Traditionally, Windows Server administrators managed infrastructure by writing imperative scripts: “Install IIS, then copy these files, then start the service.” If a junior admin manually changed a setting later, the server drifted out of compliance, causing subtle bugs. PowerShell Desired State Configuration (DSC) changes the paradigm from imperative to declarative. You simply write a configuration file stating “IIS must be installed, and this service must be running.” DSC handles the complex logic of checking the current state and forcing the server into compliance, automatically correcting any configuration drift.
Step 1: Understand the Architecture
DSC operates using two primary methods:
- Push Mode: The administrator manually pushes the configuration document to target nodes. Best for testing and small environments.
- Pull Mode: Target nodes periodically poll a central “Pull Server” (or Azure Automation) to download their configurations. Best for enterprise deployments.
In this guide, we will use Push Mode to configure a local server to act as an IIS Web Server.
Step 2: Write the Configuration Script
A DSC script looks like a standard PowerShell script but uses the Configuration keyword. Open the PowerShell ISE (or VS Code) and write the following code:
Configuration WebServerConfig {
# Import the built-in DSC resources
Import-DscResource -ModuleName 'PSDesiredStateConfiguration'
# Define the target node (localhost for this example)
Node "localhost" {
# Ensure the IIS Server Role is installed
WindowsFeature IIS {
Ensure = "Present"
Name = "Web-Server"
}
# Ensure the default IIS service is running
Service W3SVC {
Name = "W3SVC"
State = "Running"
# This creates a dependency: Don't try to start the service until the role is installed
DependsOn = "[WindowsFeature]IIS"
}
# Create a dummy index.html file
File WebContent {
Ensure = "Present"
Type = "File"
DestinationPath = "C:\inetpub\wwwroot\index.html"
Contents = "<html><body><h1>Configured by DSC</h1></body></html>"
DependsOn = "[WindowsFeature]IIS"
}
}
}Step 3: Compile the Configuration
Windows does not execute the PowerShell script directly on the target machine. Instead, it compiles the script into a standard Managed Object Format (MOF) file. To compile it, you must “run” the configuration block you just defined.
At the bottom of your script (outside the Configuration block), add the following line:
WebServerConfig -OutputPath "C:\DSC_Output"Run the entire script. It will create a new directory at C:\DSC_Output containing a file named localhost.mof.
Step 4: Push the Configuration (Enact)
To apply the MOF file to the server, use the Local Configuration Manager (LCM), the engine built into Windows that executes DSC.
Open an elevated PowerShell prompt and run:
Start-DscConfiguration -Path "C:\DSC_Output" -Wait -Verbose-Pathpoints to the folder containing your MOF file, not the file itself.-Waitforces the console to pause until the job is done.-Verboseshows you exactly what the LCM is doing (e.g., downloading binaries, starting services).
Step 5: Test for Configuration Drift
To prove DSC’s power, manually break the server.
- Open the Services console (
services.msc) and stop the “World Wide Web Publishing Service” (W3SVC). - Delete the
C:\inetpub\wwwroot\index.htmlfile.
Now, run a built-in cmdlet to test if the server is compliant with your defined state:
Test-DscConfigurationIt will return False. To instantly fix the server, simply run the push command again (or rely on the LCM’s background polling if configured to auto-correct). The LCM will detect the missing file and the stopped service, and automatically repair them without attempting to reinstall the entire IIS role.