dsc_registry generates notify event for every time puppet agent launches

[marcinbojko]

1. Description
   Setting any value in registry returns notify every time agent launches:

Notice: /Stage[main]/xxmodule/Dsc_registry[tightvncpassword]/ensure: created
Notice: /Stage[main]/xxmodule/Dsc_registry[tightvncpasswordcontrol]/ensure: created``

1. Expected behaviour
   Notice generated only once or with dsc_force=true

Example:

tightvncpassword:
  dsc_key: HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server
  dsc_valuename: Password
  dsc_hex: true
  dsc_valuedata: 00 00 00 00 00 00 00
  dsc_valuetype: binary

[jpogran]

Running puppet in debug mode shows that each run, the TEST function for the Registry DSC Resource is reporting InDesiredState = $false, so we call a SET to correct the state. The next run, Registry still returns $false when TEST is called, so we SET it again. Puppet is performing the operations based on the result returned by DSC, thus we notify every time.

Since the Registry DSC Resource is closed source, there isn't much I can debug there. A bug issue ticket will need to be opened up for the Registry DSC Resource in https://github.com/PowerShell/DscResources/issues

[marcinbojko]

Got it, will do.

[marcinbojko]

@jpogran According to PowerShell/DscResources#203 - if I undestood it correctly, this bug was fixed in current xPSDesiredStateConfiguration module.

[marcinbojko]

@jpogran
Could you take a look at whole output? If I am not mistaken DSC Resource is reporting inDesiredState = $true, but puppetdsc module still sets values.

Debug: Waited 50 milliseconds...
Debug: Wait object signaled
Debug: Waited 50 total milliseconds.
Debug: 2016-09-30 20:34:46 +0200 STDOUT> {"rebootrequired":false,"indesiredstate":true,"errormessage":""}

Debug: Create Dsc Resource returned: {"rebootrequired":false,"indesiredstate":true,"errormessage":""}

Notice: /Stage[main]/Win_manage/Dsc_registry[tightvncpasswordcontrol]/ensure: created

[jpogran]

@marcinbojko With regard to PowerShell/DscResources#203, they are saying that the Registry DSC Resource is part of the WMF release and can't be fixed out of band. The xRegistry DSC Resource is on github and can be released out of band. You can use either one depending on your company policies.

I did look at the whole output. Note in the output below (which is shortened for length, I only cut out parts that were not relevant) you can see that we do two operations.

Notice: Compiled catalog for win2012r2 in environment production in 0.82 seconds
Debug: Creating default schedules
Debug: Loaded state in 0.03 seconds
Debug: Loaded state in 0.05 seconds
Info: Applying configuration version '1475264065'
Debug: Reloading posix reboot provider
Debug: Facter: value for uses_win32console is still nil
Debug: PowerShell Version: 5.0.10586.117
############### SNIP ################
$invokeParams = @{
  Name          = 'Registry'
  Method        = 'test'
  Property      = @{
    key = 'HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server'
    valuename = 'Password'
    valuedata = @('00 00 00 00 00 00 00')
    valuetype = 'binary'
    hex = $true
  }
  ModuleName = "PSDesiredStateConfiguration"
}
############### SNIP ################
Debug: Waited 50 milliseconds...
############### SNIP ################
Debug: Waited 500 total milliseconds.

You can see above that we sent a TEST operation to DSC, in order to determine if the state of the server matches the state we expect. We pass all the information laid out in the manifest and tell DSC to check the value

Debug: Dsc Resource returned: {"rebootrequired":false,"indesiredstate":false,"errormessage":""}
Debug: Dsc Resource Exists?: false
Debug: ensure: present
Debug: Facter: value for uses_win32console is still nil
############### SNIP ################

Here we can see that DSC returns $false, indicating that the system does not match the desired state. This tells Puppet to apply the manifest to the system and effect the change.

$invokeParams = @{
  Name          = 'Registry'
  Method        = 'set'
  Property      = @{
    key = 'HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server'
    valuename = 'Password'
    valuedata = @('00 00 00 00 00 00 00')
    valuetype = 'binary'
    hex = $true
  }
  ModuleName = "PSDesiredStateConfiguration"
}
############### SNIP ################\
Debug: Waited 100 total milliseconds.
Debug: Create Dsc Resource returned: {"rebootrequired":false,"indesiredstate":true,"errormessage":""}
Notice: /Stage[main]/Main/Dsc_registry[foober]/ensure: created
Debug: /Stage[main]/Main/Dsc_registry[foober]: The container Class[Main] will propagate my refresh event
Debug: Class[Main]: The container Stage[main] will propagate my refresh event
Debug: Finishing transaction 56434520
Debug: Storing state
Debug: Stored state in 0.10 seconds
############### SNIP ################

After Puppet tells DSC to change the state by sending it a SET operation, DSC runs and returns a $true value indicating that it completed successfully and that the system is in the desired state.

So, in summary the DSC Resource is incorrectly reporting system state.

[marcinbojko]

@jpogran Thanks for the perfect explanation!

[jpogran]

Closing this out, as there is a workaround to use the xRegistry DSC Resource until the Registry DSC Resource has the correct fix.