Hello, Cloud Gurus,
and welcome back for part 2
of implementing DSC with Azure Automation.
Let's take a look at what we're going to cover.
Now that we have our compiled configuration
in the automation account,
we will start by taking a look
at the Local Configuration Manager
and then we will take a look
at applying configurations
and viewing compliance,
as well as a demo of that.
Let's get started.
Now, as we mentioned,
the Local Configuration Manager
is responsible for applying the configuration.
In Azure Automation, this is done by the LCM
pulling the compiled configuration
from the automation account and then applying it.
And there are a few options around how the LCM does this.
Let's take a look.
The refresh frequency is how often you want the LCM
to check the Pull Server,
which is our automation account,
for a new version of the configuration.
And by default, this is every 30 minutes.
And the configuration mode frequency
is how often you want the LCM
to apply the local copy of the configuration.
And by default, this is every 15 minutes.
And the configuration mode defines how you want the LCM
to apply the configuration.
And you can either have the LCM ApplyOnly,
which will only apply the configuration once,
or you can tell the LCM to apply the configuration
and then monitor to see if the configuration
drifts from the desired state.
And the final and best option in my opinion
is to have the LCM apply the configuration
and then apply it again according to the schedule,
fixing any misconfigurations that are found,
and this is referred to as ApplyAndAutoCorrect.
And you can also instruct the LCM
to download missing PowerShell modules
from the automation account.
And finally, you can also tell the LCM
what to do after a reboot.
Now let's take a quick look at a demo
of registering a server with the automation account
by configuring the Local Configuration Manager.
All right, so here we are on the Azure Portal
and we have our compiled configuration from earlier,
but if we select the nodes option here,
we currently have no nodes
registered with our Azure Automation account.
Now I want to add a server that is currently on-premises
and you can see you can add Azure virtual machines
using the Add button here
but if you want to add a hybrid machine
you can select the Add Non-Azure machine over on the right
and it'll take you to this page
in the Microsoft documentation.
And then you can use this link to navigate down
to register hybrid machines
and we're going to need to use the primary access key
and the URL from our automation account.
We're going to need to use this script
to generate a DSC meta configuration
that will onboard our node into Azure Automation
and configure the Local Configuration Manager.
So I've gone ahead and copied this script
and I've put it on the machine that I want to register.
But first, I'm going to go ahead and grab the registration
URL and the registration key from the Azure Portal.
So I'll jump back to the Azure Portal
and we'll navigate down to keys
and I'll grab the primary access key and the URL.
And then we'll jump over to our machine to onboard it
and here's the script that I've grabbed
from the Microsoft documentation.
I'll just scroll down a little bit
because you don't need to set any values at the top.
All the values you need to set are down the bottom.
And you can see here, we have a registration URL
so I'll paste that in.
And then we have a registration key
so I'll paste that in.
And then we need to have a computer name.
So I'm going to specify the name localhost,
which is this current server.
And I don't need the other computer name
so I'll just delete that.
And then I need to provide the node configuration name
which in our case is ServerConfiguration, dot,
and then the server name.
I'm okay to leave this default refresh frequency.
That's how often it'll check the automation account
for a new configuration.
And I'm okay to leave the default
configuration mode frequency as well.
So every 15 minutes,
it'll attempt to reapply the configuration.
I'm going to leave the RebootNodeIfNeeded to false.
I'm going to allow module override.
So it'll override any local modules
that it needs to override.
And now I'm going to set the all important ConfigurationMode
and we want this to be set to ApplyAndAutoCorrect.
And it's not going to reboot this over anyway,
but if it did, it would continue configuration
after the reboot.
So this script is now ready to go.
So we can go ahead and run this script.
And it's generated the meta configuration
in a mof file here.
So now we can go ahead and apply the meta-configuration
which will register this node in Azure Automation
using the Set-DscLocalConfigurationManager
PowerShell cmdlet.
And we're going to specify the path
to the folder that was created when we ran the script
and that's the DscMetaConfigs folder.
And then we'll use the force parameter
to force overriding the local configuration
managed settings.
We'll go ahead and run that.
And then we can navigate back to the Azure Portal
and take a look and see if our node has been registered.
So we'll navigate back to configuration management
and then state configuration.
And we can see that our Windows admin center server
has been registered in our automation account.
All right, that wraps up this demo.
Let's continue on with the lesson.
Now let's take a look at applying configurations.
When the LCM is configured to apply a configuration,
it goes through a bit of a process.
First, the LCM will pull the configuration
on the defined schedule.
And you can also request the LCM to pull a configuration
by running the Update-DscConfiguration
PowerShell cmdlet.
And if the configuration is newer,
it will immediately start to apply the configuration.
Otherwise, it will apply this configuration on its schedule
but you can also trigger the server
to start applying its configuration
using the Start-DscConfiguration PowerShell cmdlet.
And when the LCM applies the configuration,
it goes through 3 steps.
The first step it does is a test
to see if the resource is in the desired state.
And if the resource is in the desired state,
it marks the resource as compliant
and moves onto the next resource.
If the resource is not in the desired state
and the Local Configuration Manager
has been set to allow correction,
the Local Configuration Manager will run set,
in which the Local Configuration Manager
will attempt to bring the resource into the desired state.
And if that succeeds,
the resource will be marked as compliant.
And if it fails, it will be marked as non-compliant.
And later you can get a report on the desired state
by asking the Local Configuration Manager
to run a Get for each resource.
A Get will report on the current configuration status.
Once the configuration is applied,
the LCM will report the compliance back to Azure Automation
and you can view the compliance in Azure Automation.
Let's jump back to our server now,
try out some of these commands,
and view compliance information in the Azure Portal.
All right, so here we are back on our server.
Now, if we want our server to update
the configuration from the pull server,
we can use the Update-DscConfiguration
PowerShell cmdlet.
So we'll go ahead and run that now.
So I'm going to use Update-DscConfiguration
and I'm going to specify to wait
so that I can see the output on the screen
and I'm going to specify the verbose parameter
so I can see verbose output.
And we can see here that no updated configuration
has been found on the pull server.
That's expected because it only recently pulled
the configuration from the server
when we first configured the LCM.
And if we want to manually start the configuration process,
we can do that using Start-DSCConfiguration
and I'm going to use the UseExisting parameter
to specify that it should use the configuration
that it currently has
that it just pulled from the pull server.
I'm going to specify to wait and get verbose output.
And we can see it running its tests
and that it sets if required.
And we can see that it's successfully
applied the configuration.
Now let's take a look at the compliance status
in the Azure Portal.
So we'll flip back to the Azure Portal.
And here we can see our server
is marked as compliant in the Azure Portal.
All right, that wraps up this demo.
Let's take a look at what we've covered in this lesson.
All right, so what have we covered?
An Azure Automation account is designed to act
as a desired state configuration pull server.
The Local Configuration Manager
is responsible for pulling, applying,
and reporting the compliance of a configuration
back to the automation account.
And the configuration will be pulled on the schedule
you've set in the Local Configuration Manager configuration,
but if you want to pull the configuration manually,
you can run the Update-DscConfiguration
PowerShell commandlet to manually pull the configuration
from the automation account.
And you can use the Start-DscConfiguration
PowerShell cmdlet to manually apply a configuration.
And the configuration mode
of the Local Configuration Manager
determines how the configuration is applied.
You can set the configuration to apply only once,
or you can set the configuration to apply
and then monitor for configuration drift.
Or my favorite, you can set the configuration to apply
and automatically correct any issues it finds
when it's applying the configuration.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found this useful
and I look forward to seeing you on the next lesson.