How to Configure Windows Server 2016 Desired State Configuration

Desired State Configuration (DSC) is a management platform built into Windows PowerShell that enables administrators to define the intended state of a server through declarative configuration scripts. Rather than writing imperative scripts that perform individual tasks, DSC lets you describe what a system should look like — which features should be installed, which services should be running, which files should exist — and then enforces that state automatically. On Windows Server 2016, DSC is a powerful tool for ensuring consistency across fleets of servers and reducing configuration drift.

This guide covers the fundamentals of setting up and using DSC on Windows Server 2016, including writing your first configuration, compiling it to a MOF file, applying it to a node, and using the Local Configuration Manager to keep the state enforced over time.

Understanding DSC Architecture

DSC operates through three components. The configuration script is a PowerShell script that uses the Configuration keyword to define the desired state. The Local Configuration Manager (LCM) is the engine on each managed node that applies and monitors configurations. DSC resources are the building blocks — modules that know how to configure a specific aspect of a system, such as a Windows Feature, a service, or a registry key.

Configurations can be applied in two modes: Push mode, where an administrator manually sends the compiled configuration to a node; and Pull mode, where nodes periodically contact a central pull server to retrieve and apply their assigned configurations. Push mode is simpler to set up and is the focus of this guide.

Step 1: Verify DSC Is Available

DSC is included with PowerShell on Windows Server 2016. Confirm the version of the DSC engine available on your system:

$PSVersionTable.PSVersion
Get-DscResource

The Get-DscResource command lists all DSC resources currently installed. Built-in resources such as File, Service, WindowsFeature, and Registry are available without installing additional modules.

Step 2: Write a DSC Configuration

Create a new file named WebServerConfig.ps1 and write a configuration that ensures IIS is installed and the World Wide Web Publishing Service is running:

Configuration WebServerConfig {
    param (
        [string[]]$ComputerName = 'localhost'
    )

    Node $ComputerName {
        WindowsFeature IIS {
            Name   = 'Web-Server'
            Ensure = 'Present'
        }

        Service W3SVC {
            Name        = 'W3SVC'
            State       = 'Running'
            StartupType = 'Automatic'
            DependsOn   = '[WindowsFeature]IIS'
        }
    }
}

Save the file, then dot-source it in PowerShell to load the configuration into memory:

. .WebServerConfig.ps1

Step 3: Compile the Configuration to MOF

Invoke the configuration function to compile it into a Managed Object Format (MOF) file. DSC uses MOF as the serialized representation of the desired state:

WebServerConfig -ComputerName localhost -OutputPath C:DSCWebServerConfig

This creates a directory at C:DSCWebServerConfig containing a file named localhost.mof. Inspect the file to see the compiled configuration in MOF syntax.

Step 4: Apply the Configuration

Push the compiled MOF to the local machine using Start-DscConfiguration. The -Wait flag keeps the PowerShell session open until the operation completes, and -Verbose provides detailed progress output:

Start-DscConfiguration -Path C:DSCWebServerConfig -Wait -Verbose -Force

DSC will install IIS if it is missing and ensure the W3SVC service is running. The -Force flag is required if a configuration is already applied and you want to reapply it.

Step 5: Verify the Configuration

After applying, check whether the current state of the node matches the desired state:

Test-DscConfiguration -Verbose

This returns True if all resources are in the desired state and False if any drift has occurred. To see detailed information about what is and is not compliant:

Test-DscConfiguration -Detailed

Step 6: Configure the Local Configuration Manager

The LCM controls how and when DSC applies configurations. Use a meta-configuration to set the LCM behavior. Create a file named LCMConfig.ps1:

[DSCLocalConfigurationManager()]
Configuration LCMConfig {
    Node localhost {
        Settings {
            RefreshMode          = 'Push'
            ConfigurationMode    = 'ApplyAndAutoCorrect'
            RebootNodeIfNeeded   = $false
            ActionAfterReboot    = 'ContinueConfiguration'
        }
    }
}

Compile and apply the LCM configuration:

. .LCMConfig.ps1
LCMConfig -OutputPath C:DSCLCMConfig
Set-DscLocalConfigurationManager -Path C:DSCLCMConfig -Verbose

With ConfigurationMode set to ApplyAndAutoCorrect, the LCM will automatically restore any settings that drift from the desired state on each consistency check cycle, which defaults to every 15 minutes.

Step 7: Check LCM Status

Retrieve the current LCM settings to confirm they were applied correctly:

Get-DscLocalConfigurationManager

Review the LCMState, ConfigurationMode, and RefreshMode fields in the output. You can also inspect the DSC event log for any errors or warnings:

Get-WinEvent -LogName "Microsoft-Windows-Desired State Configuration-File Downloader/Operational" -MaxEvents 20

Using Additional DSC Resources

The PowerShell Gallery provides hundreds of community and Microsoft DSC resource modules. Install the xWebAdministration module, for example, to manage IIS sites and application pools with DSC:

Install-Module xWebAdministration -Force

Once installed, the new resources appear in Get-DscResource output and can be used within configuration scripts just like built-in resources.

Desired State Configuration on Windows Server 2016 transforms server management from a reactive process into a proactive, policy-driven discipline. By declaring what each server should look like and letting the LCM enforce that state continuously, you reduce manual effort, minimize configuration drift, and improve overall environment consistency.