The goal of this article is to help people interested in learning how to use PowerShell Desired State Configuration (DSC) to configure their SharePoint environment get started. While it is totally possible for you to configure a SharePoint Farm on an environment that has PowerShell 4.0 installed on, it is our recommendation that you try to use PowerShell 5+ as much as possible, as it offers a lot of improvements on the DSC side. The example covered in this article will be a Single Server SharePoint 2016 farm deployed with SQL Server 2016, on Windows Server 2016. We will be using DSC in push mode, meaning that we will manually execute the Start-DSCConfiguration cmdlet on the environment, and will ensure all dependent DSC Modules are put on the server prior to attempting to configure it.
The end-goal for this article, is to have a brand new Windows Server 2016 virtual machine with nothing on it to begin with, and then let DSC do the following automatically:
- Install and configure Active Directory Domain Services;
- Create all required SharePoint accounts;
- Install SQL Server 2016;
- Install the SharePoint 2016 Prerequisites;
- Install SharePoint 2016;
- Install the SharePoint 2016 French Language Pack;
- Install the SharePoint 2016 Security Update (KB3115299); This update needs to be extracted in the updates folder of the SharePoint installation (slipstreamed).
- Configure the SharePoint Farm;
The binaries to install SharePoint and SQL Server will be put on a Shared location, to which our Virtual Machine will have access to. Also, the Security Update (KB3115299) is required for the farm to get properly configured. Without it, you will get the following error thrown when calling the SPFarm DSC Block (at the New-SPConfigurationDatabase step): An error occurred while getting information about the user sp_farm at server contoso.com: The RPC server is unavailable. This installation will be slipstreamed within the SharePoint 2016 installation binaries.
Prerequisites
In this section we will cover the various prerequisites that have to be in place before initiating the DSC configuration.
Shared Location
In the current example, I will create a first Virtual Machine that will act as a file server. The SharePoint 2016 binaries, the SQL Server 2016 binaries, the Windows SXS folder, and the SharePoint 2016 language packs will be put on it. The Virtual Machine will be named DSC-Share, and will expose the following Shared Folders:
- \\DSC-Share\Media\SP2016Binaries
- \\DSC-Share\Media\SP2016LanguagePack
- \\DSC-Share\Media\SQL2016Binaries
- \\DSC-Share\Media\SXS (Needs to contain the SXS content of the Windows Server 2012 R2 installation Media)
SharePoint 2016 and SQL 2016 Binaries on Shared Drive
The SXS folder contains the /Sources/SXS content from the Windows Server 2012 R2 installation media. It contains files that are required by the Prerequisites installer to install the .NET 3.5 components. During the DSC process, the SXS folder will be copied from the Remote Network Share onto the local disk. This is required for the Windows Feature to be properly installed on the local server.
Also, it is important for you to extract the Language pack in the specified folder. By default, when you download a SharePoint language pack, you get a file called serverlanguagepack.exe, however that won’t work with SharePointDSC. In order to properly extract its content you need to run the following command: .\serverlanguagepack.exe /extract:path. This will generate the folder structure expected by SharePointDSC.
SharePoint Virtual Machine
When I said earlier that the goal of this article was to start with a plain vanilla Virtual Machine with nothing installed on it….I lied. Just a tiny bit. Because we will be using DSC in Push mode for our example, the destination server (in my case named DSC-SP) needs to have all the required DSC modules installed on it first. The modules required for our example are the following:
- xActiveDirectory
- xNetworking
- xSQLServer
- SharePointDSC
The steps to get these properly installed on your server will differ depending on whether or not your Virtual Machine has internet connectivity or not.
