dsccommunity/SecurityPolicyDsc dsccommunity/SecurityPolicyDsc

  • Stars
    star
    177
  • Rank 215,985 (Top 5 %)
  • Language
    PowerShell
  • License
    MIT License
  • Created almost 9 years ago
  • Updated 5 months ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
dsccommunity/SecurityPolicyDsc
github

dsccommunity

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A wrapper around secedit.exe to configure local security policies

SecurityPolicyDsc

Build Status Azure DevOps coverage (branch) Azure DevOps tests PowerShell Gallery (with prereleases) PowerShell Gallery

A wrapper around secedit.exe to allow you to configure local security policies. This resource requires a Windows OS with secedit.exe.

Code of Conduct

This project has adopted this Code of Conduct.

Releases

For each merge to the branch master a preview release will be deployed to PowerShell Gallery. Periodically a release version tag will be pushed which will deploy a full release to PowerShell Gallery.

Contributing

Please check out common DSC Community contributing guidelines.

Change log

A full list of changes in each version can be found in the change log.

Resources

  • AccountPolicy: Configures the policies under the Account Policy node in local security policies.
  • SecurityOption: Configures the policies under the Security Options node in local security policies.
  • SecurityTemplate: Configures user rights assignments that are defined in an INF file.
  • UserRightsAssignment: Configures user rights assignments in local security policies.

AccountPolicy

For further explanation of these settings, please consult Account Policies Reference.

Parameter Attribute DataType Description Allowed Values
Name Key String A unique name of the AccountPolicy resource instance. This is not used during configuration.
Enforce_password_history Write Uint32 Specifies the number of unique new passwords that must be associated with a user account before an old password can be reused. A number from 0 through 24 can be specified
Maximum_Password_Age Write Uint32 Specifies the period of time (in days) that a password can be used before the system requires the user to change it. A number from 0 through 999 can be specified, with 0 meaning the password will never expire
Minimum_Password_Age Write Uint32 Specifies the period of time (in days) that a password must be used before the user can change it. A number from 0 to 998 can be specified
Minimum_Password_Length Write Uint32 Specifies the least number of characters that can make up a password for a user account. A number from 0 to 14 can be specified
Password_must_meet_ complexity_requirements Write String Specifies whether passwords must meet a series of guidelines that are considered important for a strong password Enabled, Disabled
Store_passwords_using_ reversible_encryption Write String Specifies whether passwords are stored in a way that is reversible to provides support for applications that use protocols that require the user's password for authentication Enabled, Disabled
Account_lockout_duration Write Uint32 Specifies the number of minutes that a locked-out account remains locked out before automatically becoming unlocked. A number from 1 through 99,999 can be specified
Account_lockout_threshold Write Uint32 Specifies the number of failed sign-in attempts that will cause a user account to be locked
Reset_account_lockout_ counter_after Write Uint32 Specifies the number of minutes that must elapse from the time a user fails to log on before the failed logon attempt counter is reset to 0

Note: The below settings pertain to Kerberos policies and must be set by a member in the domain admins group.

Parameter Attribute DataType Description Allowed Values
Enforce_user_logon_ restrictions Write String Specifies whether the Kerberos V5 Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the user account Enabled, Disabled
Maximum_lifetime_ for_service_ticket Write Uint32 Specifies the maximum number of minutes that a granted session ticket can be used to access a particular service. A number from 10 to the value of the 'Maximum lifetime for service ticket' policy setting can be specified
Maximum_lifetime_ for_user_ticket Write Uint32 Specifies the maximum amount of time (in hours) that a user's ticket-granting ticket can be used. A number from 0 to 99,999 can be specified
Maximum_lifetime_ for_user_ticket_ renewal Write Uint32 Specifies the period of time (in days) during which a user's ticket-granting ticket can be renewed. A number from 0 to 99,999 can be specified
Maximum_tolerance_ for_computer_clock_ synchronization Write Uint32 Specifies the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller that provides Kerberos authentication

SecurityOption

For further explanation of these settings, please consult Security Options Reference.

