WhatIsACompositeResource

What Is a PowerShell DSC (v2) Composite Resource?

To understand what a PowerShell DSC composite resource is, we first need to understand what a PowerShell DSC resource is.

---

What Is a PowerShell DSC Resource?

A PowerShell DSC (Desired State Configuration) resource is a packaged set of PowerShell files and supporting components that enables DSC to manage a specific type of system configuration.

Each DSC resource is designed to work with a related group of objects or settings, providing a standardized way to declare how those settings should be configured and enforced.

For example, the Registry DSC resource (which ships with Windows PowerShell) allows DSC configurations to manage Windows Registry keys and values declaratively. Rather than writing custom scripts, you describe the desired registry state in a configuration file, and DSC ensures that state is applied and maintained. Each resource may have different parameters, for example when working with the Windows registry, you have Keys and Values, but when working with the DSC File resource, you have path's and filenames.

Here is an example of using the Registry DSC resource.

Configuration SetContosoRegistry
{
    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node 'localhost'
    {
        Registry EnableContosoFeature
        {
            Ensure    = 'Present'
            Key       = 'HKLM:\Software\Contoso'
            ValueName = 'EnableFeature'
            ValueType = 'Dword'
            ValueData = 1
        }
    }
}

In short, DSC resources:

• Represent a single area of configuration (registry, files, services, firewall rules, etc.)
• Provide a declarative interface for managing that configuration
• Are consumed by DSC configurations rather than executed directly

---

What Is a DSC Composite Resource?

A DSC composite resource builds on this concept by combining multiple DSC resources into a single, reusable unit.

Instead of managing one type of setting, a composite resource wraps several DSC resources together to represent a higher‑level configuration scenario. This allows you to capture best practices and repeatable patterns in one place.

For example, a composite resource might:

• Install required Windows features
• Create folders and registry settings
• Configure services and security options

All of these steps can then be exposed as a single logical resource with a simplified set of parameters.

Composite resources are not implemented as PowerShell classes or MOF schemas. Instead, they are written as PowerShell DSC configurations and packaged inside a module so they behave like first‑class DSC resources.

End-to-End Windows PowerShell DSC Composite Resource Example

Reasoning

Contoso has a baseline that ALL workstations contains. The baseline has the following:

• Ensures a folder exists (c:\Contoso)
• optionally create a file inside it
• Sets a registry value (hklm:\software\contoso\EnableFeature (DWORD))

Instead of having each and every PowerShell DSC configuration contain the three items above, we can encapsulate them into a composite resource. Once they are contained in a composite resource, we then use that single resource to do the work of the three items in this case.

High-level Steps to Create and Use the Composite Resource

• Create the proper folder structure
• Create the module manifest
• Create the composite resource schema
• Create the configuration file - call it to create the .mof file
• Run Start-DscConfiguration using the newly created .mof file from above

---

Create the Proper Folder Structure

Create the following structure on the machine that will compile the configuration (typically the authoring host):

C:\Program Files\WindowsPowerShell\Modules\
└─ MyCompany.Baseline\
   └─ 1.0.0.0\
      │  MyCompany.Baseline.psd1
      └─ DscResources\
         └─ BaselineContoso\
            └─ BaselineContoso.schema.psm1

Why this matters: DSC v2 discovers composite resources by looking for .schema.psm1 under DscResources<ResourceName> inside a module folder. The module must export the resource via its manifest.

Create Module Manifest

Create this file at:

C:\Program Files\WindowsPowerShell\Modules\MyCompany.Baseline\1.0.0.0\MyCompany.Baseline.psd1

Manifest Contents

@{
    # This module only contains composite resources; RootModule is empty.
    RootModule        = ''
    ModuleVersion     = '1.0.0.0'
    GUID              = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'  # Use New-Guid to create a real one
    Author            = 'Your Team'
    CompanyName       = 'Your Company'
    Copyright         = '(c) Your Company. All rights reserved.'
    PowerShellVersion = '5.1'

    # Export the composite resource name(s)
    DscResourcesToExport = @('BaselineContoso')

    # Optional: RequiredModules if your composite uses community DSC modules
    # RequiredModules = @('xSomething', 'PSDscResources')
}

Create Composite Resource Schema

Create this file at:

C:\Program Files\WindowsPowerShell\Modules\MyCompany.Baseline\1.0.0.0\DscResources\BaselineContoso\BaselineContoso.schema.psm1

Schema Contents

This is the interface the consumer of this composite resource will use. The consumer can pass in different values or use the defaults Once this composite resource is created, we can begin using it.