Virtual Machine has Internet Connectivity
If your SharePoint server Virtual Machine has internet connectivity, then you are in luck. With the help of the Package Management component of PowerShell 5+, you can simply run the following cmdlets to have PowerShell automatically download the modules from the PowerShell Gallery:
Install-Module xActiveDirectory -Force Install-Module xNetworking -Force Install-Module xSQLServer -Force Install-Module SharePointDSC -Force
Virtual Machine without Internet Connectivity
If your Virtual Machine doesn’t have internet connectivity, then you will have to manually copy the required modules inside the PowerShell modules repository. The easiest way to do that, is to download all the required module from a machine that has internet connectivity (see section just above), and then copy the downloaded modules manually onto the server. When you call the Install-Module cmdlet, PowerShell actually installs the specified module in C:\Program Files\WindowsPowerShell\Modules. Simply make sure you copy all the folders from that machine that has internet connectivity and from where you executed the Install-Module cmdlets, over to your SharePoint Virtual Machine, under the same path.
PowerShell DSC Modules
Set Network Share as being Part of the Intranet Zone
By default, the network share won’t be recognized as a trusted location. If you were to navigate to it from your SharePoint server and try to execute a program from it, you will get prompted with a Security Warning prompt that allows you to trust the file. PowerShell DSC is faced with the same issue in the background and this actually causes the process to hang. In order for PowerShell Desired State Configuration to be able to properly execute remote executable such as the SharePoint Prerequisite Installer, you need to add your network share to the Intranet zone in Internet Explorer. Simply launch the IE options, switch to the security tab, select Intranet, click on Sites and add the path to your network share (in my case file://dsc-share).
The Script
The following DSC script will be used to configure our environment. Its variables will be passed as Configuration data (defined in the next section below). The script itself is very self-explanatory and I will not go over each section in details. Note that for an offline installation, the script expects to see the following files in the prerequisiteinstallerfile folder in the root of your SharePoint 2016 binary installation folder:
- AppFabric-KB3092423-x64-ENU.exe
- dotNetFx45_Full_setup.exe
- MicrosoftIdentityExtensions-64.msi
- NDP453-KB2969351-x86-x64-AllOS-ENU.exe
- setup_msipc_x64.exe
- sqlncli.msi
- Synchronization.msi
- vc_redist.x64.exe
- vcredist_x64.exe
- WcfDataServices.exe
- WindowsServerAppFabricSetup_x64.exe
SharePoint 2016 Prerequisites
You will also notice that at the bottom of the screen there is a section that will automatically compile a Meta-Mof file to configure the Local Configuration Manager (LCM) process on that machine so that it will automatically reboot the server when needed (prerequisites, domain-join, etc.) and automatically pickup the configuration where it left it upon being restarted.
SPStandAlone.ps1
Configuration SPStandAlone
{
Import-DscResource -ModuleName PSDesiredStateConfiguration
Import-DscResource -ModuleName xActiveDirectory
Import-DSCResource -ModuleName xNetworking
Import-DSCResource -ModuleName xSQLServer
Import-DscResource -ModuleName SharePointDSC
#region Credentials
$Script:FarmAdmin = Get-Credential -Username "contoso\sp_farm" -Message "Farm Admin"
$Script:FarmDomainAdmin = Get-Credential -Username "contoso\administrator" -Message "Domain Administrator"
#endregion
node $AllNodes.NodeName
{
xFireWall SQLFirewallRule
{
Name = "AllowSQLConnection"
DisplayName = 'Allow SQL Connection'
Group = 'DSC Configuration Rules'
Ensure = 'Present'
Enabled = 'True'
Profile = ('Domain')
Direction = 'InBound'
LocalPort = ('1433')
Protocol = 'TCP'
Description = 'Firewall Rule to allow SQL communication'
DependsOn = @("[xADDomain]Domain","[xADUser]FarmAdmin")
