Ensure a Windows Service Runs Automatically Using PowerShell DSC

Desired outcome

After the DSC configuration is applied, the target Windows service (for example, the Print Spooler service named Spooler) will:

• Exist on the system.
• Have its StartType set to Automatic.
• Be in the Running state.

Prerequisites

• PowerShell 5.1 or later (built‑in on Windows 10/11 and Windows Server 2016+).
• The PSDesiredStateConfiguration module (included with Windows Management Framework 5.1+).
• Administrator privileges on the target node.
• If managing a remote computer, WinRM must be enabled and firewall rules must allow PowerShell remoting.

Focused procedure

1. Create the DSC configuration file

   Save the following script as EnsureSpooler.ps1 on a management workstation.

   Configuration EnsureSpoolerService {
       Node 'localhost' {
         Service SpoolerService {
           Name          = 'Spooler'
           StartupType   = 'Automatic'
           State         = 'Running'
           DependsOn     = '[Service]SpoolerService'  # self‑reference to avoid duplicate block warnings
         }
       }
   }
   

   Run the script to define the configuration:

   # Run in an elevated PowerShell session
   .\EnsureSpooler.ps1
   

2. Compile the configuration to a MOF file

   This step creates the MOF that the Local Configuration Manager (LCM) consumes.

   EnsureSpoolerService -OutputPath ./Output
   

   The MOF will be placed in ./Output/EnsureSpoolerService.mof.

3. Apply the configuration

   For a local target, use Start-DscConfiguration. For a remote target, create a CIM session first.

   # Local application (requires admin)
   Start-DscConfiguration -Path ./Output -Wait -Verbose -Force
   
   # Remote application example (replace COMPUTER01 with the target name)
   # $session = New-CimSession -ComputerName COMPUTER01 -Credential (Get-Credential)
   # Start-DscConfiguration -Path ./Output -CimSession $session -Wait -Verbose -Force
   

   The -Wait flag makes the command block until LCM finishes; -Verbose provides detailed progress.

Expected checks

1. Validate service state directly

   Get-Service -Name Spooler | Select-Object Name, StartType, Status
   

   Expected output:

   Name   StartType Status
   ----   --------- ------
   Spooler Automatic Running
   

2. Run DSC compliance test

   Test-DscConfiguration
   

   A return value of True indicates the node matches the applied MOF.

3. Review DSC operational logs (optional)

   Get-WinEvent -LogName Microsoft-Windows-DSC/Operational |
     Where-Object TimeCreated -gt (Get-Date).AddHours(-1) |
     Format-Table TimeCreated, Message -AutoSize
   

   Look for events with IDs 4100 (configuration applied) or 4104 (errors).

Recovery options

If the configuration fails to apply or the service drifts from the desired state:

• Re‑apply the same MOF with force

  Start-DscConfiguration -Path ./Output -Wait -Verbose -Force
  

  This tells LCM to enforce the configuration again, overwriting any conflicting settings.

• Roll back to the last known good configuration

  DSC retains a history of applied MOFs under $env:SystemRoot\System32\Configuration. To revert:

  # List available configurations
  Get-DscConfigurationStatus -All
  
  # Choose a previous ConfigurationID (e.g., GUID) and restore
  Start-DscConfiguration -Path $env:SystemRoot\System32\Configuration\ -Wait -Force
  

• Manual service reset (as a last resort)

  Set-Service -Name Spooler -StartupType Automatic
  Start-Service -Name Spooler
  

  After manual correction, re‑run Test-DscConfiguration to confirm LCM now reports compliance.

Limitations and verification tips

• The Service block cannot be duplicated for the same service name within a single configuration; duplicates cause a compilation error.
• LCM must be in a mode that allows ApplyAndMonitor or ApplyAndAutoCorrect (the default). If LCM is set to ApplyOnly, the configuration will be applied once but will not auto‑correct drift.
• When targeting remote machines, ensure WinRM listener is configured (winrm quickconfig) and that the firewall allows inbound traffic on ports 5985 (HTTP) or 5986 (HTTPS).
• Always run verification steps (Get-Service, Test-DscConfiguration) after applying or rolling back to confirm the desired state is achieved.