{"id":17780,"date":"2019-06-07T02:32:12","date_gmt":"2019-06-07T10:32:12","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/powershell\/?p=17780"},"modified":"2020-09-09T12:07:20","modified_gmt":"2020-09-09T20:07:20","slug":"azure-policy-guest-configuration-client","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/azure-policy-guest-configuration-client\/","title":{"rendered":"Azure Policy Guest Configuration – Client"},"content":{"rendered":"

This post builds upon the introduction published\u00a0<\/span>earlier\u00a0<\/span>to the PowerShell blog<\/span><\/a>.<\/span>\u00a0<\/span>In this post we are going to explore the Azure Policy Guest Configuration client<\/span>\u00a0<\/span>and how configuration content is consumed.<\/span>\u00a0<\/span><\/p>\n

The full documentation for this service is available at the following short\u00a0url.<\/span>\u00a0<\/span><\/p>\n

https:\/\/aka.ms\/gcpol<\/span><\/a>\u00a0<\/span><\/p>\n

[Updated 9\/9\/2020 with changed file\/folder names]<\/p>\n

GC service\/daemon<\/span><\/b>\u00a0<\/span><\/h3>\n

Inside Azure Policy Guest Configuration,<\/span>\u00a0<\/span>you will find the new DSC engine as part of the extension<\/span>\u00a0<\/span>for virtual machines.<\/span>\u00a0<\/span>You can see this using the<\/span>\u00a0<\/span>\u201c<\/span>Run Command<\/span>\u201d<\/span>\u00a0<\/span>feature in Azure<\/span>\u00a0<\/span>for any virtual machine that is being audited by Azure Policy<\/span>\u00a0<\/span>using one of the Guest Configuration initiatives.<\/span>\u00a0<\/span><\/p>\n

The structure of the agent folders is the same for both operating systems.<\/span>\u00a0<\/span>You will find a folder <\/span>that contains the binaries for the engine,<\/span>\u00a0<\/span>a folder named<\/span>\u00a0<\/span>\u201c<\/span>logs<\/span>\u201d<\/span>\u00a0<\/span>containing logs generated by the engine,<\/span>\u00a0<\/span>and a subfolder named<\/span>\u00a0<\/span>\u201c<\/span>downloads<\/span>\u201d<\/span>\u00a0<\/span>that is used to support additional requirements.<\/span>\u00a0<\/span><\/p>\n

Here are some example commands you can use to\u00a0take a look<\/span>\u00a0<\/span>at the new DSC engine yourself.<\/span>\u00a0<\/span><\/p>\n

Windows<\/span><\/b>\u00a0<\/span><\/h4>\n

The Guest Configuration extension for Windows has not been published to GitHub yet.<\/span><\/p>\n

List the binaries in Guest Configuration in Windows<\/span><\/b>\u00a0<\/span><\/p>\n

Command (note the version is current at this time but could change):<\/span><\/p>\n

