Build and Validate a Cluster-Ready Host

# ============================================================
# Phase 1: Base OS Configuration
# ============================================================

# Set the hostname
$HostName = "HV-NODE-01"
Rename-Computer -NewName $HostName -Force

# Set the time zone (adjust for your location)
Set-TimeZone -Id "Eastern Standard Time"

# Configure Windows Update to download but not auto-install
# (You control when hosts reboot, not Microsoft)
$AutoUpdate = (New-Object -ComObject Microsoft.Update.AutoUpdate)
# For Server Core, use Group Policy or registry:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
    -Name "AUOptions" -Value 3 -Type DWord -Force

# Enable Remote Desktop
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" `
    -Name "fDenyTSConnections" -Value 0 -Force
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Enable Remote Management (for WAC and remote PowerShell)
Enable-PSRemoting -Force
winrm quickconfig -quiet

# Restart to apply hostname change
Restart-Computer -Force

# Join Active Directory domain
$Credential = Get-Credential -Message "Enter domain admin credentials"
Add-Computer -DomainName "yourdomain.local" -Credential $Credential `
    -OUPath "OU=Hyper-V Hosts,OU=Servers,DC=yourdomain,DC=local" -Force
Restart-Computer -Force

# ============================================================
# Phase 2: Roles and Features Installation
# ============================================================

# Install Hyper-V, Failover Clustering, and supporting features
$Features = @(
    "Hyper-V",
    "Failover-Clustering",
    "Multipath-IO",
    "RSAT-Clustering-PowerShell",
    "RSAT-Hyper-V-Tools",
    "Hyper-V-PowerShell",
    "Data-Center-Bridging"
)

Install-WindowsFeature -Name $Features -IncludeManagementTools -Restart

# After reboot, verify installation
Get-WindowsFeature | Where-Object { $_.Installed -eq $true -and $_.Name -in $Features } |
    Format-Table Name, InstallState -AutoSize

# Discover physical network adapters
Get-NetAdapter -Physical |
    Select-Object Name, InterfaceDescription, LinkSpeed, MacAddress, Status |
    Format-Table -AutoSize

# Check for RDMA capability
Get-NetAdapterRdma | Format-Table Name, Enabled, OperationalState -AutoSize

# Check for SR-IOV capability
Get-NetAdapterSriov | Format-Table Name, Enabled, NumVFs -AutoSize

# ============================================================
# Phase 3: SET Virtual Switch Configuration
# ============================================================

# Define the physical NICs to include in the SET team
# Replace with your actual adapter names from Get-NetAdapter
$TeamMembers = @("NIC1", "NIC2", "NIC3", "NIC4")

# Create the SET virtual switch
New-VMSwitch -Name "SET-Switch" `
    -NetAdapterName $TeamMembers `
    -EnableEmbeddedTeaming $true `
    -AllowManagementOS $true `
    -MinimumBandwidthMode Weight

Write-Host "SET Switch created successfully." -ForegroundColor Green

# The management vNIC is created automatically when AllowManagementOS = $true
# Rename it for clarity
Rename-VMNetworkAdapter -ManagementOS -Name "SET-Switch" -NewName "Management"

# Create additional vNICs for separated traffic
Add-VMNetworkAdapter -ManagementOS -SwitchName "SET-Switch" -Name "LiveMigration"
Add-VMNetworkAdapter -ManagementOS -SwitchName "SET-Switch" -Name "Storage"

# Assign VLANs to each vNIC
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "Management" -Access -VlanId 10
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "LiveMigration" -Access -VlanId 20
Set-VMNetworkAdapterVlan -ManagementOS -VMNetworkAdapterName "Storage" -Access -VlanId 30

# Assign IP addresses
New-NetIPAddress -InterfaceAlias "vEthernet (Management)" `
    -IPAddress "10.10.10.11" -PrefixLength 24 -DefaultGateway "10.10.10.1"
Set-DnsClientServerAddress -InterfaceAlias "vEthernet (Management)" `
    -ServerAddresses "10.10.10.5","10.10.10.6"

New-NetIPAddress -InterfaceAlias "vEthernet (LiveMigration)" `
    -IPAddress "10.10.20.11" -PrefixLength 24

New-NetIPAddress -InterfaceAlias "vEthernet (Storage)" `
    -IPAddress "10.10.30.11" -PrefixLength 24

# Set bandwidth weights (ensure critical traffic gets priority)
Set-VMNetworkAdapter -ManagementOS -Name "Management" -MinimumBandwidthWeight 10
Set-VMNetworkAdapter -ManagementOS -Name "LiveMigration" -MinimumBandwidthWeight 30
Set-VMNetworkAdapter -ManagementOS -Name "Storage" -MinimumBandwidthWeight 40

Write-Host "Host vNICs configured with VLAN separation." -ForegroundColor Green

# Verify SET switch team
Get-VMSwitch | Format-Table Name, SwitchType, EmbeddedTeamingEnabled -AutoSize
Get-VMSwitchTeam | Format-List *

