Compliance settings, which in previous versions of System Center Configuration Manager was termed Desired Configuration Management, allows you to monitor and remediate the configuration of computers.
Configuration Manager’s compliance settings functionality uses configuration items and configuration baselines. A configuration item includes one or more settings that you want to assess to determine the compliance state of a computer. The configuration item includes compliance rules to evaluate the settings, as well as providing severity ratings for noncompliance. Some configuration items can be configured for remediation, which allows you to alter a non-compliant setting so that it is compliant. Configuration baselines are collections of software updates, configuration items, and other configuration baselines.
Configuration items
Configuration Manager supports the following types of configuration items for assessing the compliance of computers:
- Application configuration item Use this type of configuration item to determine application compliance, including whether the application is installed and whether it is configured in a specific manner.
- Operating system configuration item Allows you to determine operating system configuration compliance, such as whether particular roles or features are installed and particular registry keys are configured.
- Software updates configuration item Available when you manage software updates with Configuration Manager, and allows you to assess whether a computer has specific software updates installed.
For example, to create a configuration item related to whether Remote Desktop is enabled on a target computer running the Windows Server 2012 R2 operating system, perform the following steps:
1. In the Assets And Compliance workspace of the Configuration Manager console, select the Configuration Items node under the Compliance Settings node. On the ribbon, click Create Configuration Item.
2. On the General page of the Create Configuration Item Wizard, provide a name and ensure that the type of configuration item is set to Windows, as shown in Figure 1.
FIGURE 1 Create Configuration Item Wizard
3. On the Supported Platforms page, ensure that Windows Server 2012 R2 is selected, as shown in Figure 2 You should only select the operating systems that you want the configuration item assessed for on this page.
FIGURE 2 Select Windows versions
4. On the Settings page, click New. This will launch the Create Setting dialog box.
5. In the Create Setting dialog box, click Browse.
6. In the registry tree, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server, and select the fDenyTSConnections registry value. In this scenario, the value is set to 0, which allows Remote Desktop connections. Enable the This Registry Value Must Satisfy The Following Rule If Present Equals 0, as shown in Figure 3.
FIGURE 3 Browse Registry
7. Enter a name for the rule. On the Compliance Rules page, click the fDenyTSConnections Equals 0 condition, and click Edit. Select the Remediate Noncompliant Rules When Supported and Report Noncompliance If This Setting Instance Is Not Found check boxes, and set the Noncompliance Severity For Reports to Critical, as shown in Figure 4.
FIGURE 4 Edit Rule
8. Complete the wizard to create the configuration item.
Configuration baselines
Configuration baselines can include configuration items, software updates, and other configuration baselines. To create a configuration baseline that includes the Remote Desktop configuration item configured earlier, perform the following steps:
1. In the Assets And Compliance workspace of the Configuration Manager console, select Configuration Baselines under Compliance Settings.
2. On the ribbon, click Create Configuration Baseline. This will launch the Create Configuration Baseline dialog box.
3. On the Create Configuration Baseline dialog box, specify a name for the baseline, and then click Add, and then click Configuration Items.
4. On the Add Configuration Items dialog box, click the Remote Desktop Enabled configuration item, and click Add, as shown in Figure 5.
FIGURE 5 Add Configuration Items
5. Verify that the configuration item is present, as shown in Figure 6, and then click OK.
FIGURE 6 Create Configuration Baseline
To deploy the configuration baseline to a collection, select the configuration baseline, and click Deploy on the ribbon. When deploying the baseline, select the collection to which you want to deploy the baseline, and also choose whether you want to enable remediation. Figure 7 shows the Server 2012 R2 Configuration Baseline deployed to the Windows Server 2012 R2 Servers collection with the remediation option enabled.
FIGURE 7 Deploy Configuration Baselines
Once the configuration baseline has been deployed, you’ll be able to view a list of compliant and non-compliant computers from the Configuration Baseline node, by selecting the baseline in Deployments node in the Monitoring workspace, or by viewing reports in the Compliance And Settings Management report category.
Remediation
Certain types of configuration items can be remediated, but only when the item is included in a baseline deployment that you have also configured for remediation. Remediation is only available for the following types of computer related configuration items:
- Registry value
- Scripts
- WQL query configuration items
You can configure remediation to be performed, either by creating a value if it is not present, altering a value if it exists but is not compliant (for example, changing a registry value), or by running a remediation script. The remediation script will need to alter the setting to the desired state.