}
WindowsFeature ADDS
{
Name = "AD-Domain-Services"
IncludeAllSubFeature = $true
Ensure = "Present"
}
WindowsFeature ADDSTools
{
Name = 'RSAT-AD-Tools'
IncludeAllSubFeature = $true
Ensure = "Present"
}
xADDomain Domain
{
DomainName = $AllNodes.DomainName
DomainAdministratorCredential = $Script:FarmDomainAdmin
SafemodeAdministratorPassword = $Script:FarmDomainAdmin
DependsOn = "[WindowsFeature]ADDS"
}
xADUser FarmAdmin
{
DomainName = $AllNodes.DomainName
Username = $Script:FarmAdmin.UserName.Replace(($AllNodes.DomainNetBIOS + "\"),"")
Password = $Script:FarmAdmin
PasswordNeverExpires = $true
DependsOn = "[xADDomain]Domain"
}
xSQLServerSetup SQLSetup
{
InstanceName = "MSSQLServer"
SourcePath = $AllNodes.SQLBinaryPath
Features = "SQLENGINE"
InstallSharedDir = "C:\Program Files\Microsoft SQL Server"
SQLSysAdminAccounts = $Script:FarmAdmin.UserName
SQLSvcAccount = $Script:FarmDomainAdmin
AgtSvcAccount = $Script:FarmDomainAdmin
PSDscRunAsCredential = $Script:FarmDomainAdmin
DependsOn = @("[xADDomain]Domain","[xADUser]FarmAdmin","[xFirewall]SQLFirewallRule")
}
File SXSFolder
{
SourcePath = $AllNodes.SXSRemotePath
Type = "Directory"
DestinationPath = $AllNodes.SxsLocalPath
Recurse = $true;
Credential = $Script:FarmDomainAdmin
Force = $true
PSDSCRunAsCredential = $Script:FarmDomainAdmin
}
SPInstallPrereqs SPPrereqs
{
InstallerPath = $AllNodes.SharePointBinaryPath + "\prerequisiteinstaller.exe"
OnlineMode = $false
SQLNCli = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\sqlncli.msi"
DOTNETFX = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\dotNetfx45_Full_setup.exe"
NETFX = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\NDP453-KB2969351-x86-x64-AllOS-ENU.exe"
Sync = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\Synchronization.msi"
AppFabric = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\WindowsServerAppFabricSetup_x64.exe"
IDFX11 = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\MicrosoftIdentityExtensions-64.msi"
MSIPCClient = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\setup_msipc_x64.exe"
WCFDataServices56 = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\WcfDataServices.exe"
KB3092423 = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\AppFabric-KB3092423-x64-ENU.exe"
MSVCRT11 = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\vcredist_x64.exe"
MSVCRT14 = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\vc_redist.x64.exe"
ODBC = $AllNodes.SharePointBinaryPath + "\prerequisiteinstallerfiles\msodbcsql.msi"
DependsOn = @("[xSQLServerSetup]SQLSetup","[File]SXSFolder")
SXSPath = $AllNodes.SXSLocalPath
PSDSCRunAsCredential = $Script:FarmDomainAdmin
}
SPInstall InstallSharePoint
{
Ensure = "Present"
BinaryDir = $AllNodes.SharePointBinaryPath
ProductKey = $AllNodes.ProductKey
DependsOn = @("[SPInstallPrereqs]SPPrereqs", "[xFirewall]SQLFirewallRule")
PSDSCRunasCredential = $Script:FarmDomainAdmin
}
SPInstallLanguagePack InstallLPBinaries
{
BinaryDir = $AllNodes.LanguagePackPath
Ensure = "Present"
DependsOn = "[SPInstall]InstallSharePoint"
PsDscRunAsCredential = $Script:FarmDomainAdmin
}
SPFarm SharePointFarm
{
Passphrase = New-Object System.Management.Automation.PSCredential ('Passphrase', (ConvertTo-SecureString $AllNodes.Passphrase -AsPlainText -Force));
AdminContentDatabaseName = "SP2016_CENTRAL_ADMIN";
FarmAccount = $Script:FarmAdmin;
FarmConfigDatabaseName = "SP2016_Config";
CentralAdministrationPort = 7777;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
CentralAdministrationAuth = "NTLM";
RunCentralAdmin = $True;
ServerRole = "SingleServerFarm"
Ensure = "Present";
DatabaseServer = $AllNodes.NodeName;
DependsOn = @("[SPInstallLanguagePack]InstallLPBinaries");
}
SPManagedAccount b3c4904a-3e85-4ddd-896b-1359901667e7
{
Account = $Script:FarmAdmin;
AccountName = $Script:FarmAdmin.Username;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
Ensure = "Present";
EmailNotification = 5;
PreExpireDays = 2;
}
SPServiceAppPool SearchServiceAppPool
{
Name = "SP2016-Search";
ServiceAccount = $Script:FarmAdmin.Username;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
