Use Windows PowerShell DSC to construct file servers from scratch
Administrators can take control over the deployment of common resources, such as Windows-based file servers, using PowerShell Desired State Configuration.
It's no secret that automation gives administrators a speedy way to tackle routine tasks while reducing errors from mistyped commands or errant mouse clicks. Desired State Configuration is a powerful extension to Windows PowerShell that goes a step beyond automation.
Windows PowerShell Desired State Configuration (DSC) aims to simplify server deployments through declarative syntax, meaning the administrator tells the system what the server configuration should be rather than constructing every feature.
Using Desired State Configuration, administrators can create a configuration for every server role. By defining servers into roles, administrators can treat a web server or file server as a single entity that contains many different Windows features, security settings, configuration item and so on. Rather than worrying about applying these settings every time, the administrators just need to reference a server role configuration. Other configuration management tools provide automation from a third-party vendor, while Windows PowerShell DSC is a native Microsoft product.
Here's how to build a Windows PowerShell DSC script to provision a file server -- one of various tasks that Windows administrators can automate with the tool.
Determine the configuration
Before embarking on a scripting project, define the plan and make sure all team members understand it. For the purpose of this article, provisioning a file server means:
Installing the File Services feature;
Creating two file shares; and
Setting appropriate permissions on the file shares.
First, install the latest version of Windows Management Framework both on the computer that will create the configuration and on the server being configured.
Next, create a Windows PowerShell DSC template in a file called C:\FileServer.ps1 that will designate the resources to use and will create the node's Managed Object Format file. Name the file server MEMBERSRV1. In this example, we are specifying the server name for the purposes of provisioning a single file server. For organizations that want to prepare multiple file servers, see the instructions for using the ConfigurationData parameter.
Before embarking on a scripting project, define the plan and make sure all team members understand it.
Next, add the file shares. To start, create two folders on the server and then create file shares from them. Do this with the built-in File DSC resource and the xSmbShare module. Because the xSmbShare module for setting up and configuring a Server Message Block (SMB) shared folder is not a default resource, we download it from the PowerShell Gallery. To do that, create a remote session to the server and install the module containing the resource.
Next, set permissions on the file shares with NT file system (NTFS) Associating Access Control Lists. To do this, download another useful DSC module from the PowerShell Gallery: cNtfsAccessControl. It's available via the same access method used for xSmbShare. Include this additional module in the Import-DscResource line.
Next, tailor permissions to the file shares. We will give the domain's authenticated users read-only access to the base folder for each file share. To do that, reference the cNtfsPermissionEntry resource, specify the principal of Authenticated Users, the path to the folder and the specific rights to give this identity.
cNtfsPermissionEntry 'FileShare1' {
Ensure = 'Present'
DependsOn = "[File]Share1Folder"
Principal = 'Authenticated Users'
Path = 'C:\FileShare1'
AccessControlInformation = @(
cNtfsAccessControlInformation
{
AccessControlType = 'Allow'
FileSystemRights = 'Read'
Inheritance = 'ThisFolderSubfoldersAndFiles'
NoPropagateInherit = $false
}
)
}
cNtfsPermissionEntry 'FileShare2' {
Ensure = 'Present'
DependsOn = "[File]Share2Folder"
Principal = 'Authenticated Users'
Path = 'C:\FileShare2'
AccessControlInformation = @(
cNtfsAccessControlInformation
{
AccessControlType = 'Allow'
FileSystemRights = 'Read'
Inheritance = 'ThisFolderSubfoldersAndFiles'
NoPropagateInherit = $false
}
)
}
Now that all these instructions are set, run this Windows PowerShell DSC configuration on the soon-to-be file server. This will run the instructions on the remote server and provision the file server.
