Skip to content

LCM Validation

Validating Node Compliance

The Local Configuration Manager (LCM) ensures nodes adhere to desired configurations. Validating compliance confirms whether a node meets its configuration baseline. Use Test-DscConfiguration to verify compliance without applying changes. This cmdlet compares the current state of resources against the desired state defined in DSC configurations.

Example: Validate compliance against a configuration 

Test-DscConfiguration -ConfigurationData .\ConfigData.psd1

Output Interpretation: - True: The node is compliant. - False: The node is non-compliant; use -Detailed to identify failing resources. - Errors: Provide detailed information about resource-specific issues.

LCM Diagnostic Logs

LCM logs are critical for troubleshooting configuration drift or failures. Logs are stored in the Application event log under Microsoft-Windows-DSC. Use Get-WinEvent to query these logs or Get-DscConfiguration to retrieve the current LCM state.

Example: Retrieve LCM status 

Get-DscConfiguration

Example: Analyze LCM logs for errors 

Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-DSC'; ID=4104, 4105}

Key Log Entries: - Event ID 4104: Indicates a configuration drift (node is non-compliant). - Event ID 4105: Indicates a configuration failure during application. - Event ID 4106: Indicates a successful configuration application.

Troubleshooting Common LCM Errors

  1. Configuration Drift: Use Test-DscConfiguration to identify non-compliant resources. For example: 

    Test-DscConfiguration -ConfigurationData .\ConfigData.psd1 -Detailed
    This outputs a list of resources that failed validation.

  2. Resource-Specific Errors: Check the Error property in Get-DscConfiguration for detailed error messages. For instance: 

    Get-DscConfiguration | Select-Object -ExpandProperty Error

  3. LCM Service Issues: Ensure the DSCService is running: 

    Get-Service DSCService | Select-Object Status, Name
    Restart the service if necessary: 
    Restart-Service DSCService

  4. Configuration Data Mismatches: Verify that the ConfigurationData file referenced in Test-DscConfiguration exists and is correctly formatted.

Key takeaways

  • Use Test-DscConfiguration to validate node compliance and identify failing resources.
  • Query LCM logs via Get-WinEvent or Get-DscConfiguration to diagnose configuration drift or errors.
  • Common issues include resource errors, configuration data mismatches, and LCM service failures.
  • Always use -Detailed with Test-DscConfiguration to pinpoint non-compliant resources.
  • Regularly monitor event logs for Event IDs 4104, 4105, and 4106 to proactively address compliance issues.