latter might play into the LCM configuration: For example, when set to ApplyAndAutoCorrect, even if AutoReboot=$false, an auto reboot may occur once a setting passes its "ImplementBy" date/time without previously being implemented.

These suggestions reflect some of the realities of managing a production environment.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1659904 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1659904).

Repro Steps:

Internal BugId: 15730

I think it's time for an overhaul of Group Policy and GP Preferences. You can still keep the GUI to allow everyone to have something familiar, but I would love to see if Group Policy can be converted to start using PowerShell DSC under the hood. I think this would make things much simpler in terms of deployment and wouldn't require logon/logoff or restarts anymore (unless you wanted a script to run at those times). For everything else like IE/Edge settings, registry settings, mapped drives/printers, desktop backgrounds and such I think having everything exposed in PowerShell would both make it more secure (as we've recently seen with the SMB signing problems) and easier to troubleshoot. It might even make it easier to deploy a Linux version of Group Policy since DSC can work against Linux...

Having the following script:

configuration SimpleConfig2
{

Import-DscResource –ModuleName 'PSDesiredStateConfiguration'


node $remoteCommputer

{

    Environment TestVersion

    {

        Ensure = "Present"  # You can also set Ensure to "Absent"

        Name = "TestEnvironmentVariable"

        Value = "TestValue2"

    }

}

}

SimpleConfig2

Start-DSCConfiguration -Path "SimpleConfig2" -Force -Wait -ComputerName $remoteCommputer -Credential $g_AutomationDefaultVMAccounCred -verbose

$result = Test-DscConfiguration -Path "SimpleConfig2" -ComputerName $remoteCommputer -Credential $g_AutomationDefaultVMAccounCred

The config is applied correctly, yet Test-DscConfiguration fails with the following message:

The configurationData parameter is reserved for future use. The current configuration is used by default.

+ CategoryInfo          : InvalidArgument: (root/Microsoft/...gurationManager:String) [], CimException

+ FullyQualifiedErrorId : MI RESULT 4

+ PSComputerName        : target-machine

OS: Windows Server 2016 1607 (14393.1593)
PSVersionTable:
Name Value

PSVersion 5.1.14393.1532

PSEdition Desktop

PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}

BuildVersion 10.0.14393.1532

CLRVersion 4.0.30319.42000

WSManStackVersion 3.0

PSRemotingProtocolVersion 2.3

SerializationVersion 1.1.0.1

PSDscResource module: v2.8.0.0

Take a look at this configuration:
Configuration DependentConfig
{

Import-DscResource -ModuleName PSDscResources -Name Registry


Node MyNode01

{

    File SetupScript

    {

        DestinationPath = 'C:\Scripts\hello.txt'

        Contents = 'somecommand'

        Type = 'File'

        Ensure = 'Present'

        DependsOn = '[Registry]regCheck'

    }

    Registry regCheck

    {

        Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'

        ValueName = 'SomeValue'

        ValueData = 0

        ValueType = 'DWord'

        Ensure = 'Present'

    }

}

}

DependentConfig -OutputPath C:\DependentConfig

This requires PSDscResources module version 2.8.0.0 from the gallery and the file resource from the PSDesiredStateConfiguration in-box module. However, compiling this configuration will fail with a message that File resource cannot be loaded. If we remove -Name File from the first import command, you will see an error that Registry resource cannot be found. We have to use -Name with PSDscResources since PSDesiredStateConfiguration already exports the same resource.

So, the only work around at this time is to remove the PSDesiredStateConfiguration import completely from the configuration so that we can at least compile this. Here is something that works.

