How to always execute Get-Asset in Role?

[Adam1]

I use the custom DSC resource to import and apply the certificate for use with the RDS role.

Before running Ensure-DscResource I need to download the appropriate certificate from the repository. I'm trying to download the certificate to a temporary directory using Get-Asset to use it later with a DSC resource. The server configuration is as follows:

Get-Asset server.domain.lab.pfx
(
    Type: File
);

Ensure-DscResource
(
    ConfigurationKey: $Role,
    Name: xRDCertificateConfiguration,
    Module: xRemoteDesktopSessionHost,
    Properties: %(
        Role: RDRedirector,
        ConnectionBroker: server.domain.lab,
        ImportPath: $PathCombine($WorkingDirectory, server.domain.lab.pfx),
        Credential: $PSCredential(Certificate, P@ssw0rd)
    )
);

The file is unfortunately not downloaded.
If I create a plan with the same script, everything works fine and the file is downloaded.

How can I assure that this file is downloaded in a role? I try to avoid using Ensure-Asset.

[atripp]

Great question!

The answer is, unfortunately, buried in the Formal Specifications. But long story short, you'll want to wrap the Get-Asset operation in a with executionPolicy = always block.

For more information, note that there are three modes of executions:

• Collect Only - only ICollectingOperation operations will run; if the operation is a IComparingOperation, then drift may be indicated. All ensure operations implement both interfaces.
• Collect then Execute - a collection pass is performed as described above; if any drift is indicated, an execution pass is performed that runs:
  • operations that indicated drift
  • IExecutingOperation operations in the same scope as a drift-indicating operation that do not implement - IComparingOperation; this is all execution actions
  • operations with an execution policy of AlwaysExecute; this can only be set on a Context Setting Statement
• Execute Only- only IExecutingOperation operations will run; all ensure and execute operations implement this interface

So what's happening is that Get-Asset will never run in a Collect pass, where as Ensure-DscResource will always run in a Collect pass (but only in Collection mode). By forcing Get-Asset to always execute, it will run even in the collect pass.

By the way: I would love to find a way to properly document the answer to this, so users don't get frustrated; any suggestions on where to edit the contents?