Ensure = "Present";
}
SPWebApplication SP2016
{
DatabaseName = "SP2016-Content";
Url = "http://" + $AllNodes.NodeName + "/";
ApplicationPool = "SP2016-AppPool";
Path = "C:\inetpub\wwwroot\wss\VirtualDirectories\80";
UseSSL = $False;
AllowAnonymous = $False;
Name = "SP2016";
AuthenticationMethod = "NTLM";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
ApplicationPoolAccount = $Script:FarmAdmin.Username;
Ensure = "Present";
Port = "80";
DatabaseServer = $AllNodes.NodeName;
AuthenticationProvider = "Windows Authentication";
}
SPServiceAppPool MMS
{
Name = "MMS";
ServiceAccount = $Script:FarmAdmin.Username;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
Ensure = "Present";
}
SPContentDatabase SP2016-Content
{
Enabled = $True;
MaximumSiteCount = 5000;
Name = "SP2016-Content";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
WarningSiteCount = 2000;
DatabaseServer = $AllNodes.NodeName;
WebAppUrl = "http://" + $AllNodes.NodeName;
}
SPQuotaTemplate 10bac15d-d097-471a-b09c-82a63d1818bb
{
Name = "10GB";
MaximumUsagePointsSolutions = 300;
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
StorageMaxInMB = 10240;
WarningUsagePointsSolutions = 275;
StorageWarningInMB = 8192;
}
SPSite 50721b23-6892-4353-a104-814a4295ea42
{
OwnerAlias = $Script:FarmAdmin.Username;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
Url = "http://" + $AllNodes.NodeName
Language = 1033;
QuotaTemplate = "10GB";
CompatibilityLevel = 15;
Template = "STS#0";
ContentDatabase = "SP2016-Content";
DependsOn = @("[SPWebApplication]SP2016");
}
SPSite 50721b23-6892-4353-a104-814a2395ea42
{
OwnerAlias = $Script:FarmAdmin.Username;
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
Url = "http://" + $AllNodes.NodeName + "/sites/searchcenter"
Language = 1033;
QuotaTemplate = "10GB";
CompatibilityLevel = 15;
Template = "SRCHCEN#0";
ContentDatabase = "SP2016-Content";
DependsOn = @("[SPWebApplication]SP2016");
}
SPServiceInstance CentralAdministrationInstance
{
Name = "Central Administration";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance ManagedMetadataWebServiceInstance
{
Name = "Managed Metadata Web Service";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance MicrosoftSharePointFoundationIncomingE-MailInstance
{
Name = "Microsoft SharePoint Foundation Incoming E-Mail";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance MicrosoftSharePointFoundationWebApplicationInstance
{
Name = "Microsoft SharePoint Foundation Web Application";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance MicrosoftSharePointFoundationWorkflowTimerServiceInstance
{
Name = "Microsoft SharePoint Foundation Workflow Timer Service";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance SearchHostControllerServiceInstance
{
Name = "Search Host Controller Service";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance SearchQueryandSiteSettingsServiceInstance
{
Name = "Search Query and Site Settings Service";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance SharePointServerSearchInstance
{
Name = "SharePoint Server Search";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
SPServiceInstance UserProfileServiceInstance
{
Name = "User Profile Service";
Ensure = "Present";
PsDSCRunAsCredential = $Script:FarmDomainAdmin;
}
}
}
#region LCM Config
[DSCLocalConfigurationManager()]
Configuration LCMConfig
{
Node $env:ComputerName
{
Settings
{
ActionAfterReboot = 'ContinueConfiguration';
RebootNodeIfNeeded = $true;
}
}
}
LCMConfig
Set-DscLocalConfigurationManager LCMConfig -Force -Verbose
#endregion
SPStandAlone -ConfigurationData .\SPStandAlone-ConfigData.psd1
The Configuration Data
If you pay close attention to the last line of the script above, you’ll notice that upon calling our DSC Configuration’s name (in our case SPStandAlone), that we are passing it a path to a .psd1 file for the -ConfigurationData parameter. This basically tells PowerShell Desired State Configuration that it needs to read the variables contained in that .psd1 file in order to properly compile itself.
