How to install and deploy Network Controller on Windows Server

For those looking to streamline the management and automation of their networks—whether physical or virtual—on a Windows Server, configuring the Network Controller Server Role is essential. This role acts as a centralized solution for overseeing routers, switches, and firewalls, providing a cohesive approach to network management.

What is a Network Controller in Windows Server?

A Network Controller in Windows Server is a robust and scalable server role that facilitates centralized management of both physical and virtual network infrastructures. It functions as the core hub for configuring, monitoring, and troubleshooting network devices and services, empowering administrators to define and enforce network policies effectively.

To install and deploy a Network Controller on a Windows Server, follow these structured steps:

1. Create a Security Group
2. Install the Network Controller
3. Deploy Network Controller

1] Create a Security Group

Before deploying the Network Controller, it is necessary to establish an Active Directory Domain Services (AD DS) Security Group. Here’s how to do it:

1. In Active Directory User and Computer, expand your domain, right-click on the organizational unit where you wish to create the security group, and select New > Group.
2. Input the group name (e.g., Network Admin), select the scope (set it to Global), and choose the group type.
3. Right-click on the group and select Properties.
4. Navigate to Members > Add, enter “administrator” in the Enter the object names to select field, and click on Check Names. Additional users can be added as needed.
5. Create another group named Network Ops and include the previously added users.

Once the groups are established, request a certificate by launching the Certificate Enrollment Wizard on the server. Choose an appropriate certificate template for network controllers and submit the request to a Certificate Authority (CA). After approval, download and install the issued certificate on the server to ensure secure operations.

2] Install the Network Controller

The Network Controller is a server role that does not come pre-installed on Windows Server, so the initial task is to install it. Follow these steps:

1. Open Server Manager.
2. Navigate to Manage > Add Roles and Features.
3. Click Next when the Add Roles and Features wizard appears.
4. Ensure that Role-based or Feature-based installation is selected, then click Next.
5. Select your server from the server pool and click Next.
6. On the Server Roles tab, check the box for Network Controller, click on Add Features when prompted, and then click Next.
7. Since the required features are already installed, click Next to bypass the Features tab.
8. Review the details on the Network Controller tab and click Next.
9. Check the Restart the destination server automatically option, then click Install.

After a brief wait for the installation to complete, proceed to the next step.

3] Deploy Network Controller

To deploy the Network Controller, configuring the Network Controller cluster is necessary. Start by creating a cluster node. Open PowerShell as an administrator and execute the following command:

New-NetworkControllerNodeObject -Name  -Server  -FaultDomain  -RestInterface  [-NodeCertificate ]

• Name : Specifies the name of the network controller node.
• Server : Indicates the fully qualified domain name (FQDN) of the server hosting the network controller node.
• FaultDomain : Identifies the fault domain for the node, grouping servers that may fail together due to shared dependencies.
• RestInterface : Specifies the network interface on the server that will accept REST requests.
• NodeCertificate : Optional certificate for secure communications.

Next, run the following command to configure the cluster:

Install-NetworkControllerCluster -Node  -ClusterAuthentication  [-ManagementSecurityGroup ][-DiagnosticLogLocation ][-LogLocationCredential ] [-CredentialEncryptionCertificate ][-Credential ][-CertificateThumbprint ] [-UseSSL][-ComputerName ][-LogSizeLimitInMBs] [-LogTimeLimitInDays ]

• Node : Specifies an array of NetworkControllerNode objects representing the cluster nodes.
• ClusterAuthentication : Defines the authentication method for the cluster, including options like None, Kerberos, and X509Certificate.
• ManagementSecurityGroup : Names the security group managing the Network Controller.
• DiagnosticLogLocation : Indicates where diagnostic logs will be stored.
• LogLocationCredential : Specifies credentials for accessing the log location.
• CredentialEncryptionCertificate : Certificate used for encrypting credentials.
• Credential : Credentials for the Network Controller.
• CertificateThumbprint : Thumbprint of the certificate used for the Network Controller.
• UseSSL: Indicates whether SSL should be utilized for communications.
• ComputerName : Specifies the computer name where the cmdlet will execute.
• LogSizeLimitInMBs : Sets the maximum size for log files in megabytes.
• LogTimeLimitInDays : Sets the time limit for log files in days.

Finally, validate the deployment by running Get-NetworkController.