DOCSEARCHbyAlgolia
Submit Docs

ComputerManagementDsc

repository·main·Indexed 43 days ago

https://github.com/dsccommunity/computermanagementdsc

A PowerShell Desired State Configuration (DSC) module providing class-based resources for managing Windows system components. Key capabilities include configuring computer identity, Active Directory domain membership via Offline Domain Join, scheduled tasks, SMB server settings and shares, power plans, PowerShell execution policies, and system locale. Requires Windows Management Framework 5.0 or higher.

Tokens
4.5K
Snippets
6
Records
34
Agent score
55%

What's inside ComputerManagementDsc

  1. Overview of ComputerManagementDsc resources

    main

    The ComputerManagementDsc module provides a collection of Desired State Configuration (DSC) resources for managing various Windows system settings.

    Key resources include:

    • Computer: Configures computer name, description, and Active Directory domain or workgroup membership.
    • IEEnhancedSecurityConfiguration: Configures IE Enhanced Security Configuration for administrator or user roles.
    • OfflineDomainJoin: Joins computers to an Active Directory domain using an Offline Domain Join request file.
    • PendingReboot: Monitors registry locations to predict and handle pending reboots.
    • PowerPlan: Activates a specific power plan.
    • PowerShellExecutionPolicy: Sets the desired PowerShell execution policy.
    • PSResourceRepository: Manages PowerShellGet repositories.
    • RemoteDesktopAdmin: Manages remote desktop administration settings.
    • ScheduledTask: Defines, deletes, or disables run-once or recurring scheduled tasks. Note: Requires the ScheduledTasks PowerShell module (Windows Server 2012/Windows 8 or newer). Configurations can be compiled on older systems but cannot be applied.
    • SmbServerConfiguration: Configures SMB Server settings.
    • SmbShare: Manages SMB shares.
    • SystemLocale: Sets the system locale.
    • SystemProtection: Configures System Protection (Workstations only; Servers not supported).
    • SystemRestorePoint: Creates or deletes restore points (Workstations only; Servers not supported).
    • TimeZone: Sets the machine time zone.
    • UserAccountControl: Configures UAC notification levels or granular settings.
    • VirtualMemory: Configures paging file properties.
    • WindowsEventLog: Configures specific Windows Event Logs.
    • WindowsCapability: Enables or disables Windows Capabilities.

  2. Manage Remote Desktop administration settings with DSC_RemoteDesktopAdmin

    main

    The DSC_RemoteDesktopAdmin resource manages remote desktop administration settings on a Windows computer. It allows you to control two primary configurations:

    1. Remote Desktop Connections: Enable or disable the ability for computers to connect via Remote Desktop.
    2. Network Level Authentication (NLA): Require or deny Network Level Authentication for remote connections.

    This resource is used to ensure consistent security and accessibility policies for Remote Desktop Services across managed nodes.

  4. Use DSC_SystemRestorePoint to manage restore points

    main

    The DSC_SystemRestorePoint resource allows you to create or delete system restore points.

    Requirements and Limitations

    • System Protection: You must have System Protection enabled on at least one drive for this resource to function.
    • OS Support: This resource is only applicable to workstation operating systems. It is not supported on Server operating systems.

  6. Configure Windows Event Log settings with DSC_WindowsEventLog

    main

    The DSC_WindowsEventLog resource is used to manage and configure the settings of a Windows Event Log.

    Restricting Guest Access

    You can control whether the built-in Guests group has access to an event log using the RestrictGuestAccess property.

    • When set to true: The RestrictGuestAccess registry key is configured, and the event log's DACL (Discretionary Access Control List) is updated to ensure the Guests group is removed.
    • When set to false: The RestrictGuestAccess registry key is configured, and the DACL is updated to ensure the Guests group is added.

    Note on Custom DACLs: If you provide a custom DACL via the SecurityDescriptor property, the resource will still enforce the RestrictGuestAccess logic and will display a warning if the DACL is modified to accommodate this behavior.

    Registering Event Sources and Resource Files

    When registering an event source, this resource follows the standard PowerShell cmdlet paradigm: it does not verify if the associated resource files exist on the local computer.

    To ensure an event source works correctly with custom resource files, you must manually ensure those files are present on the target machine (for example, by using a DSC File resource in your configuration) before or alongside the event log configuration.

  12. Configure System Protection with DSC_SystemProtection

    main

    The DSC_SystemProtection resource is used to configure System Protection settings.

    Important Constraints:

    • OS Support: This resource is only applicable to workstation operating systems. Server operating systems are not supported.
    • Drive Configuration: Disk usage is configured on a per-drive basis. Unlike the legacy xWindowsRestore resource, this resource does not accept an array of drives; you must define a configuration for each specific drive you wish to manage.