Parameter Attribute DataType Description Allowed Values
Name Key String Describes the security option to be managed. This could be anything as long as it is unique
Accounts_Administrator_ account_status Write String Determines whether the local Administrator account is enabled or disabled Enabled, Disabled
Accounts_Block_ Microsoft_accounts Write String Prevents using the Settings app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services. This policy is disabled, Users cant add Microsoft accounts, Users cant add or log on with Microsoft accounts
Accounts_Guest_ account_status Write String Determines whether the Guest account is enabled or disabled Enabled, Disabled
Accounts_Limit_local_ account_use_of_blank_ passwords_to_console_ logon_only Write String Determines whether remote interactive logons by network services such as Remote Desktop Services, Telnet, and File Transfer Protocol (FTP) are allowed for local accounts that have blank passwords Enabled, Disabled
Accounts_Rename_ administrator_account Write String Determines whether a different account name is associated with the security identifier (SID) for the administrator account
Accounts_Rename_ guest_account Write String Determines whether a different account name is associated with the security identifier (SID) for the Guest account
Audit_Audit_the_ access_of_global_ system_objects Write String If you enable this policy setting, a default system access control list (SACL) is applied when the device creates system objects such as mutexes, events, semaphores, and MS-DOS devices. If you also enable the Audit object access audit setting, access to these system objects is audited Enabled, Disabled
Audit_Audit_the_ use_of_Backup_and_ Restore_privilege Write String Determines whether to audit the use of all user rights, including Backup and Restore, when the Audit privilege use policy setting is configured Enabled, Disabled
Audit_Force_audit_ policy_subcategory_ settings_Windows_ Vista_or_later_to_ override_audit_policy_ category_settings Write String Allows you to manage your audit policy in a more precise way by using audit policy subcategories Enabled, Disabled
Audit_Shut_down_ system_immediately_ if_unable_to_log_ security_audits Write String Determines whether the system shuts down if it is unable to log security events Enabled, Disabled
DCOM_Machine_Access_ Restrictions_in_ Security_Descriptor_ Definition_Language_ SDDL_syntax Write String Allows you to define additional computer-wide controls that govern access to all Distributed Component Object Model (DCOM) based applications on a device
DCOM_Machine_Launch_ Restrictions_in_ Security_Descriptor_ Definition_Language_ SDDL_syntax Write String Allows you to define additional computer-wide controls that govern access to all DCOM based applications on a device. However, the ACLs that are specified in this policy setting control local and remote COM launch requests (not access requests) on the device
Devices_Allow_undock_ without_having_to_ log_on Write String Enables or disables the ability of a user to remove a portable device from a docking station without logging on Enabled, Disabled
Devices_Allowed_to_ format_and_eject_ removable_media Write String Determines who is allowed to format and eject removable media. Administrators, Administrators and Power Users, Administrators and Interactive Users
Devices_Prevent_ users_from_installing_ printer_drivers Write String Determines who can install a printer driver as part of adding a network printer Enabled, Disabled
Devices_Restrict_ CD_ROM_access_to_ locally_logged_on_ user_only Write String Determines whether a CD is accessible to local and remote users simultaneously Enabled, Disabled
Devices_Restrict_ floppy_access_to_ locally_logged_on_ user_only Write String Determines whether removable floppy disks are accessible to local and remote users simultaneously Enabled, Disabled
Domain_controller_ Allow_server_operators_ to_schedule_tasks Write String Determines whether server operators can use the 'at' command to submit jobs. Enabled, Disabled
Domain_controller_ LDAP_server_ signing_requirements Write String Determines whether the Lightweight Directory Access Protocol (LDAP) server requires LDAP clients to negotiate data signing None, Require Signing
Domain_controller_ Refuse_machine_ account_password_ changes Write String Enables or disables blocking a domain controller from accepting password change requests for machine accounts Enabled, Disabled
Domain_member_ Digitally_encrypt_ or_sign_secure_ channel_data_always Write String Determines whether all secure channel traffic that is initiated by the domain member must be signed or encrypted Enabled, Disabled
Domain_member_ Digitally_encrypt_ secure_channel_data_ when_possible Write String Determines whether all secure channel traffic that is initiated by the domain member must be encrypted Enabled, Disabled
Domain_member_ Digitally_sign_ secure_channel_data_ when_possible Write String Determines whether all secure channel traffic that is initiated by the domain member must be signed Enabled, Disabled
Domain_member_ Disable_machine_ account_password_ changes Write String Determines whether a domain member periodically changes its machine account password Enabled, Disabled
Domain_member_ Maximum_machine_ account_password_age Write String Determines when a domain member submits a password change
