Validate the expanded Machine Configuration package, not just its ZIP size

Source facts

A Machine Configuration artifact must be a ZIP archive no larger than 100 MB when uncompressed. The expected contents include the compiled MOF, required DSC resource modules and a metaconfig file describing package type and version; no root or version folder is required.

The packaging command collects required modules from the authoring environment’s PSModulePath. Microsoft separately warns against placing secrets or confidential information in custom packages. Microsoft Learn.

Applicability

Identify the intended target platforms and documented authoring prerequisites. This check concerns the completed artifact, not whether the target has the network access or agent version required to use it.

DSE recommendation

DSE recommends inspecting a safely expanded copy of the built package before release. Measure its total uncompressed content and compare the module inventory with the compiled configuration’s dependencies. Review included files for unintended credentials or confidential material. Record the exact tested artifact and authoring environment so a later rebuild does not silently substitute a different dependency set.

Verification

Use a clean, approved test environment to validate the package and its expected configuration behavior. Confirm required modules are inside the artifact rather than merely installed on the build machine. Retain the size calculation, file inventory and test result. Do not accept a package solely because compression brought the download below 100 MB or because the authoring workstation already had every dependency available.

Official references

Microsoft Learn: How to create custom machine configuration package artifacts. Source retrieved September 9, 2026.