That PowerShell Data File (.psd1) is where we will specify all of the variables for our environment. This allows us to keep the .ps1 script generic so that it can be used to generate 100’s of Virtual Machines having the same configuration without having to modify it for each one. We simply need to modify the .psd1 file in order for the changes to be picked up upon the MOF compilation job. In our example, we will be specifying the following content in our .psd1 file. Note how the script above is accessing each of these variables by using $AllNodes.<Variable>. This $AllNodes is a reserved keyword that allows us to access values in the ConfigurationData of any given DSC configuration script. You could also expand the .psd1 to include variables unique for a specific node, if your DSC script node ever defined more than one node (like it should be the case for most SharePoint farms).
SPStandAlone-ConfigData.psd1
@{
AllNodes = @(
@{
NodeName = $env:COMPUTERNAME;
PSDscAllowPlainTextPassword = $true;
PSDscAllowDomainUser = $true;
#region Parameters
Passphrase = "pass@word1"
DomainName = "contoso.com"
DomainNetBIOS = "contoso"
ProductKey = "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"
LanguagePackPath = "\\DSC-Share\Media\SP2016LanguagePack"
SharePointBinaryPath = "\\DSC-Share\Media\SP2016Binaries"
SQLBinaryPath = "\\DSC-Share\Media\SQL2016Binaries"
SXSLocalPath = "c:\SXS" # The content from the Network Share will be copied locally at that location;
SXSRemotePath = "\\DSC-Share\Media\SXS\"
#endregion
}
)}
Executing the DSC Script
This section describes the steps you need to take in order to initiate the deployment and configuration of your SharePoint 2016 Farm using the PowerShell Desired State Configuration scripts above.
- Copy both the SPStandAlone.ps1 and SPStandAlone-ConfigData.psd1 file onto the SharePoint server. In my case, I put hem both under C:\temp\.
DSC Script and its associated Configuration data
- Open a new PowerShell console as an administrator and browse to the directory where you’ve copied the 2 files.
- Execute the SPStandAlone.ps1 script and provide both the SharePoint Farm Admin and Domain Admin credentials when prompted. Even though this user doesn’t yet exist, the credentials you provide here will be used to create the account in Active Directory.
Compiling your SharePoint DSC MOF file
SharePoint DSC MOF File Generated
- Your .MOF file has now been generated in a new folder named by our Configuration (SPStandAlone).
SPStandAlone Compiled MOF File
All that is now left to do is to call the following PowerShell cmdlet to initiate the deployment process:Start-DSCConfiguration SPStandAlone -Force -Wait -Verbose
The server will automatically reboot several times, and upon rebooting, you will loose the verbose PowerShell console, but don’t worry DSC is still being executed in the background. If you need to check the DSC execution logs, simply open Event Receiver and navigate to Applications and Services Logs > Microsoft > Windows > Desired State Configuration > Operational. After about an hour or so depending on the performance of your environment, you will have a fully working SharePoint 2016 Standalone machine.