Domain_member_ Require_strong_ Windows_2000_or_ later_session_key Write String Determines whether a secure channel can be established with a domain controller that is not capable of encrypting secure channel traffic with a strong, 128-bit session key Enabled, Disabled
Interactive_logon_ Display_user_ information_when_ the_session_is_locked Write String Controls whether details such as email address or domain\username appear with the username on the sign-in screen User displayname, domain and user names, User display name only, Do not display user information
Interactive_logon_ Do_not_display_ last_user_name Write String Determines whether the name of the last user to log on to the device is displayed on the Secure Desktop Enabled, Disabled
Interactive_logon_ Do_not_require_ CTRL_ALT_DEL Write String Determines whether pressing CTRL+ALT+DEL is required before a user can log on Enabled, Disabled
Interactive_logon_ Machine_account_ lockout_threshold Write String Allows you to set a threshold for the number of failed logon attempts that causes the device to be locked by using BitLocker
Interactive_logon_ Machine_inactivity_limit Write String Specifies the amount of inactive time before the user's session locks by invoking the screen saver
Interactive_logon_ Message_text_for_ users_attempting_ to_log_on Write String Specifies a text message to be displayed to users when they log on
Interactive_logon_ Message_title_for_ users_attempting_ to_log_on Write String Specifies a message title to be displayed to users when they log on
Interactive_logon_ Number_of_previous_ logons_to_cache_in_ case_domain_controller_ is_not_available Write String Determines whether a user can log on to a Windows domain by using cached account information
Interactive_logon_ Prompt_user_to_ change_password_ before_expiration Write String Determines how many days in advance users are warned that their passwords are about to expire
Interactive_logon_ Require_Domain_ Controller_ authentication_to_ unlock_workstation Write String Determines whether it is necessary to contact a domain controller to unlock a device Enabled, Disabled
Interactive_logon_ Require_smart_card Write String Requires users to log on to a device by using a smart card Enabled, Disabled
Interactive_logon_ Smart_card_removal_ behavior Write String Determines what happens when the smart card for a logged-on user is removed from the smart card reader No Action, Lock workstation, Force logoff, Disconnect if a remote Remote Desktop Services session
Microsoft_network_ client_Digitally_ sign_communications_ always Write String If this policy setting is enabled, SMBv2 clients will digitally sign all packets Enabled, Disabled
Microsoft_network_ client_Digitally_sign_ communications_if_ server_agrees Write String If this policy setting is enabled, SMBv2 clients will digitally sign all packets if the server agrees Enabled, Disabled
Microsoft_network_ client_Send_ unencrypted_ password_to_third_ party_SMB_servers Write String Allows or prevents the SMB redirector to send plaintext passwords to a non-Microsoft server service that does not support password encryption during authentication Enabled, Disabled
Microsoft_network_ server_Amount_ of_idle_time_ required_before_ suspending_session Write String Determines the amount of continuous idle time that must pass in an SMB session before the session is suspended due to inactivity
Microsoft_network_ server_Attempt_ S4U2Self_to_obtain_ claim_information Write String Specifies whether a Windows file server will attempt to use the Kerberos S4U2Self feature to obtain a claim-enabled access token for the client prinicipal if required. Default, Enabled, Disabled
Microsoft_network_ server_Digitally_ sign_communications_ always Write String Specifies whether an SMB server requires SMB network packets to be digitally signed Enabled, Disabled
Microsoft_network_ server_Digitally_ sign_communications_ if_client_agrees Write String Specifies whether an SMB server will negotaite to digitally sign SMB network packets with a client Enabled, Disabled
Microsoft_network_ server_Disconnect_ clients_when_logon_ hours_expire Write String Enables or disables the forced disconnection of users who are connected to the local device using SMB outside their user account's valid logon hours Enabled, Disabled
Microsoft_network_ server_Server_SPN_ target_name_ validation_level Write String Controls the level of validation that a server with shared folders or printers performs on the service principal name (SPN) that is provided by the client device when the client device establishes a session by using the Server Message Block (SMB) protocol Off, Accept if provided by client, Required from client
Network_access Allow_anonymous SID_Name_translation Write String Enables or disables the ability of an anonymous user to request security identifier (SID) attributes for another user Enabled, Disabled
Network_access_ Do_not_allow_ anonymous_ enumeration_ of_SAM_accounts Write String Determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares Enabled, Disabled
Network_access_ Do_not_allow_ anonymous_ enumeration_ of_SAM_accounts_ and_shares Write String Determines which additional permissions will be assigned for anonymous connections to the device. Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares Enabled, Disabled
Network_access_ Do_not_allow_storage_ of_passwords_and_ credentials_for_ network_authentication Write String Determines whether Credential Manager saves passwords and credentials for later use when it gains domain authentication Enabled, Disabled
