Remove all websites except the ones I really want about webadministrationdsc HOT 3 CLOSED

IMO opinion most desired state configuration software (Chef, Puppet, DSC etc) don't really support this use case. The configuration is only aware of the state you've given it. So in your example it'd only be aware of Site-A and Site-B and would have no concept of the other sites. By the design you'd have to explicitly disallow those sites. Though I could be totally wrong. 😁

from webadministrationdsc.

You would have to explicitly setup your DSC configuration to say Ensure: Absent for the specific websites and app pools that you do not wish to have present. There isn't a way to do a "Search for all sites that exist which don't match Site-A and Site-B" short of scripting it outside of DSC, or creating a custom catch-all DSC resource call (which should not be used, in my opinion).

In Chef I know you technically could run a script-block in a recipe that checks to see if anything is returned from a PowerShell query that is searching for non-matching sites, but that is bad practice.

You have to make sure that any changes being done to an environment are being done via your configuration management solution, as DSC will only be aware of what it has been directed to target. If you are worried others are logging on and making websites that they should not, you may need to evaluate changes to the way change management is done and modifying the Administrative permissions that people have on those target nodes.

from webadministrationdsc.

@ScriptAutomate - I understand DSC much better now and agree with everything you said.

Yes it would be nice to have a very strictly managed environment where admin always follow the rules, but in the real world, that's not how it works.

On my servers as part of my monitoring scripts I check for the number of users, installed features running websites etc. and generate an alert if a non-desired number has been found.

I initially thought, it would be nice if these checks would be part of DSC and would be corrected automatically, but that could break things.

I now think its better to keep this alert system parallel with DSC and then manually look into any changes and potentially roll them back or add them to the DSC configuration.

from webadministrationdsc.