Find out where a Push Server Gets the Configuration From

Working in a Push scenario, I run Start-DscConfiguration to tell the LCM what configuration to run. Once I’ve done that, the LCM runs that configuration automatically based on the LCM settings.

Question is; how do I determine where the LCM is getting its configuration?

For example; if I am investigating a server and was not the person that ran Start-DscConfiguration, how do I find out where the configuration is?


Well, the LCM is going to keep a copy of the configuration in $env:SystemRoot\System32\Configuration\current.mof ; it’s not getting it from anywhere else after a push has happened.

If you want to know where the push originally came from, I don’t think the LCM keeps that information anywhere (but will double check this when I get a chance). You might be able to find something in the DSC event log, though.

Perfect! Thanks Dave!

Hi Craig,

You can filter the DSC event log for ID 4102 and find out who pushed the configuration from where and when.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DSC/Operational';Id=4102} | Format-List -Property TimeCreated, Message, UserId

TimeCreated : 02/10/2014 23:08:22
Message     : Job {3D677BE4-4A78-11E4-82B2-001E4FC0836E} : 
              Configuration is sent from computer DSC01 by user sid S-1-5-21-605124763-3332917143-1498451686-1234.
UserId      : S-1-5-21-605124763-3332917143-1498451686-1234