Network_access_ Let_Everyone_ permissions_apply_ to_anonymous_users Write String Determines what additional permissions are granted for anonymous connections to the device. If you enable this policy setting, anonymous users can enumerate the names of domain accounts and shared folders and perform certain other activities Enabled, Disabled
Network_access_ Named_Pipes_that_ can_be_accessed_ anonymously Write String Determines which communication sessions, or pipes, have attributes and permissions that allow anonymous access
Network_access_ Remotely_accessible_ registry_paths Write String Determines which registry paths are accessible when an application or process references the WinReg key to determine access permissions
Network_access_ Remotely_accessible_ registry_paths_and_ subpaths Write String Determines which registry paths and subpaths are accessible when an application or process references the WinReg key to determine access permissions
Network_access_ Restrict_anonymous_ access_to_Named_ Pipes_and_Shares Write String Enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the 'Network access: Named pipes that can be accessed anonymously' and 'Network access: Shares that can be accessed anonymously' settings Enabled, Disabled
Network_access_ Restrict_clients_ allowed_to_make_ remote_calls_to_SAM Write String[] The Permission and Identity required for restricted remote Sam access
Network_access_ Shares_that_can_be_ accessed_anonymously Write String Determines which shared folders can be accessed by anonymous users
Network_access_ Sharing_and_security_ model_for_local_ accounts Write String Determines how network logons that use local accounts are authenticated Classic - Local users authenticate as themselves, Guest only - Local users authenticate as Guest
Network_security_ Allow_Local_System_ to_use_computer_ identity_for_NTLM Write String Determines what identity to use for services running as Local System when NTLM is used Enabled, Disabled
Network_security_ Allow_LocalSystem_ NULL_session_fallback Write String Determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility Enabled, Disabled
Network_Security_ Allow_PKU2U_ authentication_requests_ to_this_computer_ to_use_online_identities Write String Determines whether authentication is allowed between two or more computers that have established a peer relationship through the use of online IDs Enabled, Disabled
Network_security_ Configure_encryption_ types_allowed_for_ Kerberos Write String[] Allows you to set the encryption types that the Kerberos protocol is allowed to use DES_CBC_CRC, DES_CBC_MD5, RC4_HMAC_MD5, AES128_HMAC_SHA1, AES256_HMAC_SHA1, FUTURE
Network_security_ Do_not_store_LAN_ Manager_hash_value_ on_next_password_ change Write String Determines whether LAN Manager is prevented from storing hash values for the new password the next time the password is changed Enabled, Disabled
Network_security_ Force_logoff_when_ logon_hours_expire Write String Determines whether to disconnect users who are connected to the local device using SMB outside their user account's valid logon hours Enabled, Disabled
Network_security_ LAN_Manager_ authentication_level Write String Determines which challenge or response authentication protocol is used for network logons Send LM & NTLM responses, Send LM & NTLM - use NTLMv2 session security if negotiated, Send NTLM responses only, Send NTLMv2 responses only, Send NTLMv2 responses only. Refuse LM, Send NTLMv2 responses only. Refuse LM & NTLM
Network_security_ LDAP_client_ signing_requirements Write String Determines the level of data signing that is requested on behalf of client devices that issue LDAP BIND requests None, Negotiate Signing, Require Signing
Network_security_ Minimum_session_ security_for_NTLM_ SSP_based_including_ secure_RPC_clients Write String Allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security Require NTLMv2 session security, Require 128-bit encryption, Both options checked
Network_security_ Minimum_session_ security_for_NTLM_ SSP_based_including_ secure_RPC_servers Write String Allows a client device to require the negotiation of 128-bit encryption or NTLMv2 session security Require NTLMv2 session security, Require 128-bit encryption, Both options checked
Network_security_ Restrict_NTLM_ Add_remote_server_ exceptions_for_ NTLM_authentication Write String Allows you to create an exception list of remote servers to which client devices are allowed to use NTLM authentication if the 'Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers' policy setting is configured
Network_security_ Restrict_NTLM_ Add_server_exceptions_ in_this_domain Write String Allows you to create an exception list of servers in this domain to which client device are allowed to use NTLM pass-through authentication if any of the deny options are set in the 'Network Security: Restrict NTLM: NTLM authentication in this domain' policy setting
Network_Security_ Restrict_NTLM_ Incoming_NTLM_Traffic Write String Allows you to deny or allow incoming NTLM traffic from client computers, other member servers, or a domain controller Allow all, Deny all domain accounts, Deny all accounts
Network_Security_ Restrict_NTLM_ NTLM_authentication_ in_this_domain Write String Allows you to deny or allow NTLM authentication within a domain from this domain controller Disable, Deny for domain accounts to domain servers, Deny for domain accounts, Deny for domain servers, Deny all