# Verify host vNICs
Get-VMNetworkAdapter -ManagementOS |
    Select-Object Name, SwitchName, MacAddress, Status |
    Format-Table -AutoSize

# Verify VLAN assignments
Get-VMNetworkAdapterVlan -ManagementOS | Format-Table -AutoSize

# Verify IP addressing
Get-NetIPAddress -InterfaceAlias "vEthernet*" |
    Select-Object InterfaceAlias, IPAddress, PrefixLength |
    Format-Table -AutoSize

# Test connectivity on each vNIC
Test-NetConnection -ComputerName "10.10.10.1" -InformationLevel Detailed  # Gateway
Test-NetConnection -ComputerName "10.10.10.5" -InformationLevel Detailed  # DNS

# Enable RDMA on the Live Migration and Storage vNICs
Enable-NetAdapterRdma -Name "vEthernet (LiveMigration)"
Enable-NetAdapterRdma -Name "vEthernet (Storage)"

# Verify RDMA is enabled
Get-NetAdapterRdma -Name "vEthernet*" | Format-Table Name, Enabled -AutoSize

# For RoCEv2, configure Data Center Bridging (DCB) priority flow control
# This requires matching configuration on your physical switches
Install-WindowsFeature Data-Center-Bridging

# Create a QoS policy for RDMA traffic
New-NetQosPolicy -Name "SMB" -NetDirectPortMatchCondition 445 -PriorityValue8021Action 3
New-NetQosPolicy -Name "ClusterHeartbeat" -Cluster -PriorityValue8021Action 7

# Enable flow control for RDMA priority class
Enable-NetQosFlowControl -Priority 3
Disable-NetQosFlowControl -Priority 0,1,2,4,5,6,7

# Enable DCB on physical adapters
foreach ($Adapter in $TeamMembers) {
    Enable-NetAdapterQos -Name $Adapter
}

Write-Host "RDMA and DCB configured." -ForegroundColor Green

# ============================================================
# Phase 4: Storage Preparation
# ============================================================

# MPIO should already be installed from Phase 2
# Enable MPIO support for iSCSI devices
Enable-MSDSMAutomaticClaim -BusType iSCSI

# Verify MPIO is configured for iSCSI
Get-MSDSMAutomaticClaimSettings

# The server needs a reboot after enabling iSCSI MPIO claims
Restart-Computer -Force

# Start the iSCSI Initiator service and set to auto-start
Set-Service -Name MSiSCSI -StartupType Automatic
Start-Service -Name MSiSCSI

# Get the iSCSI Initiator IQN (you'll need this for storage array configuration)
$IQN = (Get-InitiatorPort).NodeAddress
Write-Host "iSCSI Initiator IQN: $IQN" -ForegroundColor Cyan

# Add iSCSI target portals (replace with your storage array IPs)
New-IscsiTargetPortal -TargetPortalAddress "10.10.30.100" -InitiatorPortalAddress "10.10.30.11"
New-IscsiTargetPortal -TargetPortalAddress "10.10.30.101" -InitiatorPortalAddress "10.10.30.11"

# Discover available targets
Get-IscsiTarget

# Connect to targets with MPIO (repeat for each path)
# Replace the NodeAddress with the IQN from your storage array
$TargetIQN = "iqn.2010-06.com.storagevendor:targetname"

Connect-IscsiTarget -NodeAddress $TargetIQN `
    -TargetPortalAddress "10.10.30.100" `
    -InitiatorPortalAddress "10.10.30.11" `
    -IsPersistent $true `
    -IsMultipathEnabled $true

Connect-IscsiTarget -NodeAddress $TargetIQN `
    -TargetPortalAddress "10.10.30.101" `
    -InitiatorPortalAddress "10.10.30.11" `
    -IsPersistent $true `
    -IsMultipathEnabled $true

# Verify iSCSI sessions
Get-IscsiSession | Format-Table InitiatorNodeAddress, TargetNodeAddress,
    IsConnected, IsPersistent -AutoSize

# Verify MPIO paths
Get-IscsiConnection | Format-Table ConnectionIdentifier, InitiatorAddress,
    TargetAddress -AutoSize

# Check MPIO policy on connected disks
Get-MSDSMGlobalDefaultLoadBalancePolicy
mpclaim -s -d  # Shows multipath devices and paths

# Set SAN policy to online shared disks (required for clustering)
Set-StorageSetting -NewDiskPolicy OnlineAll

# ============================================================
# Phase 5: Hyper-V Host Configuration
# ============================================================

# Set default VM storage paths
$VMPath = "C:\ClusterStorage\Volume1\VMs"       # Will be a CSV after clustering
$VHDPath = "C:\ClusterStorage\Volume1\VHDs"      # Adjust per your storage design

# For now, set temporary local paths (updated after cluster creation)
Set-VMHost -VirtualMachinePath "D:\VMs" -VirtualHardDiskPath "D:\VHDs"

# Create the directories if they don't exist
New-Item -Path "D:\VMs" -ItemType Directory -Force
New-Item -Path "D:\VHDs" -ItemType Directory -Force

# Configure Live Migration settings
Enable-VMMigration
Set-VMMigrationNetwork "10.10.20.0/24"  # Use the Live Migration VLAN