dir 'C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\1.28.3.0\\dsc\\GC\\'<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
    Directory: C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\1.28.3.0\\dsc\\GC\r\n\r\n\r\nMode                LastWriteTime         Length Name                                                                  \r\n----                -------------         ------ ----                                                                  \r\n-a----        7\/20\/2020   7:12 PM        1843712 gclib.dll                                                             \r\n-a----        7\/20\/2020   7:16 PM         204800 gc_cache_operations.dll                                               \r\n-a----        7\/20\/2020   7:03 PM         534528 gc_diagnostics.dll                                                    \r\n-a----        7\/20\/2020   7:01 PM         572416 gc_infrastructure.dll                                                 \r\n-a----        7\/20\/2020   7:05 PM          70144 gc_operations.dll                                                     \r\n-a----        7\/20\/2020   7:07 PM        2157056 gc_pull_client.dll                                                    \r\n-a----        7\/20\/2020   7:08 PM         463360 gc_reporting.dll                                                      \r\n-a----        7\/20\/2020   7:04 PM         459776 gc_security_tools.dll                                                 \r\n-a----        7\/20\/2020   7:18 PM         358400 gc_service.exe                                                        \r\n-a----        7\/20\/2020   7:14 PM         618496 gc_timer.dll                                                          \r\n-a----        7\/20\/2020   7:16 PM         213504 gc_timer_operations.dll                                               \r\n-a----        7\/20\/2020   7:17 PM         268288 gc_worker.exe                                                         \r\n-a----        7\/20\/2020   7:04 PM         398336 gc_worker_manager.dll  <\/span><\/pre>\n
You will also find an instance of pwsh.exe and supporting files in this same (version specific) folder. That is because Guest Configuration includes the portable installation of PowerShell Core so there is no need to manage PowerShell versions for the system.<\/span>\u00a0<\/span><\/p>\n
View the details of the DSC service in Guest Configuration in Windows<\/span><\/b>\u00a0<\/span><\/p>\n
Command:<\/span>\u00a0<\/span><\/p>\n
Get-Service<\/span> GCService | <\/span>fl<\/span>\u00a0*<\/span>\u00a0<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : GCService<\/span><\/code>\nRequiredServices\u00a0\u00a0\u00a0 :\u00a0{}<\/span><\/code>\nCanPauseAndContinue\u00a0: False<\/span><\/code>\nCanShutdown\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0False<\/span><\/code>\nCanStop\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0True<\/span><\/code>\nDisplayName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0Guest Configuration Service<\/span><\/code>\nDependentServices\u00a0\u00a0 :\u00a0{}<\/span><\/code>\nMachineName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0.<\/span><\/code>\nServiceName\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 : GCService<\/span><\/code>\nServicesDependedOn\u00a0 : {}<\/span><\/code>\nServiceHandle\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0SafeServiceHandle<\/span><\/code>\nStatus\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0Running<\/span><\/code>\nServiceType\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0Win32OwnProcess<\/span><\/code>\nStartType\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :\u00a0Automatic<\/span><\/code>\nSite\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span><\/code>\nContainer\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span>\u00a0<\/span><\/code><\/p>\n
Linux<\/span><\/b>\u00a0<\/span><\/h4>\n
The Guest Configuration extension for Linux is published in GitHub<\/span>\u00a0<\/span>here<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n
List the binaries in Guest Configuration in Linux<\/span><\/b>\u00a0<\/span><\/p>\n
Command (note the version is current at this time but could change):<\/span>\u00a0<\/span><\/p>\n
sudo ls \/var\/lib\/waagent\/Microsoft.GuestConfiguration.ConfigurationforLinux-1.25.5\/GCAgent\/GC\/gc_*<\/span>\u00a0<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
