Find out where a Push Server Gets the Configuration From

This topic contains 3 replies, has 3 voices, and was last updated by  Daniel Krebs 3 years, 1 month ago.

  • Author
    Posts
  • #19297

    Craig Martin
    Member

    Working in a Push scenario, I run Start-DscConfiguration to tell the LCM what configuration to run. Once I've done that, the LCM runs that configuration automatically based on the LCM settings.

    Question is; how do I determine where the LCM is getting its configuration?

    For example; if I am investigating a server and was not the person that ran Start-DscConfiguration, how do I find out where the configuration is?

    -Craig

  • #19298

    Dave Wyatt
    Moderator

    Well, the LCM is going to keep a copy of the configuration in $env:SystemRoot\System32\Configuration\current.mof ; it's not getting it from anywhere else after a push has happened.

    If you want to know where the push originally came from, I don't think the LCM keeps that information anywhere (but will double check this when I get a chance). You might be able to find something in the DSC event log, though.

  • #19302

    Craig Martin
    Member

    Perfect! Thanks Dave!

  • #19303

    Daniel Krebs
    Moderator

    Hi Craig,

    You can filter the DSC event log for ID 4102 and find out who pushed the configuration from where and when.

    Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DSC/Operational';Id=4102} | Format-List -Property TimeCreated, Message, UserId
    
    TimeCreated : 02/10/2014 23:08:22
    Message     : Job {3D677BE4-4A78-11E4-82B2-001E4FC0836E} : 
                  Configuration is sent from computer DSC01 by user sid S-1-5-21-605124763-3332917143-1498451686-1234.
    UserId      : S-1-5-21-605124763-3332917143-1498451686-1234
    

    Regards,
    Daniel

You must be logged in to reply to this topic.