Network_Security_ Restrict_NTLM_ Outgoing_NTLM_traffic_ to_remote_servers Write String Allows you to deny or audit outgoing NTLM traffic from a computer running Windows 7, Windows Server 2008, or later to any remote server running the Windows operating system Allow all, Audit all, Deny all
Network_Security_ Restrict_NTLM_ Audit_Incoming_ NTLM_Traffic Write String Allows you to audit incoming NTLM traffic Disabled, Enable auditing for domain accounts, Enable auditing for all accounts
Network_Security_ Restrict_NTLM_ Audit_NTLM_ authentication_ in_this_domain Write String Allows you to audit on the domain controller NTLM authentication in that domain Disable, Enable for domain accounts to domain servers, Enable for domain accounts, Enable for domain servers, Enable all
Recovery_console_ Allow_automatic_ administrative_logon Write String Determines whether the built-in Administrator account password must be provided before access to the Recovery Console on the device is granted Enabled, Disabled
Recovery_console_ Allow_floppy_ copy_and_access_ to_all_drives_and_ folders Write String Enables or disables the Recovery Console SET command Enabled, Disabled
Shutdown_Allow_ system_to_be_shut_ down_without_having_ to_log_on Write String Determines whether a device can be shut down without having to log on to Windows Enabled, Disabled
Shutdown_Clear_ virtual_memory_ pagefile Write String Determines whether the virtual memory paging file is cleared when the device is shut down Enabled, Disabled
System_cryptography_ Force_strong_ key_ protection_for_user_ keys_stored_on_the_ computer Write String Determines whether users can use private keys, such as their Secure/Multipurpose Internet Mail Extensions (S/MIME) key, without a password User input is not required when new keys are stored and used, User is prompted when the key is first used, User must enter a password each time they use a key
System_cryptography_ Use_FIPS_compliant_ algorithms_for_ encryption_hashing_ and_signing Write String Determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite Enabled, Disabled
System_objects_ Require_case_ insensitivity_for_ non_Windows_ subsystems Write String Determines whether case insensitivity is enforced for all subsystems Enabled, Disabled
System_objects_ Strengthen_default_ permissions_of_ internal_system_objects_ eg_Symbolic_Links Write String Determines the strength of the default discretionary access control list (DACL) for objects Enabled, Disabled
System_settings_ Optional_subsystems Write String Determines which subsystems support your applications
System_settings_ Use_Certificate_ Rules_on_Windows_ Executables_for_ Software_Restriction_ Policies Write String Determines whether digital certificates are processed when software restriction policies are enabled and a user or process attempts to run software with an .exe file name extension Enabled, Disabled
User_Account_Control_ Admin_Approval_ Mode_for_the_Built_in_ Administrator_account Write String Determines the behavior of Admin Approval Mode for the built-in administrator account Enabled, Disabled
User_Account_Control_ Allow_UIAccess_ applications_to_prompt_ for_elevation_without_ using_the_secure_ desktop Write String Controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts that are used by a standard user Enabled, Disabled
User_Account_Control_ Behavior_of_the_ elevation_prompt_for_ administrators_ in_Admin_Approval_ Mode Write String Determines the behavior of the elevation prompt for accounts that have administrative credentials Elevate without prompting, Prompt for credentials on the secure desktop, Prompt for consent on the secure desktop, Prompt for credentials, Prompt for consent, Prompt for consent for non-Windows binaries
User_Account_Control_ Behavior_of_the_ elevation_prompt_for_ standard_users Write String Determines the behavior of the elevation prompt for standard users Automatically deny elevation request, Prompt for credentials on the secure desktop, Prompt for credentials
User_Account_Control_ Detect_application_ installations_and_ prompt_for_elevation Write String Determines the behavior of application installation detection for the entire system Enabled, Disabled
User_Account_Control_ Only_elevate_ executables_that_are_ signed_and_validated Write String Enforces public key infrastructure (PKI) signature checks on any interactive application that requests elevation of privilege Enabled, Disabled
User_Account_Control_ Only_elevate_UIAccess_ applications_that_are_ installed_in_secure_ locations Write String Enforces the requirement that apps that request running with a UIAccess integrity level (by means of a marking of UIAccess=true in their app manifest), must reside in a secure location on the file system Enabled, Disabled
User_Account_Control_ Run_all_administrators_ in_Admin_Approval_ Mode Write String Determines the behavior of all User Account Control (UAC) policies for the entire system Enabled, Disabled
User_Account_Control_ Switch_to_the_secure_ desktop_when_ prompting_for_elevation Write String Determines whether the elevation request prompts on the interactive user desktop or on the secure desktop Enabled, Disabled
User_Account_Control_ Virtualize_file_and_ registry_write_failures_ to_per_user_locations Write String Enables or disables the redirection of the write failures of earlier applications to defined locations in the registry and the file system Enabled, Disabled

