• Client Settings must enable the Compliance Settings agent and set the intervals for evaluation.
• Client Settings will usually require the PowerShell Execution Setting in the Computer Agent to be set to Bypass
• Collection for applying these settings
• Configuration Items
• Configuration Baselines to aggregate settings

This is all stuff you can find on TechNet.  What I was unable to find when preparing for a customer recently was some solid advise about best practices around how to organize Compliance Settings (CS).  I wanted to post our solution for those searching in the future.  The customer had a list of items that must be configured a certain way on different server workloads.  Some were basic, systemic OS settings and some were application specific.  The customer has settings crossing all of the categories listed below.  Each category represents a baseline that we created.

• Member Server
• Windows Clusters
• SQL Servers
• Domain Controllers
• SQL Clusters

The primary goal of this project was to make sure we monitored all the settings, but we also wanted to build the CS feature to easily allow future expansion and maximum reusability for Configuration Items (CIs).  We went with a tiered structure and categorized each CI to fit within that structure.  The structure included the following.

• Member Servers - this would include all CIs that are required on all servers hosting a production workload.  CIs applicable to only some OS versions were limited in scope using the Supported Platforms properties of the CIs
• Windows Clusters- this would include the Member Server Baseline and all CIs specific to a Windows Cluster
• SQL Server - this would include the Member Server Baseline and all CIs specific to a SQL server
• SQL Clusters - this would include the Member Server Baseline, SQL Server Baseline and all CI's specific to SQL clusters
• Domain Controllers - this would include the Member Server Baseline and all CIs specific to domain controllers

This type of structure allows us to modify the member sever baseline and have that change drop all the way through the other baselines to define the new standard.  This hierarchy also eases the task of adding another application, like IIS servers.  We simply create CIs specific to the desired IIS configuration and include the member server baseline.  Another benefit to this hierarchy is that when multiple teams are responsible for their own baselines, you can setup security much easier.  The team responsible for SQL or IIS can add or change CIs within their scope and not have to involve other teams.

Hope this helps,

John Taylor

If you install Server Core edition or have removed the Server-Gui-Shell feature from Windows Server 2012 and want to convert to full GUI, you have some additional tasks that you will need to perform.  I attempted to just execute the widely published PowerShell command to convert to full GUI and received the following message.

The installation froze for some time at this stage before showing the error message.

Error Message:

Install-WindowsFeature : The request to add or remove features on the specified server failed.

Installation of one or more roles, role services, or features failed.  The source files could not be downloaded. 

Use the source option to specify the location of the files that are required to restore the feature.

Error: 0x800F0906

The error message says it cannot find the source files to perform the installation. 

I was building a new lab environment and didn’t have the ability to stage the installation files on the network, but that is an option.  My environment was inside a Hyper-V environment on my Windows 8 system, so I needed to pull the files from the disk.  As you know the installation files are located inside the /sources/install.wim file.  To get the Full GUI running, I performed the following steps:

1. Mount the Windows Server 2012 ISO to the host.
2. open an administrative command prompt
3. mkdir c:\mount
4. check your wimfile to determine the correct index for the OS (mine was 4) -the command is dism /get-imageinfo /ImageFile:d:\sources\install.wim
5. ‘dism /mount-wim /wimfile:d:\sources\install.wim /index:4 /mountdir:c:\mount /readonly
6. powershell (enter PowerShell prompt)
7. install-windowsfeature server-gui-mgmt-infra,server-gui-shell –restart –source c:\mount\windows\winsxs
8. Unmount Wim (dism /unmount-wim /mountdir:c:\mount)
9. Remove Mount Directory (rmdir c:\mount)

The seventh command will finish the installation and restart the server when complete.  When the Install-WindowsFeature PowerShell command is executed and the server has internet access, the required files can be downloaded from Windows Update.   Some of these features are very large, so specifying a network location or mounting the installation WIM, using the procedure above, may be the best alternative for installing removed features.

-John