In working with Configuration Manager 2007, I’ve come to believe that in the age of regulatory compliance, the Desired Configuration Managment (DCM) feature is one of the most significant. In comparing the capabilities with a couple of the most popular enterprise systems management platforms, I think it compares quite favorably. DCM eliminates the temptation of using Operations Manager 2007 for configuration change auditing, which is not really what the monitoring platform is intended for.
In this post, I’ll provide an overview of DCM functionality, some of the business drivers for it’s use, as well as links to 3rd party resources with offerings to augment out-of-the-box functionality in DCM to give you a running start at DCM in your own environment.
What is Desired Configuration Management (DCM)?
DCM is a feature in SCCM 2007 that will provides a framework for assisting organizations in both defining and enforcing corporate policies and standards for system configurations, whether related to the operating system or an application installed on the system. In this article, I’m going to do a 50,000 foot flyover of the DCM along and provide pointers to some great resources
First, let me say that DCM in Configuration Manager 2007 is not the DCM you may remember from SMS 2003 fame (or infamy, depending on who you ask). The DCM feature of SCCM 2007 is a complete retooling of the feature, with authoring and scheduling features integrated into the Console, while leveraging the new the many improvements in Configuration Manager 2007 for improved scalability and performance. The new platform incorporates model-based design leveraging Service Modeling Language (SML) (a component of Microsoft’s Dynamic Systems Initiative) which makes the features we’re about to discuss possible.
Some of the key scenarios that drove the features Microsoft delivered in the final release of DCM include:
-
Regulatory Compliance - Desired Configuration Manager was as a tool for demonstrating regulatory compliance (e.g. - Sarbanes-Oxley, HIPAA, FISMA, etc) in system configurations. The key at the end of the day is not only deploying a compliant standard system configuration, but being able to periodically prove adherence to these policies.
-
Pre and post change configuration - Verify that no unplanned changes took place during the implementation of a planned change.
-
Monitoring for “drift” - Verify that new systems are built in accordance to the planned role in your infrastructure, and monitoring for human error and misconfiguration in day-to-day administration. In short, ensuring corporate policies are implemented in base machine builds and maintained over time.
-
Streamline Support - Incorporating DCM reporting into the troubleshooting process to drive down time to resolution and overall support costs.
The bottom line - DCM monitors your systems actual configuration against a “desired configuration” model and identifies policies that have drifted outside this policy.
DCM Components
To most effectively implement desired configuration management, it is important to familiarize yourself with 3 key concepts: Configuration Items, Configuration Baselines, and Configuration Packs.
The smallest unit of measure in the DCM model is the Configuration Item (CI). Configuration Items represent a desired object or setting or value on a server or within an application. Configuration items can include registry values, objects on the file system (files, folders) and attributes (firewall settings, NTFS permissions), as well data retrieved via scripts. The Configuration Items fall into one of the following categories:
-
Application CI - Settings within an application like MS Word, Exchange, or SQL Server.
-
OS CI - Representing a specific operating system object or setting.
-
General CI - General settings related to corporate policies like corporate security policy, Sarbanes-Oxley, etc.
These configuration items are reusable, and can be grouped into multiple, logical collections of settings known as a Configuration Baselines, which represent your base unit of management in DCM. Within the configuration baseline, you can define mandatory, optional and prohibited configuration items.
Configuration Baselines will generally be constructed to map to machine roles (a type or class of system), such as Domain Controller, Exchange 2003 Server, SQL Database Server. As one can imagine, creating all the configuration items for configuration baseline for something like Exchange could take a lot of time and effort. This is where Configuration Packs come in. Configuration Packs are pre-defined configuration baselines (templates so to speak) created by Microsoft and 3rd parties representing best practice configuration for common OS and server applications. Configuration packs are designed to be used as a starting point for your own corporate baseline, and then modified to meet your organizations requirements.
Where can I get Configuration Packs?
Currently available Configuration Packs can be found in the System Center Pack Catalog. Here you will find dozens of templates from Microsoft and MS partners, including baselines for Windows 2003, several popular server applications, including templates targeted to various regulatory standards like Sarbanes Oxley, GLBA, FISMA, and EUDPD. MSIT has also assisted in delivering 3 levels of configuration packs (basic, intermediate and advanced) for several common server roles including AD, File and Print, DHCP, DNS, WINS.
Reporting and Enforcement
Configuration Manager comes with a pretty good reporting environment out of the box, and by building query-based collections based on DCM compliance results; you can then leverage the software deployment features of SCCM 2007 to target programs to the collection. The next step in automating remediation is planned for a future release.
Managing the Configuration Pack Lifecycle
The pace of change is fast, and corporate policies (and the configuration baselines defined to support them) evolve over time. This brings about several key challenges in managing change within your configuration management strategy, such as:
-
So how can I manage and document the changes to my Configuration Baselines over time?
-
How can I test the effect of a new configuration baseline BEFORE I deploy to my production environment?
-
How can I manage rollback to a previous version in the event of a mistake?
-
How can I effectively report on my organizations compliance?
3rd Party Resources
To support these processes, both Silect Software and SecureVantage are delivering solutions for Configuration Pack lifecycle management and DCM compliance reporting.
-
The Silect offering is called CP Studio, and is similar to their MP Studio offering for Opsmgr 2007 in that CP Studio offers versioning, change and lifecycle management for your Configuration Packs.
-
The SecureVantage offering includes Desired Configuration Compliance Reporting amongst other things (more on this when I’m more familiar).
Next Steps
To get started with DCM, you can download a copy of SCCM 2007 from the product homepage on the Microsoft site at http://www.microsoft.com/systemcenter/configmgr/default.mspx
For additional information on the 3rd party offerings for DCM mentioned in this article:
Your comments and feedback are always welcome via comments on this post of via our Contact page.
