Desired Configuration Management

1. Desired Configuration Management Ravi Sankar Technology Evangelist | Microsoft Corporation http://ravisankar.spaces.live.com/blog

2. Session Objectives • DCM Overview • Vision and core scenarios • Terms and concepts • DCM data flow diagram • Admin Tasks • Things to be aware of for 2007 • Service Modeling Language (SML) • DCM 2007 & the DCM Solution for SMS 2003 • Resources

3. Overview: What is DCM? • Vision • DCM will enable customers to define configuration baselines identifying required and prohibited configuration items and audit compliance of Windows systems throughout their IT organizations against those defined baselines. • Core Scenarios: • Detect server configuration “drift” • Improve Helpdesk (HD) troubleshooting and “time-to-resolve” (TTR) • Regulatory compliance reporting • Change verification

4. Overview: Terms & Concepts • Configuration Item (CI) • CIs are units of configuration that can be detected, applied, and removed from ConfigMgr managed machines. • Application CI • Operating System CI • General CI • Software Updates CI • Configuration Baseline • A configuration baseline is a complex type of CI composed of other CIs which are classified as required, optional or prohibited within the baseline. This is the primary unit of administrative work and can be assigned to collections for compliance monitoring.

5. Admin Tasks • Develop configuration knowledge • Author new CIs and Baselines in admin console • Author DCM Digests for import • Import “best practice” CIs and Baselines • Assign Baselines • Review compliance reports • Build query-based collections using DCM compliance state messages

6. Building knowledge – Sources of CI data • Microsoft and other software vendors • Download portal on Microsoft.com • Solutions integrators, consulting services • Line of business application developers • IT personnel

7. Overview: Data flow DCM CIs / Baselines Configuration Items created by importing valid CI documents 1 ConfigMgr Database Windows Server 2003 CI 401K Application CI Antivirus Software CI Compliance State Tables New Configuration Items authored 2 401(k) Application Server Baseline ConfigMgr Admin Console Configuration Baseline defined using CIs 3 ConfigMgr Server Managed Client Configuration baseline assigned to collection 4 6 WMI 5 Compliance state sent to ConfigMgrDatabase for reporting DCM discovers CIs and validates data against rules XML Configuration Manager Client Script Active Directory Registry SQL File IIS Software Updates MSI

8. Building knowledge – Author in ConfigMgr • Author from scratch • Operating System CI • Application CI • General CI • Configuration Baseline • Create Child CI • Inherit from parent (and grandparent and etc…) • Add new rules to inherited objects and settings • Add new settings and objects • Duplicate

9. Building knowledge – Parent/Child CIs • Parent CI • Imported from Microsoft • Defines core settings/objects • and “laws of physics” Copy of Microsoft SQL Server 2005 • Duplicate CI • No link maintained to original. • Full editing capabilities. Microsoft SQL Server 2005 • Child CI • Inherit definition from parent • Add rules to parent settings • and objects • Add new settings/objects • for this child CI only • Duplicate CI • No link to original. • Inheritance from same parent as original. Woodgrove Bank’s Configuration for SQL Server 2005 Best Practices for Microsoft SQL Server 2005 SQL Server for Sales IT SQL Server for HR IT Additional layers of inheritance as required. SQL Server for Sales Reporting Application

10. Service Modeling Language • Built on Service Modeling Language (SML): a modeling language built on XML standards that provides a rich set of constructs for modeling complex IT systems, including: • Structure of the system: objects and relationships • Desired configuration • Administrative policies • Management information such as events and performance counters, rules for determining the operational health of the system, etc • ConfigMgr 2007 will consume the structure and desired configuration portions of SML models as they relate to a single computer system. • SML runtime requires .Net framework 2.x

11. How does DCM use SML? • Prescriptive use of existing XML standards: • XML Schema (XSD): Modeling language for type definitions and invariants • Extensible Stylesheet Language Transformation (XSLT): Type discovery and instance document generation script • Schematron: Instance validation rules using XPath queries and .Net regular expressions • Extensible Markup Language (XML): Type instance documents and exception reports • Run-time engine: • Built on .Net 2.0 framework • Orchestrates (1) type discovery and instance document generation; (2) instance document schema validation; and (3) instance validation to produce exception report • In-memory type and instance store

12. Building knowledge - Import • “Best Practices” knowledge from Microsoft, other software vendors, solutions integrators and internal LOB developers. • DCM Digest • Fully-described DCM CI or Baseline • Human-readable form • DCM generates SML during import • All DCM functionality unlocked for administrator (add to baseline, duplicate, create child) DCM Digest XML Service Modeling Language XML • (2) Complete ConfigMgr CI Document (SML + DCM Digest) • Author can perform more complex operations than can be authored in ConfigMgr admin UI while still exposing as much as possible in the UI • Most DCM functionality unlocked for administrator (add to baseline, create child) • (3) SML Only – No DCM Digest • Author completely controls discovery and rule evaluation. • Limited functionality in DCM (add to baseline)

13. Assign Baselines • Use wizard to assign baselines from Baseline or Collection node • Choose baseline(s) to assign and target collection • Set compliance evaluation schedule or use default schedule

14. Using compliance results • Compliance results sent as XML attachment on state messages • State message severity determined by greatest severity of any failed rule in CI/Baseline • Use DCM Home Page for basic reporting • Launch other reports from Home Page or Reports node • Use Query-based collections based on DCM compliance data to deploy software, scripts, updates or task-sequences

15. DCM 2007 improvements over DCM Solution for 2003 • Model-based and standards-based • Type management & re-use • Version control • Derivation with parent/child CIs • Composition into configuration baselines • Integrated authoring, scheduling and evaluation • Improved performance and scalability • Knowledge ecosystem development • DCM Solution to DCM 2007 conversion tool

16. Resources • Service Modeling Language