# Deploying to Windows: artifacts, DSC and the container boundary

> Ship immutable artifacts, use PowerShell DSC or a pipeline for config, and know when Windows containers help versus when they add work.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Three layers:

1. **Artifact** — a versioned build (zip/msi/container image), immutable.
2. **Config** — DSC/pipeline, not hand edits on the server.
3. **Release** — swap/stage, health check, rollback.

If you still copy files over RDP, you cannot answer “what is running?”.

## Artifact

- Build once, deploy the same bytes to every node.
- Version it (`app-2026.10.29-1`), keep a checksum.
- Include `web.config`, migrations and static assets.
- Keep the last N artifacts for rollback.

## Config

PowerShell DSC can enforce IIS site/app-pool state:

```powershell
Configuration WebTier {
  Import-DscResource -ModuleName PSDesiredStateConfiguration, WebAdministration
  Node 'localhost' {
    WindowsFeature IIS { Name = 'Web-Server'; Ensure = 'Present' }
    WebAppPool AppPool {
      Name = 'apppool'; Ensure = 'Present'
      managedRuntimeVersion = ''
    }
    WebSite Site {
      Name = 'app'; PhysicalPath = 'C:\sites\app'
      ApplicationPool = 'apppool'; State = 'Started'
      Ensure = 'Present'
    }
  }
}
```

DSC needs the WebAdministration DSC resources (or `xWebAdministration`) and a pull/apply story. It is not a one-liner.

## Release

- Deploy to a staging slot/folder; warm up.
- Switch the site root or binding; keep the old folder.
- Health check `/readyz`; roll back on failure.
- Deploy during low traffic; watch 5xx/latency.

## Containers

Windows containers can help when:

- the app is self-contained and Windows-compatible;
- you need identical dev/prod;
- you already run container orchestration.

They add work when:

- the app needs host IIS modules/COM/registry;
- base image size/version mismatch (Server 2022 vs 2025);
- you have no registry/patching pipeline.

> **Caution: Containers do not remove patching**
>
> A Windows container still needs a patched base image, a rebuilt app image, and a registry. If you cannot patch VMs, you will not patch images either.

## Verify

```powershell
(Get-Item C:\sites\app\app.dll).VersionInfo.FileVersion
Get-WebSite app | Select-Object Name,PhysicalPath,State
```

Check the deployed version matches the artifact, and the site root points where you think.

## Lab boundary

E1. The lab deployed by hand (IIS site, Nginx zip, PHP zip) and did not run DSC or containers. The pipeline is the production method for Server 2025.

## Sources

- [Microsoft Learn — PowerShell DSC](https://learn.microsoft.com/en-us/powershell/dsc/overview)
- [Microsoft Learn — Windows containers](https://learn.microsoft.com/en-us/virtualization/windowscontainers/about/)
- [Microsoft Learn — Web Deploy](https://learn.microsoft.com/en-us/iis/publish/using-web-deploy/introduction-to-web-deploy)

---

Source: https://winbook.fyi/en/server/ops/deploy/