[stdout]\n<\/span><\/code>\/var\/lib\/waagent\/Microsoft.GuestConfiguration.ConfigurationforLinux-1.25.5\/GCAgent\/GC\/gc_linux_service \/var\/lib\/waagent\/Microsoft.GuestConfiguration.ConfigurationforLinux-1.25.5\/GCAgent\/GC\/gc_worker<\/span><\/p>\n
Currently, Guest Configuration in Linux is only supporting content in the format of Chef InSpec profiles. We expect this to soon open to PowerShell-based resources and other tool formats.<\/span>\u00a0<\/span><\/p>\n
View the details of the GC service in Guest Configuration in Linux<\/span><\/b>\u00a0<\/span><\/p>\n
Command:<\/span>\u00a0<\/span><\/p>\n
systemctl<\/span> status gcd.service<\/span>\u00a0<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
[stdout]\r\n\u25cf gcd.service - DSC Service\r\n   Loaded: loaded (\/lib\/systemd\/system\/gcd.service; enabled; vendor preset: enabled)\r\n   Active: active (running) since Wed 2020-09-09 16:43:12 UTC; 2h 38min ago\r\n Main PID: 4035 (gc_linux_servic)\r\n    Tasks: 42 (limit: 4075)\r\n   CGroup: \/system.slice\/gcd.service\r\n           \u2514\u25004035 \/var\/lib\/waagent\/Microsoft.GuestConfiguration.ConfigurationforLinux-1.25.5\/GCAgent\/GC\/gc_linux_service\r\n\r\nSep 09 16:43:12 ub0 systemd[1]: gcd.service: Service hold-off time over, scheduling restart.\r\nSep 09 16:43:12 ub0 systemd[1]: gcd.service: Scheduled restart job, restart counter is at 4.\r\nSep 09 16:43:12 ub0 systemd[1]: Stopped DSC Service.\r\nSep 09 16:43:12 ub0 systemd[1]: Started DSC Service.\r\nSep 09 16:43:12 ub0 gc_linux_service[4035]: Running DSC rest server...<\/span><\/pre>\n
Configurations<\/span><\/b>\u00a0<\/span><\/h3>\n
Configurations in Guest Configuration are managed in a whole new way.<\/span>\u00a0<\/span>There is no longer a need for partial configurations<\/span>\u00a0<\/span>because many configurations can be managed independently.<\/span>\u00a0<\/span><\/p>\n
Please keep in mind that currently,<\/span>\u00a0<\/span>configurations are used only for auditing settings<\/span>\u00a0<\/span>and not enforcing the configuration.<\/span>\u00a0<\/span><\/p>\n
The model for Guest Configuration takes lessons learned<\/span>\u00a0<\/span>from both the DSC Extension and State Configuration service.<\/span>\u00a0<\/span>The Guest Configuration service does not require or support<\/span>\u00a0<\/span>uploading and storing assets in the service,<\/span>\u00a0<\/span>or a compilation service.<\/span>\u00a0<\/span>Configurations are packaged in .zip format<\/span>\u00a0<\/span>as they were for DSC Extension.<\/span>\u00a0<\/span>A Guest Assignment in the Guest Configuration<\/span>\u00a0<\/span>resource provider includes a reference to the location<\/span>\u00a0<\/span>of the package,<\/span>\u00a0<\/span>a hash value of the package file,<\/span>\u00a0<\/span>and a table of parameters to be passed to the engine when the configuration is executed.<\/span>\u00a0<\/span><\/p>\n
For content provided by Microsoft,<\/span>\u00a0<\/span>the configuration content managed and replicated globally.<\/span>\u00a0<\/span>When the package is downloaded to the machine,<\/span>\u00a0<\/span>it is decompressed and extracted to a local folder.<\/span>\u00a0<\/span><\/p>\n
Each folder contains everything needed for DSC<\/span>\u00a0<\/span>to manage\u00a0<\/span>th<\/span>e<\/span>\u00a0<\/span>configuration including<\/span>\u00a0<\/span>the\u00a0<\/span>mof<\/span>, any resources required, and the\u00a0<\/span>metaconfiguration<\/span>\u00a0<\/span>to use for that configuration.<\/span>\u00a0<\/span>This means the mode, frequency, and other LCM settings can be unique<\/span>\u00a0<\/span>per configuration.<\/span>\u00a0<\/span><\/p>\n
View configuration content in Windows<\/span><\/b>\u00a0<\/span><\/p>\n
In this test case, the server is in scope of multiple audit policies.<\/span>\u00a0<\/span><\/p>\n
Command:<\/span>\u00a0<\/span>\r\n\r\ndir c:\\programdata\\GuestConfig\\Configuration\\<\/span>\u00a0<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
\u00a0Directory: C:\\programdata\\GuestConfig\\Configuration<\/span><\/code><\/p>\n
