PowerShell Desired State Configuration: Push vs Pull Mode

─□✕

PowerShell Desired State Configuration gives you two fundamentally different delivery models for the same MOF configurations. Push mode is engineer-driven and immediate: you run a command, the config is applied. Pull mode is node-driven and autonomous: each managed system checks a central server on a schedule and self-corrects. The choice between them shapes your entire infrastructure management architecture, and getting it wrong means either operational friction or a pull server you don’t actually need.

Quick Answer

Use push mode for small environments (under ~30 nodes) and ad-hoc changes. Switch to pull mode when nodes must self-heal automatically, when you manage more than a few dozen machines, or when firewalls prevent outbound PowerShell remoting from your management machine.

Push Mode: Start-DscConfiguration Workflow

In push mode, you compile a configuration into a MOF file on your authoring machine and push it to target nodes using Start-DscConfiguration. The target node applies the MOF immediately via WinRM.

# Step 1: Define and compile the configuration
Configuration WebServerBaseline {
    param ([string[]] $ComputerName)
    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node $ComputerName {
        WindowsFeature IIS {
            Name   = "Web-Server"
            Ensure = "Present"
        }
        Service W3SVC {
            Name      = "W3SVC"
            State     = "Running"
            StartType = "Automatic"
        }
    }
}

# Compiles MOF files into .\WebServerBaseline\
WebServerBaseline -ComputerName "web01", "web02"

# Step 2: Push to nodes
Start-DscConfiguration -Path ".\WebServerBaseline" `
                        -ComputerName "web01", "web02" `
                        -Wait -Verbose -Force

The -Wait flag blocks until all nodes confirm completion. Drop it for asynchronous delivery to many nodes.

Pull Mode Architecture: Pull Server and Node Registration

In pull mode, each node’s Local Configuration Manager (LCM) polls a pull server at a defined interval, downloads any pending MOF, applies it, and reports compliance back. The pull server holds MOF files and their checksums. Nodes are identified by a ConfigurationID (GUID) or ConfigurationName (PS5 partial configurations).

# Typical pull server components:
# 1. An SMB share or HTTPS endpoint hosting MOF files + checksums
# 2. An optional reporting endpoint (HTTPS only)
# 3. Node LCMs configured to point at the pull server

# Name a MOF for a node using its ConfigurationID (GUID)
$guid = [guid]::NewGuid().ToString()
Write-Host "Node GUID: $guid"

# The MOF must be named: <GUID>.mof on the pull server
# Checksum must be:      <GUID>.mof.checksum

Configuring the LCM with Settings and ConfigurationID

The LCM is configured with a special DSC meta-configuration. After applying it, the node becomes a pull client.

[DSCLocalConfigurationManager()]
Configuration PullClientLCM {
    param ([string] $NodeGuid, [string] $PullServerShare)

    Settings {
        RefreshMode          = "Pull"
        ConfigurationID      = $NodeGuid
        RefreshFrequencyMins = 30
        RebootNodeIfNeeded   = $false
    }

    ConfigurationRepositoryShare SMBPull {
        SourcePath = $PullServerShare
    }
}

# Compile the meta-config
PullClientLCM -NodeGuid "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" `
              -PullServerShare "\\pullsrv01\DSCPull"

# Apply it to the local LCM
Set-DscLocalConfigurationManager -Path ".\PullClientLCM" -Verbose

After this, the LCM will poll the SMB share every 30 minutes for a MOF matching the node’s GUID. The node must have read access to the share and the DSC resource modules installed locally.

Setting Up an SMB Pull Server

An SMB pull server is the simplest option — just a file share with the right MOF and checksum files. No IIS required.

# On the pull server — create the share and set permissions
$pullPath = "C:\DSCPull"
New-Item -ItemType Directory -Path $pullPath -Force | Out-Null
New-SmbShare -Name "DSCPull" -Path $pullPath `
             -FullAccess "Domain Admins" `
             -ReadAccess "Domain Computers"

# Publish a compiled MOF with its checksum
$guid   = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
$mofSrc = ".\WebServerBaseline\web01.mof"

Copy-Item $mofSrc "$pullPath\$guid.mof"

# Generate checksum (requires xPSDesiredStateConfiguration or manual hash)
New-DscChecksum -Path "$pullPath\$guid.mof" -Force
# Creates $pullPath\$guid.mof.checksum

Write-Host "MOF and checksum published for node $guid"

Triggering Consistency Checks and Detecting Drift

You can force an immediate consistency check on a node without waiting for the next poll interval.

# Force an immediate LCM consistency check on a remote node
Invoke-CimMethod -ComputerName "web01" `
                 -Namespace "root/Microsoft/Windows/DesiredStateConfiguration" `
                 -ClassName "MSFT_DSCLocalConfigurationManager" `
                 -MethodName "PerformRequiredConfigurationChecks" `
                 -Arguments @{ Flags = [uint32]1 } `
                 -ErrorAction Stop

Viewing Compliance with Get-DscConfigurationStatus

Check whether the last consistency check succeeded, failed, or resulted in reboot.

# Local node
$status = Get-DscConfigurationStatus
$status | Select-Object Status, StartDate, DurationInSeconds,
                         NumberResourcesInDesiredState,
                         NumberResourcesNotInDesiredState

# Remote node
$status = Get-DscConfigurationStatus -CimSession (
              New-CimSession -ComputerName "web01" -ErrorAction Stop
          )
Write-Host "Compliance: $($status.Status)"

Status    StartDate            DurationInSeconds ResourcesOK ResourcesDrift
------    ---------            ----------------- ----------- --------------
Success   2025-09-01 08:00:12              14.3           2              0

Common Errors

Checksum file missing on pull server: If the .mof.checksum file is absent or stale, the node’s LCM will refuse to apply the MOF and will silently revert to the last known good configuration. Always regenerate the checksum with New-DscChecksum every time you update a MOF on the pull server.
LCM RefreshMode not set to Pull: If you publish a node’s MOF to a pull server but the node’s LCM is still in Push mode (the default), it will never contact the pull server. Verify the LCM mode with Get-DscLocalConfigurationManager | Select-Object RefreshMode on the target node before troubleshooting pull behavior.

Related Cmdlets / See Also

Wrapping Up

Push mode is the right starting point for small estates and rapid iteration. When autonomous self-healing and scale demand it, migrate to pull mode by configuring LCMs and standing up an SMB share — no IIS required. In both modes, Get-DscConfigurationStatus is your first stop for compliance verification.