Configuration DependentConfig
{

Import-DscResource -ModuleName PSDesiredStateConfiguration

Import-DscResource -ModuleName PSDscResources -Name Registry


Node MyNode01

{

    File SetupScript

    {

        DestinationPath = 'C:\Scripts\hello.txt'

        Contents = 'somecommand'

        Type = 'File'

        Ensure = 'Present'

        DependsOn = '[Registry]regCheck'

    }

    Registry regCheck

    {

        Key = 'HKEY_LOCAL_MACHINE\SYSTEM\SomeKey'

        ValueName = 'SomeValue'

        ValueData = 0

        ValueType = 'DWord'

        Ensure = 'Present'

    }

}

}

DependentConfig -OutputPath C:\DependentConfig

When upgrading to WMF 5.1, we are seeing errors in the DSC event log on servers that use a configuration with encrypted content (passwords). We are using encrypted credentials to create application pools and assign a service account as the identity. The data gets decrypted fine and the app pools get created with the correct identities. However the following error gets logged in the DSC event log every time a consistency check runs:

Job :
Message Cannot unprotect message. The input contained no encrypted content. Specify the '-IncludeContext' parameter if you wish to output the original content when no encrypted content is detected.
HResult -2146233087
StackTrack at System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
at System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
at System.Management.Automation.PowerShell.Worker.CreateRunspaceIfNeededAndDoWork(Runspace rsToUse, Boolean isSync)
at System.Management.Automation.PowerShell.CoreInvokeHelperTInput,TOutput
at System.Management.Automation.PowerShell.CoreInvokeTInput,TOutput
at Microsoft.PowerShell.DesiredStateConfiguration.Internal.ResourceProviderAdapter.CMS_DecryptMessage(String thumbprint, String encryptedMessage, IStreamsHandler plugInStreamsHandler, String& outputResult, IntPtr& errorInstanceHandle)

We updated our certificate to use the new requirements for WMF 5.1 and everything looks fine there.

On 2 Fully Updated Windows Server 2016 Machines running and provisioned from Azure I have created a Pull Server Configuration. I have created the DSC Signing Certificate using a custom template on a Enterprise Root CA which has worked for 2012R2 nodes and also tested using xDSCUtils New-xSelfSignedDscEncryptionCertificate. Using the same Certificate to Compile and Execute the MOF on the same Computer works, it is only if you compile on one and execute on another that the problems arise.
I kept getting errors when passing in credentials. I therefore wrote a tiny custom DSC Resource that Displays the Password as clear text when I run Start-DSCConfiguration -Wait -Verbose
You can find it here https://gist.github.com/aboersch/65e846a4966fe2c4708ed21d655a54a7
The Client does not correctly decrypt the Credentials. As a Password I am receiving
-----BEGIN CMS-----
<Long Multi-Line Base64 String>
-----END CMS-----
If I pass this to Unprotect-CmsMessage I receive the correct Password.
The Certificate passes $.PrivateKey.KeyExchangeAlgorithm and $.Verify
I have tried changing the Certificate Provider to '"Microsoft Enhanced Cryptographic Provider v1.0"', '"Legacy Cryptographic Service Provider"', and '"Microsoft RSA SChannel Cryptographic Provider"'.
I have already tried these:
http://stackoverflow.com/questions/34006865/dsc-problems-with-credentials-and-build-10586
https://wespoint.wordpress.com/2017/01/19/powershell-dsc-encryption-issue/

Hi all,
I am using DSC partials to create role-based architectures with Azure virtual machines.
When switching to Windows 2016 (everything works great on Windows 2012 R2), I get errors when DSC is compiling the MOF.
The idea is that I have multiple partials that contain the same Windows Feature installation, because it's needed for a certain roles. When I apply more roles on the same machine, the partials need to merge. So I have one partial that contains this:

    WindowsFeature DotNetFrameworkRole1

    {

        Name = 'AS-NET-Framework'

    }

and another partial that contains this:

    WindowsFeature DotNetFrameworkRole2

    {

        Name = 'AS-NET-Framework'

    }

When applying the partials on same machine (again, works fine in Windows 2012), I get these errors on Windows 2016:

