@@ -6,7 +6,7 @@ ms.topic: how-to
6
6
---
7
7
# How to create Guest Configuration policies for Windows
8
8
9
- Before creating custom policies , it's a good idea to read the conceptual overview information at the
9
+ Before creating custom policy definitions , it's a good idea to read the conceptual overview information at the
10
10
page [ Azure Policy Guest Configuration] ( ../concepts/guest-configuration.md ) .
11
11
12
12
To learn about creating Guest Configuration policies for Linux, see the page
@@ -234,7 +234,7 @@ AuditBitLocker ./Config
234
234
```
235
235
236
236
Save this file with name ` config.ps1 ` in the project folder. Run it in PowerShell by executing ` ./config.ps1 `
237
- in the terminal. A new mof file will be created.
237
+ in the terminal. A new mof file is created.
238
238
239
239
The ` Node AuditBitlocker ` command isn't technically required but it produces a file named
240
240
` AuditBitlocker.mof ` rather than the default, ` localhost.mof ` . Having the .mof file name follow the
@@ -265,8 +265,7 @@ development environment as is used inside Azure machines. Using this solution, y
265
265
integration testing locally before releasing to billed cloud environments.
266
266
267
267
Since the agent is actually evaluating the local environment, in most cases you need to run the
268
- Test- cmdlet on the same OS platform as you plan to audit. The test will only use modules that are included
269
- in the content package.
268
+ Test- cmdlet on the same OS platform as you plan to audit. The test only uses modules that are included in the content package.
270
269
271
270
Parameters of the ` Test-GuestConfigurationPackage ` cmdlet:
272
271
@@ -387,8 +386,8 @@ files.
387
386
> - ** Tag** adds one or more tag filters to the policy definition
388
387
> - See the section [ Filtering Guest Configuration policies using Tags] ( #filtering-guest-configuration-policies-using-tags ) .
389
388
> - ** Category** sets the category metadata field in the policy definition
390
- > - If the parameter is not included, the category will default to Guest Configuration.
391
- > These features are currently in preview and require Guest Configuration module
389
+ > - If the parameter is not included, the category defaults to Guest Configuration.
390
+ > These features are in preview and require Guest Configuration module
392
391
> version 1.20.1, which can be installed using ` Install-Module GuestConfiguration -AllowPrerelease ` .
393
392
394
393
Finally, publish the policy definitions using the ` Publish-GuestConfigurationPolicy ` cmdlet. The
@@ -446,15 +445,15 @@ New-AzRoleDefinition -Role $role
446
445
### Filtering Guest Configuration policies using Tags
447
446
448
447
> [ !Note]
449
- > This feature is currently in preview and requires Guest Configuration module
448
+ > This feature is in preview and requires Guest Configuration module
450
449
> version 1.20.1, which can be installed using ` Install-Module GuestConfiguration -AllowPrerelease ` .
451
450
452
- The policies created by cmdlets in the Guest Configuration module can optionally include
451
+ The policy definitions created by cmdlets in the Guest Configuration module can optionally include
453
452
a filter for tags. The ** Tag** parameter of ` New-GuestConfigurationPolicy ` supports
454
- an array of hashtables containing individual tag entires. The tags will be added
455
- to the ` If ` section of the policy definition and cannot be modified by a policy assignment.
453
+ an array of hashtables containing individual tag entires. The tags are added
454
+ to the ` If ` section of the policy definition and can not be modified by a policy assignment.
456
455
457
- An example snippet of a policy definition that will filter for tags is given below.
456
+ An example snippet of a policy definition that filters for tags is given below.
458
457
459
458
``` json
460
459
"if" : {
@@ -472,13 +471,13 @@ An example snippet of a policy definition that will filter for tags is given bel
472
471
]
473
472
},
474
473
{
475
- // Original Guest Configuration content will follow
474
+ // Original Guest Configuration content
476
475
}
477
476
]
478
477
}
479
478
```
480
479
481
- ### Using parameters in custom Guest Configuration policies
480
+ ### Using parameters in custom Guest Configuration policy definitions
482
481
483
482
Guest Configuration supports overriding properties of a Configuration at run time. This feature
484
483
means that the values in the MOF file in the package don't have to be considered static. The
@@ -521,7 +520,7 @@ New-GuestConfigurationPolicy
521
520
> [ !Note]
522
521
> This feature is in preview and requires Guest Configuration module
523
522
> version 1.20.1, which can be installed using ` Install-Module GuestConfiguration -AllowPrerelease ` .
524
- > In version 1.20.1, this feature is only available for policies that audit Windows machines
523
+ > In version 1.20.1, this feature is only available for policy definitions that audit Windows machines
525
524
526
525
The artifact packages for Guest Configuration can be extended to include third-party tools.
527
526
Extending Guest Configuration requires development of two components.
@@ -532,12 +531,12 @@ Extending Guest Configuration requires development of two components.
532
531
- Convert output
533
532
- Content in the correct format for the tool to natively consume
534
533
535
- The DSC resource will require custom development if a community solution does not already exist.
534
+ The DSC resource requires custom development if a community solution does not already exist.
536
535
Community solutions can be discovered by searching the PowerShell Gallery for tag
537
536
[ GuestConfiguration] ( https://www.powershellgallery.com/packages?q=Tags%3A%22GuestConfiguration%22 ) .
538
537
539
538
> [ !Note]
540
- > Guest Configuration extensibility is currently a "bring your own
539
+ > Guest Configuration extensibility is a "bring your own
541
540
> license" scenario. Ensure you have met the terms and conditions of any third
542
541
> party tools before use.
543
542
@@ -547,7 +546,7 @@ content for the third-party platform in the content artifact.
547
546
548
547
### Step by step, creating a content artifact that uses third-party tools
549
548
550
- Only the ` New-GuestConfigurationPackage ` cmdlet will require a change from
549
+ Only the ` New-GuestConfigurationPackage ` cmdlet requires a change from
551
550
the step-by-step guidance for DSC content artifacts. For this example,
552
551
use the ` gcInSpec ` module to extend Guest Configuration to audit Windows machines
553
552
using the InSpec platform rather than the built-in module used on Linux. The
@@ -619,7 +618,7 @@ Configuration wmi_service
619
618
wmi_service -out ./Config
620
619
` ` `
621
620
622
- Run the You should now have a project structure as below :
621
+ You should now have a project structure as below :
623
622
624
623
` ` ` file
625
624
/ wmi_service
@@ -649,8 +648,8 @@ the previous step:
649
648
650
649
` ` ` azurepowershell-interactive
651
650
New-GuestConfigurationPackage `
652
- -Name 'AuditFilePathExists ' `
653
- -Configuration './Config/AuditFilePathExists .mof'
651
+ -Name 'wmi_service ' `
652
+ -Configuration './Config/wmi_service .mof' `
654
653
-FilesToInclude './wmi_service'
655
654
```
656
655
0 commit comments