SecurityTemplate

Parameter Attribute DataType Description Allowed Values
IsSingleInstance Key String Specifies the resource is a single instance, the value must be 'Yes' Yes
Path Required String The path to the desired security policy template (.inf)

UserRightsAssignment

Parameter Attribute DataType Description Allowed Values
Policy Key String The policy name of the user rights assignment to be configured. Create_a_token_object, Access_this_computer_from_the_network, Change_the_system_time, Deny_log_on_as_a_batch_job, Deny_log_on_through_Remote_Desktop_Services, Create_global_objects, Remove_computer_from_docking_station, Deny_access_to_this_computer_from_the_network, Act_as_part_of_the_operating_system, Modify_firmware_environment_values, Deny_log_on_locally, Access_Credential_Manager_ as_a_trusted_caller, Restore_files_and_directories, Change_the_time_zone, Replace_a_process_level_token, Manage_auditing_and_security_log, Create_symbolic_links, Modify_an_object_label, Enable_computer_and_user_accounts_ to_be_trusted_for_delegation, Generate_security_audits, Increase_a_process_working_set, Take_ownership_of_files_ or_other_objects, Bypass_traverse_checking, Log_on_as_a_service, Shut_down_the_system, Lock_pages_in_memory, Impersonate_a_client_ after_authentication, Profile_system_performance, Debug_programs, Profile_single_process, Allow_log_on_through_ Remote_Desktop_Services, Allow_log_on_locally, Increase_scheduling_priority, Synchronize_directory_service_data, Add_workstations_to_domain, Adjust_memory_quotas_for_a_process, Obtain_an_impersonation_token_for_ another_user_in_the_same_session, Perform_volume_maintenance_tasks, Load_and_unload_device_drivers, Force_shutdown_from_a_remote_system, Back_up_files_and_directories, Create_a_pagefile, Deny_log_on_as_a_service, Log_on_as_a_batch_job, Create_permanent_shared_objects
Identity Required String[] The identity of the user or group to be added or removed from the user rights assignment.
Force Write Boolean Specifies to explicitly assign only the identities defined
Ensure Write String Desired state of resource. Present, Absent

More Repositories

1

SqlServerDsc

This module contains DSC resources for deployment and configuration of Microsoft SQL Server.
PowerShell
358
star
2

ActiveDirectoryDsc

This module contains DSC resources for deployment and configuration of Active Directory Domain Services.
PowerShell
339
star
3

ComputerManagementDsc

DSC resources for for configuration of a Windows computer. These DSC resources allow you to perform computer management tasks, such as renaming the computer, joining a domain and scheduling tasks as well as configuring items such as virtual memory, event logs, time zones and power settings.
PowerShell
303
star
4

SharePointDsc

The SharePointDsc PowerShell module provides DSC resources that can be used to deploy and manage a SharePoint farm
C#
247
star
5

NetworkingDsc

DSC resources for configuring settings related to networking.
PowerShell
226
star
6

xPSDesiredStateConfiguration

DSC resources for configuring common operating systems features, files and settings.
PowerShell
209
star
7