Job {B1BD89DA-1965-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed. LCM failed to start desired state configuration manually.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Job {3CFCAF9F-1967-11E7-A942-000D3A27FE28} :
MIResult: 11
Error Message: The resources ('[WindowsFeature]DotNetFrameworkRole1' and '[WindowsFeature]DotNetFrameworkRole2') have conflicting values of the following properties: 'ModuleVersion'. Ensure that their values match. Merging of partial configurations failed.
Message ID: MI RESULT 11
Error Category: 20
Error Code: 11
Error Type: MI

Any ideas for this one?
Thank you,
Sorin

In a recent change, the new database for the on-prem Pullserver is now ESENT. Had a question for clarification.

As an old Exchange guy, I have fears that immediately pop into mind. The logs files do not appear to be using circular logging (a way of self cleaning and restricting the amount of log files) – Is this true?

If so, then I’m guess that the log files will continue to grow until the disk is full – which happens to exchange if the log files are not truncated. Is there a way today or in the future we will be able to manage the log files?

Thanks for the help understanding!

Hi Powershell Team,

When I try to invoke the get method for a custom DSC resource using PsDscRunAsCredential, I get an error. This does not happen with either the set or test methods.

The same custom resource works fine in a normal configuration though. I'm not sure if that's because the get method is not called there.

Setup:
Windows Server 2012 R2
WMF5 RTM

PS C:\Users\username> Invoke-DscResource -Name cWhoAmI -Method get -ModuleName cWhoAmI -Property $props -Verbose
Invoke-DscResource : The PowerShell DSC resource returned results in a format that is not valid. The results from
running Get-TargetResource should be in a hashtable format. The keys in the hashtable should be the same as the
properties in the corresponding DSC resource schema file.
At line:1 char:1
+ Invoke-DscResource -Name cWhoAmI -Method get -ModuleName cWhoAmI -Pro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo          : InvalidResult: (root/Microsoft/...gurationManager:String) [Invoke-DscResource], CimExcep

tion

+ FullyQualifiedErrorId : GetTargetResourceInvalidResultFormat,Microsoft.PowerShell.DesiredStateConfiguration.Comm

ands.InvokeDscResourceMethodCommand

Here's is the test code used:

[DscResource()]
class cWhoAmI
{

[DscProperty(Key)]

[string]$Username


[void] Set()

{

    $name = whoami.exe

    Write-Verbose $name

}        

[bool] Test()

{   

    $name = whoami.exe

    Write-Verbose $name

    if ($this.Username -ne $name)

    {

        return $false

    }     

    return $true

}    

[cWhoAmI] Get()

{

    $name = whoami.exe

    Write-Verbose $name

    return $this 

}    

}

#

$creds = (Get-Credential)

$props = @{

username = 'domain\username'

PsDscRunAsCredential = $creds

}

Invoke-DscResource -Name cWhoAmI -Method test -ModuleName cWhoAmI -Property $props -Verbose

error here

#

$configData = @{

AllNodes = @(

    @{

        NodeName = 'localhost'

        PsDscAllowPlainTextPassword = $true

    }

)

}

configuration 'who'
{

Import-DscResource -ModuleName cWhoAmI


Node $allnodes.nodename

{

    cWhoAmI 'whoami'

    {

        UserName = 'domain\username'

        PsDscRunAsCredential = (get-credential)

    }

}

}

who -configuration $configData

start-dscconfiguration -force -verbose -wait -path .\who

no error

Currently, if you have a configuration that installs a Windows feature then has another step that configures settings using a module that gets installed with that particular feature, the LCM fails its check because that module is not currently present on the node.

For example, we have a configuration that installs the Web-Server role. There are later steps which use the xWebAdministration resource to configure things like Application Pools and Application Pool defaults. The problem is, when the LCM pulls the configuration and runs it's checks, it fails because the xWebAdministration resource uses cmdlets that are present in the WebAdministration module which gets installed with the Web-Server role. Since that role is not installed, the LCM fails saying the WebAdministration module is not present.

