DSC groups question

Freek Brouwer 1

Dear all, I have a question, i`m trying to setup a DSC form for lack of a better name. What i want to do is force that certain local groups remain empty. This as you cannot remove the built-in accounts of course.
I have the following bit below

Freek Brouwer 1

configuration SecurityBaselinev1_0
{ 

    Node localhost
    {


    $array= @(
"Backup Operators"
"Certificate Service DCOM Access"


)

    foreach ($service in $array){

        Group $service
        {
            GroupName        = $service
            Ensure = "Absent"


        }
        }


        LocalConfigurationManager {
            ConfigurationMode  = 'ApplyOnly'
            RebootNodeIfNeeded = $true
        }
    }
}

$cd = @{
    AllNodes = @(
        @{
            NodeName = 'localhost'
            PSDscAllowPlainTextPassword = $true
        }
    )
}

start-dscconfiguration .\SecurityBaselinev1_0 -Verbose -Force -Wait

olufemia-MSFT 2,861 Reputation points

2020-07-21T22:07:18.333+00:00

Hello @Freek Brouwer , is your question related to a DSC-in-cloud scenario (Azure Automation DSC) or DSC On-premise? From the details above, seems to be related to an on-premise scenario but requesting clarification so we know how best to address your question. Looking forward to your response. :)
Freek Brouwer 1 Reputation point

2020-07-22T07:34:09.943+00:00

Dear, the enviroment that im trying to setup is for azure public cloud. The code im using on a VM started on azure.

1 answer

tbgangav-MSFT 10,416 Reputation points

2020-07-26T06:06:31.943+00:00
Hi @Freek Brouwer , Currently Members property in "Group" resource or MembersToInclude property in "GroupSet" resource cannot be empty as they expect at least 1 value so you may submit a feature request here to have a feature to allow empty value for Members property in "Group" resource or MembersToInclude property in "GroupSet" resource.

But to accomplish requirement with resources that are currently available, go with any of below 2 approaches.

Use "Script" resource instead of "Group" / "GroupSet" resource

Use "Group" resource to ensure replace current group membership with only a single particular member as exception

PFA Approach-1.ps1.txt and Approach-2.ps1.txt for configuration files.
Please sign in to rate this answer.
tbgangav-MSFT 10,416 Reputation points

2020-07-26T06:14:55.38+00:00

Note that node name in attached configuration file is provided as "MM-VM-Win2019-2" and Members section is provided as "MM-VM-Win2019-2\mmadmin" which you may replace as appropriate.

For illustration, please check this pdf.

On the other hand, I hope you are already aware of Azure Automation DSC but if not then I would recommend you to go through this document and related next steps documents to understand how to onboard a machine to Azure Automation DSC, compose or import and compile a configuration, view compilation job, view node configuration, remediate non compliant machines, etc.

Freek Brouwer 1 Reputation point

2020-07-29T13:43:49.84+00:00

First of all thank you for taking time to answer my question.
Im partialy to approach 2 as this is easier to setup.
But it is not clear for me what "Members = @("MM-VM-Win2019-2\mmadmin")" does

This only makes sure that the user MM-VM-Win2019-2\mmadmin is present?
How does this force that only 1 user is present in the group?

With kind regards
Freek Brouwer

tbgangav-MSFT 10,416 Reputation points

2020-07-31T13:52:59.337+00:00

Hi @Freek Brouwer , Yes, your understanding is correct! "Members = @("MM-VM-Win2019-2\mmadmin")" makes sure that only user "MM-VM-Win2019-2\mmadmin" is present as member. That is because "Members" property of "Group" resource replaces the current group membership with the specified members (i.e., in this example it replaces current group membership with "MM-VM-Win2019-2\mmadmin").
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

DSC groups question

1 answer

Your answer