Mode\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0LastWriteTime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Length Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\n----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -------------\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ------ ----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:03 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsDefenderExploitGuard\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:03 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsDscConfiguration\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:03 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0windowsfirewallenabled\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:03 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsLogAnalyticsAgentConnection\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:03 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsPendingReboot\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:04 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsPowerShellModules\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/code>\nd-----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6\/5\/2019\u00a0\u00a0 1:04 PM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0WindowsTimeZone\u00a0\u00a0<\/code>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n
View configuration content in Linux<\/span><\/b>\u00a0<\/span><\/p>\n
In this test case, the server is in scope of only one audit policy.<\/span>\u00a0<\/span><\/p>\n
Command:<\/span>\u00a0<\/span><\/p>\n
sudo ls<\/span>\u00a0\/var\/lib\/GuestConfig\/Configuration<\/span>\u00a0<\/span><\/code><\/pre>\n
Result:<\/span>\u00a0<\/span><\/p>\n
[<\/span>stdout<\/span>]<\/span><\/code>\nfirewalldenabled<\/span>\u00a0<\/span><\/code><\/p>\n
Logs<\/span><\/b>\u00a0<\/span><\/h3>\n
Log output is available on each node within the agent folder named<\/span>\u00a0<\/span>\u201c<\/span>Logs<\/span>\u201d<\/span>.<\/span>\u00a0<\/span>This can also be returned using<\/span>\u00a0<\/span>\u201c<\/span>Run Command<\/span>\u201d<\/span>,<\/span>\u00a0<\/span>however the output is limited to the last 4096\u00a0bytes\u00a0so it is best<\/span>\u00a0<\/span>to filter the logs to only what you are looking for.<\/span>\u00a0<\/span>Examples approaches are given below.<\/span>\u00a0<\/span><\/p>\n
View error messages in Windows logs<\/span><\/b>\u00a0<\/span><\/p>\n
Command (note the version is current at this time but could change):<\/span><\/p>\n
Select-String -Path 'C:\\programdata\\GuestConfig\\gc_agent_logs\\gc_agent.log' -pattern 'DSC*Engine' -CaseSensitive -Context 0,5<\/span><\/pre>\n
Result (this is a short snippet of the actual output):<\/span>\u00a0<\/span><\/p>\n
[INFO] [00000000-0000-0000-0000-000000000000] Job\u00a0<\/span><\/code>\n3af0538a-35f4-415f-b5b8-70ae3099e6a2 :\u00a0Operation Get-DscConfiguration\u00a0<\/span><\/code>\ncompleted successfully.<\/span>\u00a0<\/span><\/code><\/p>\n
\n
<\/code><\/div>\n<\/div>\n
View error messages in Linux logs<\/span><\/b>\u00a0<\/span><\/p>\n
Command (note the version is current at this time but could change):<\/span>\u00a0<\/span><\/p>\n
grep -A 5 'DSC*Engine' \/var\/lib\/GuestConfig\/gc_agent_logs\/gc_agent.log<\/pre>\n
Result (this is a short snippet of the actual output):<\/span>\u00a0<\/span><\/p>\n
[<\/span>2019-06-05<\/span>\u00a018:14:22.772] [PID 30775] [TID 30824] [DSCEngine] [INFO] [00000000-0000-0000-0000-000000000000] Job 6ae51953-24aa-44e8-8abb-4ec522cc5b1f :\u00a0Method\u00a0CU_TestConfiguration\u00a0ended successfully<\/span>\u00a0<\/span><\/code><\/p>\n
<\/code><\/p>\n
Thank you!<\/span>\nMichael Greene<\/span>\nPrincipal Program Manger<\/span>\nMicrosoft Azure<\/span>\n@migreene<\/span><\/a>\u00a0<\/span><\/p>\n
\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"
This post builds upon the introduction published\u00a0earlier\u00a0to the PowerShell blog.\u00a0In this post we are going to explore the Azure Policy Guest Configuration client\u00a0and how configuration content is consumed.\u00a0<\/p>\n","protected":false},"author":658,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[142],"class_list":["post-17780","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell","tag-desired-state-configuration"],"acf":[],"blog_post_summary":"
This post builds upon the introduction published\u00a0earlier\u00a0to the PowerShell blog.\u00a0In this post we are going to explore the Azure Policy Guest Configuration client\u00a0and how configuration content is consumed.\u00a0<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/17780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/658"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=17780"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/17780\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=17780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=17780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=17780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}