Because of this, we need to split our configurations up into 2 and manually apply both. It would be nice if the LCM could use some kind of logic to accommodate for modules that will become available after certain roles are installed or configuration steps are completed.

When multiple configurations names are specified in LCM configuration the pull fails get obtain any configuration.

LCM Config Example

    ConfigurationRepositoryWeb HillIntl-Pull

    {

        ServerURL = &quot;<a rel="nofollow noreferrer" href="http://server1:8080/PSDSCPullServer.svc&quot;">http://server1:8080/PSDSCPullServer.svc&quot;</a>;

        AllowUnsecureConnection = $true;

        RegistrationKey = &quot;aaaa333-6c83-4636-a0cb-39b88a968849&quot;;

        ConfigurationNames = @(&#39;BaseConfig&#39;,&#39;WebServer&#39;);

    }

Resulting errors

Job {C7312E94-D405-11E5-80B5-00155D086627} :
Message UpdateMetaConfig is not a valid value for GetActionResponse.
HResult -2146233087
StackTrack at System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input, Hashtable errorResults, Boolean enumerate)
at System.Management.Automation.Runspaces.LocalPipeline.InvokeHelper()
at System.Management.Automation.Runspaces.LocalPipeline.InvokeThreadProc()

Job {C7312E94-D405-11E5-80B5-00155D086627} :
This event indicates that failure happens when LCM is trying to get the configuration from pull server using download manager NULL. ErrorId is 0x1. ErrorDetail is A generic exception occurred during the invocation of the Get-DSCAction cmdlet by Download Manager WebDownloadManager.

Job {C7312E94-D405-11E5-80B5-00155D086627} :
MIResult: 1
Error Message: A generic exception occurred during the invocation of the Get-DSCAction cmdlet by Download Manager WebDownloadManager.
Message ID: GetActionException
Error Category: 8
Error Code: 1
Error Type: MI

Entering a single Configuration name (as below) works without issue.

        ConfigurationNames = @('BaseConfig');

Votes from Connect: 3

Original Date Submitted: 6/8/2015 2:40:45 PM

Description:
Contact Information
Handle: aL3891
Site Name: PowerShell
Feedback ID: 1411231

Problem Description:
At the moment all dsc resources are executed serially. given that dependencies are allready specified, it would in theory be safe to execute steps in parallel.

I'm guessing this is planned at some point but i could really use a way to enable parallel execution because I'm using dsc to spin up test environments with a bunch of services and having those being set up in parallel would speed things up considerably.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1411231 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1411231).

Repro Steps:

Internal BugId: 14550

Votes from Connect: 4

Original Date Submitted: 12/13/2014 2:03:27 AM

Description:
Contact Information
Handle: RobCannon
Site Name: PowerShell
Feedback ID: 1053308

Frequency: Always Happens
Regression: Yes, this happens in all previous versions

Problem Description:
I would like to a parameter in a PartialConfiguration section to specify a time period.

Some configurations would always be running and could fix configuration drift. But other configurations (that would cause a service disruption if applied) could be target to only run during a specified maintenance window. The window parameter should allow you to specify a time window and either a day of the week or day of the month.

It would be helpful if there was a way to coordinate this configuration window with other servers in a service group so that you could perform maintenance on a group of servers that are providing a service in such a way that there is always service availability across the group.

One thought would be to specify a url that is called before the server can start maintenance and another to call when maintenance is complete. That would allow a great deal of flexibility because the service would be programmed to coordinate service availability, deal with load balancers and handle maintenance freezes.

Product Studio item created by Connect Synchronizer due to creation of feedback ID 1053308 (http://connect.microsoft.com/PowerShell/feedback/ViewFeedback.aspx?FeedbackID=1053308).

Repro Steps:
Expected Results:

Internal BugId: 13145