Automate SQL 2012 policy management with powershell

Question

Hello.
I´m trying to automate policy management via Powershell and I´m running into some problems. What I want to do is register a SQL 2012 server to a group in a CMS server and then import a pre defined policy into that server. The first part where I register
the client server is no problem but I cant figure out how to import the policy.
Has anyone else run into this problem?
Regards.
/Niklas

Answer 1

Of course!
First thing you need to do if it is not already done is to register the CMS server. 
Set-Location "SQLSERVER:\SQLRegistration\Central Management Server Group"
New-Item -Name $CMSServer -ItemType registration -Value "server=$CMSServer;integrated security=true"
Second you want to register the client server into a CMS server group.
Set-Location "SQLSERVER:\SQLRegistration\Central Management Server Group\$CMSServer\SQL Server Group"
New-Item -Name $serverToRegister.Replace("\","`$") -ItemType registration -Value "server=$serverToRegister;integrated security=true"
When this is done I want to create my policy and schedule on all my target machines. I defined my policies directly in my powershell script so if
you want to import the exported policies you probably need to extract information from the XML files.
This example creates a schedule called hisec that executes daily at 1 am.
$createSchedulecommand = @"
DECLARE @start_date varchar(8) = convert(varchar(8), DATEADD(day,-1,GETDATE()), 112)
EXEC msdb.dbo.sp_add_schedule  @schedule_name = N'hisec',
@enabled = 1, @freq_type = 4, @freq_interval = 1, @active_start_date = @start_date,
@active_start_time = 010000; "@ 
Invoke-Sqlcmd -Query $createSchedulecommand -ServerInstance $targetInstanceName -Database "msdb" 
Next thing is to create my policy. This example checks if XPCmdShell is enabled.
$createPolicyCommand = @"
DECLARE @object_SET_id int
EXEC msdb.dbo.sp_syspolicy_add_object_SET
@object_SET_name=N'hisec_ObjectSET',
@facet=N'IServerSecurityFacet',
@object_SET_id=@object_SET_id OUTPUT;
DECLARE @target_SET_id int
EXEC msdb.dbo.sp_syspolicy_add_target_SET
@object_SET_name=N'hisec_ObjectSET',
@type_skeleton=N'Server',
@type=N'SERVER',
@enabled=True,
@target_SET_id=@target_SET_id OUTPUT;
GO
DECLARE @uid varchar(40)
SET @uid = (select schedule_uid from msdb..sysschedules where name = 'hisec')
DECLARE @policy_id int
EXEC msdb.dbo.sp_syspolicy_add_policy
@name=N'hisec',
@condition_name=N'ServerSecurity',
@policy_category=N'',
@description=N'',
@help_text=N'',
@help_link=N'',
@schedule_uid=@uid,
@EXECution_mode=4,
@is_enabled=True,
@policy_id=@policy_id OUTPUT,
@root_condition_name=N'',
@object_SET=N'hisec_ObjectSET';
GO
Invoke-Sqlcmd -Query $createPolicyCommand -ServerInstance $targetInstanceName
-Database "msdb"
Hope this can help you somehow.