DscWorkshop

Blueprint for a full featured DSC project for Push / Pull with or without CI/CD
PowerShell
202
star
8

WebAdministrationDsc

This module contains DSC resources for deploying and configuring web servers and related components.
PowerShell
162
star
9

CertificateDsc

DSC resources to simplify administration of certificates on a Windows Server.
PowerShell
122
star
10

HyperVDsc

This module contains DSC resources for deployment and configuration of Microsoft Hyper-V.
PowerShell
112
star
11

TheDSCBook

leanpub manuscript for The DSC Book, forever edition
103
star
12

xWindowsUpdate

This module contains DSC resources for configuration of Microsoft Windows Update and installing Windows updates.
PowerShell
88
star
13

ExchangeDsc

This module contains DSC resources for deployment and configuration of Microsoft Exchange Server.
PowerShell
80
star
14

StorageDsc

DSC resource module is used to manage storage on Windows Servers.
PowerShell
71
star
15

DnsServerDsc

This module contains DSC resources for the management and configuration of Windows Server DNS Server.
PowerShell
65
star
16

FailoverClusterDsc

This module contains DSC resources for deployment and configuration of Windows Server Failover Cluster.
PowerShell
60
star
17

xRobocopy

DSC Module to automate Robocopy transfers
PowerShell
54
star
18

ActiveDirectoryCSDsc

DSC resources for installing or uninstalling Active Directory Certificate Services components in Windows Server.
PowerShell
51
star
19

dsccommunity.org

DSC community organisation's website
HTML
43
star
20

CommonTasks

DSC Configuration (Composite Resource) for demo DSC and Datum
PowerShell
42
star
21

xRemoteDesktopSessionHost

This module contains DSC resources for the management and configuration of Microsoft Remote Desktop Session Host (RDSH).
PowerShell
36
star
22

cNtfsAccessControl

The cNtfsAccessControl DSC resource module.
PowerShell
33
star
23

xPendingReboot

PowerShell
31
star
24

UpdateServicesDsc

This module contains community maintained DSC resources for deployment and configuration of Windows Server Update Services.
PowerShell
31
star
25

xDscDiagnostics

This module contains cmdlets for analyzing DSC event logs.
PowerShell
31
star
26

xSmbShare

THIS MODULE HAS BEEN DEPRECATED Please use ComputerManagementDsc/SmbShare instead: https://github.com/PowerShell/ComputerManagementDsc
PowerShell
28
star
27

ConfigMgrCBDsc

This module contains DSC resources for the management and configuration of Microsoft System Center Configuration Manager Current Branch (ConfigMgrCB).
PowerShell
27
star
28

xDhcpServer

This module contains DSC resources for deployment and configuration of Microsoft DHCP Server.
PowerShell
26
star
29

AuditPolicyDsc

PowerShell
25
star
30

xDSCResourceDesigner

PowerShell
24
star
31

xWindowsEventForwarding

DSC Module to manage Windows Event Forwarding
PowerShell
23
star
32

TheDSCBookCode

PowerShell
23
star
33

DFSDsc

DSC Resource for configuring Windows Distributed File System (Replication and Namespaces)
PowerShell
23
star
34

GPRegistryPolicyDsc

DSC resources used to apply and manage local group policies by modifying the respective .pol file.
PowerShell
21
star
35

xDatabase

PowerShell
20
star
36

xBitlocker

This DSC module allows you to configure Bitlocker on a single disk, configure a TPM chip, or automatically enable Bitlocker on multiple disks.
PowerShell
20
star
37

WSManDsc

DSC resources for configuring WS-Management and PowerShell Remoting.
PowerShell
19
star
38

xRemoteDesktopAdmin

PowerShell
17
star
39

xSystemSecurity

THIS MODULE HAS BEEN DEPRECATED. See the README.md for more information.
PowerShell
17
star
40

xSCOM

PowerShell
17
star
41

xCredSSP

This module contains DSC resources for configuration of the WSMan Credential Security Support Provider (CredSSP).
PowerShell
16
star
42

OfficeOnlineServerDsc

This module contains DSC resources for deployment and configuration of Office Online Server.
PowerShell
15
star
43