# This is a Composite Resource implemented as a Configuration.
# Do NOT put Import-DscResource here. The consuming configuration will handle imports.

configuration BaselineContoso
{
    param(
        [ValidateSet('Present','Absent')]
        [string] $Ensure = 'Present',

        [string] $InstallPath = 'C:\Contoso',

        [uint32] $EnableFeatureValue = 1  # DWORD for registry value
    )

    # Folder baseline (removed recursively when Ensure='Absent')
    File ContosoFolder
    {
        Ensure          = $Ensure
        Type            = 'Directory'
        DestinationPath = $InstallPath
        Recurse         = $true
    }

    # Optional config file to demonstrate file management
    # This will be created/removed according to Ensure
    File ContosoConfig
    {
        Ensure          = $Ensure
        DestinationPath = (Join-Path $InstallPath 'contoso.config')
        Contents        = "Feature=$EnableFeatureValue"
        DependsOn       = '[File]ContosoFolder'
    }

    # Registry value baseline
    Registry EnableContosoFeature
    {
        Ensure    = $Ensure
        Key       = 'HKLM:\Software\Contoso'
        ValueName = 'EnableFeature'
        ValueType = 'Dword'
        ValueData = $EnableFeatureValue
    }
}

Notes:

This composite uses only built‑in resources (File, Registry) so there are no external dependencies.
If you use community resources (e.g., xPSDesiredStateConfiguration), the consuming configuration must Import-DscResource for those modules as well.

Create a Configuration File Consuming the Composite Resource

Save as ApplyBaseline.ps1 anywhere (e.g., your working folder):

Configuration ApplyBaseline
{
    # Import the built-in DSC module and YOUR composite module
    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName 'MyCompany.Baseline'

    Node 'localhost'
    {
        # Use the composite like any other DSC resource
        BaselineContoso Baseline
        {
            Ensure             = 'Present'
            InstallPath        = 'C:\Contoso'
            EnableFeatureValue = 1
        }
    }
}

# Compile -> creates .\ApplyBaseline\localhost.mof
ApplyBaseline

# Apply
Start-DscConfiguration -Path .\ApplyBaseline -Wait -Verbose -Force

Compiling and Applying a DSC Configuration

The script defines a DSC configuration named ApplyBaseline.
To generate the MOF file, the configuration name is invoked—much like calling a PowerShell function.

When the following line is executed:

ApplyBaseline

When this line is executed, the configuration is compiled, which produces a MOF file (for example, localhost.mof). At this stage, no configuration has been applied to the system; the desired state has only been translated into a MOF document.

Applying the configuration is handled by:

Start-DscConfiguration

This cmdlet instructs the Local Configuration Manager (think PowerShell DSC agent, usually called LCM) to apply one or more MOF files. The -Path parameter points to a directory that can contain one or multiple MOF files, all of which will be consumed and applied by the LCM.

Verify

# Registry value
Get-ItemProperty -Path 'HKLM:\Software\Contoso' -Name 'EnableFeature'

# File(s) and folder
Get-ChildItem -Path 'C:\Contoso' -Force

# DSC compliance
Test-DscConfiguration -Detailed

Why Use Composite Resources?

Composite resources help you:

• Reduce duplication across DSC configurations
• Encapsulate complex logic behind a simple interface
• Standardize configuration patterns across teams and environments
• Make DSC configurations easier to read and maintain

They are especially useful in larger solutions—such as security baselines, application stacks, or compliance frameworks—where the same group of settings must be applied consistently.

---

Summary

• A DSC resource manages a specific type of configuration
• A DSC composite resource combines multiple DSC resources into a single reusable unit
• Composite resources are written using PowerShell DSC configurations
• They enable cleaner, more maintainable, and standardized DSC implementations
• PowerStig creates composite resources that you consume in your configuration files.