FileContentDsc

DSC resources for setting the content of files. Configuration text files are the most common use case for this module.
PowerShell
15
star
44

xSCSMA

PowerShell
14
star
45

xJea

This module is deprecated, please use https://github.com/dsccommunity/JeaDsc instead.
PowerShell
14
star
46

xWinEventLog

THIS MODULE HAS BEEN DEPRECATED Please use ComputerManagementDsc instead: https://github.com/PowerShell/ComputerManagementDsc
PowerShell
12
star
47

xChrome

PowerShell
12
star
48

SChannelDsc

PowerShell
12
star
49

xSqlPs

THIS MODULE HAS BEEN DEPRECATED Please use SqlServerDsc instead: https://github.com/PowerShell/SqlServerDsc
PowerShell
12
star
50

FSRMDsc

DSC resources for configuring Windows File Server Resource Manager.
PowerShell
11
star
51

xSCVMM

PowerShell
10
star
52

DscResource.DocGenerator

Module for generation of DSC resource documentation
PowerShell
9
star
53

DscResource.Common

This module contains common functions that are used in DSC resources.
PowerShell
9
star
54

xMySql

PowerShell
9
star
55

xFirefox

PowerShell
9
star
56

xPowerShellExecutionPolicy

THIS MODULE HAS BEEN DEPRECATED Please use PowershellExecutionPolicy instead: https://github.com/PowerShell/ComputerManagementDsc
PowerShell
8
star
57

xWebDeploy

PowerShell
8
star
58

xAzurePack

PowerShell
7
star
59

iSCSIDsc

DSC resources for configuring Windows iSCSI targets and initiators.
PowerShell
7
star
60

xAzure

PowerShell
7
star
61

xTimeZone

THIS MODULE HAS BEEN DEPRECATED Please use ComputerManagementDsc instead: https://github.com/PowerShell/ComputerManagementDsc
PowerShell
7
star
62

FileSystemDsc

This module contains DSC resources for managing file systems.
PowerShell
7
star
63

dsccommunity.github.io

Compiled pages for the DSC Community organisation's website
HTML
6
star
64

xDefender

DSC Module for Windows Defender preferences
PowerShell
6
star
65

PSNativeCmdDevKit

Module to help developing commands that call native commands and binaries and parses their output.
PowerShell
6
star
66

xSCSPF

PowerShell
5
star
67

xSCDPM

PowerShell
5
star
68

xPhp

PowerShell
5
star
69

DscResource.AnalyzerRules

PowerShell Script Analyzer Rules to help enforce the DSC Community Guidelines
PowerShell
5
star
70

xInternetExplorerHomePage

PowerShell
5
star
71

DscResource.Test

Module to test your Projects against the HQRM guidelines
PowerShell
5
star
72

xDismFeature

THIS MODULE HAS BEEN DEPRECATED. See the README.md for more information.
PowerShell
5
star
73

xWordPress

PowerShell
4
star
74

xWindowsRestore

PowerShell
4
star
75

PasswordPolicyDsc

Composite resource to simplify managing password policies locally on a Windows Server
PowerShell
4
star
76

xSafeHarbor

PowerShell
4
star
77

NpmDsc

A DSC Resource Module for managing npm packages.
PowerShell
3
star
78

xSCSR

PowerShell
3
star
79

xAzureStorage

PowerShell
3
star
80

DscResource.Analysis

PowerShell Module for Analysing the health and other properties of a DSC Resource repository
PowerShell
3
star
81

AzureDevOpsDsc

This module contains DSC resources for deployment and configuration of initially Azure DevOps Services and later Azure DevOps Server.
PowerShell
3
star
82

PostgreSqlDsc

DSC Resources for PostgreSqlDsc
PowerShell
2
star
83

GitHubEnterpriseDsc

This module contains DSC resources for deployment and configuration of GitHub Enterprise.
PowerShell
2
star
84

DscTools

PowerShell
2
star
85

dscbook

1
star
86

AzureConnectedMachineDsc

DSC resource for managing the state of Azure Arc for servers agent
1
star
87

DpkgPackage

PS Wrapper for the Debian Package command dpkg (Debian & derivatives)
PowerShell
1
star
88

BizTalkServerDsc

Biztalk DSC Resource Module
PowerShell
1
star
89

ProtectedData

PowerShell Module for securely encrypting and sharing secret data
PowerShell
1
star
90

DscResource.Base

This module contains common classes that can be used for class-based DSC resources development.
PowerShell
1
star