# Set authentication protocol for live migration
# Kerberos is recommended for domain-joined hosts (constrained delegation required)
# CredSSP is simpler but less secure
Set-VMHost -VirtualMachineMigrationAuthenticationType Kerberos

# Set maximum simultaneous live migrations
# Rule of thumb: 1 per 10 Gbps of live migration bandwidth
Set-VMHost -MaximumVirtualMachineMigrations 4

# Set maximum storage migrations
Set-VMHost -MaximumStorageMigrations 2

# Enable NUMA spanning (default, but verify)
Set-VMHost -NumaSpanningEnabled $true

# Configure enhanced session mode (Desktop Experience only)
Set-VMHost -EnableEnhancedSessionMode $true

# Verify host configuration
Get-VMHost | Format-List VirtualMachinePath, VirtualHardDiskPath,
    VirtualMachineMigrationEnabled, VirtualMachineMigrationAuthenticationType,
    MaximumVirtualMachineMigrations, MaximumStorageMigrations, NumaSpanningEnabled

# Run on a domain controller or machine with RSAT-AD-PowerShell
# Allow HV-NODE-01 to delegate to HV-NODE-02 for CIFS and Microsoft Virtual System Migration Service

$SourceNode = "HV-NODE-01"
$TargetNode = "HV-NODE-02"

# Get the computer objects
$Source = Get-ADComputer $SourceNode
$Target = Get-ADComputer $TargetNode

# Configure delegation for live migration and shared storage
Set-ADComputer -Identity $Source -Add @{
    'msDS-AllowedToDelegateTo' = @(
        "cifs/$TargetNode",
        "cifs/$TargetNode.yourdomain.local",
        "Microsoft Virtual System Migration Service/$TargetNode",
        "Microsoft Virtual System Migration Service/$TargetNode.yourdomain.local"
    )
}

# Repeat in reverse direction
Set-ADComputer -Identity $Target -Add @{
    'msDS-AllowedToDelegateTo' = @(
        "cifs/$SourceNode",
        "cifs/$SourceNode.yourdomain.local",
        "Microsoft Virtual System Migration Service/$SourceNode",
        "Microsoft Virtual System Migration Service/$SourceNode.yourdomain.local"
    )
}

Write-Host "Kerberos constrained delegation configured for live migration." -ForegroundColor Green

# ============================================================
# Phase 6: Comprehensive Validation
# ============================================================

# --- Network Validation ---

Write-Host "=== Network Validation ===" -ForegroundColor Cyan

# 1. Verify all vNICs are up
$vNICs = Get-NetAdapter -Name "vEthernet*"
foreach ($vNIC in $vNICs) {
    $status = if ($vNIC.Status -eq "Up") { "PASS" } else { "FAIL" }
    $color = if ($status -eq "PASS") { "Green" } else { "Red" }
    Write-Host "  $($vNIC.Name): $status ($($vNIC.LinkSpeed))" -ForegroundColor $color
}

# 2. Verify VLAN tagging
Get-VMNetworkAdapterVlan -ManagementOS | ForEach-Object {
    Write-Host "  $($_.ParentAdapter.Name): VLAN $($_.AccessVlanId)" -ForegroundColor White
}

# 3. Test connectivity on each network
$PingTests = @(
    @{ Name = "Gateway"; Target = "10.10.10.1"; Interface = "vEthernet (Management)" },
    @{ Name = "DNS"; Target = "10.10.10.5"; Interface = "vEthernet (Management)" },
    @{ Name = "DC"; Target = "10.10.10.5"; Interface = "vEthernet (Management)" }
)

foreach ($Test in $PingTests) {
    $Result = Test-NetConnection -ComputerName $Test.Target -WarningAction SilentlyContinue
    $status = if ($Result.TcpTestSucceeded -or $Result.PingSucceeded) { "PASS" } else { "FAIL" }
    $color = if ($status -eq "PASS") { "Green" } else { "Red" }
    Write-Host "  Ping $($Test.Name) ($($Test.Target)): $status" -ForegroundColor $color
}

# 4. Verify DNS resolution
$DNSTest = Resolve-DnsName -Name "yourdomain.local" -ErrorAction SilentlyContinue
if ($DNSTest) {
    Write-Host "  DNS Resolution: PASS" -ForegroundColor Green
} else {
    Write-Host "  DNS Resolution: FAIL" -ForegroundColor Red
}

# 5. Verify SET team health
$TeamInfo = Get-VMSwitchTeam
Write-Host "`n  SET Team Members:" -ForegroundColor White
foreach ($Member in $TeamInfo.NetAdapterInterfaceDescription) {
    $Adapter = Get-NetAdapter -InterfaceDescription $Member
    $color = if ($Adapter.Status -eq "Up") { "Green" } else { "Red" }
    Write-Host "    $($Adapter.Name): $($Adapter.Status) ($($Adapter.LinkSpeed))" -ForegroundColor $color
}

# --- Storage Validation ---

Write-Host "`n=== Storage Validation ===" -ForegroundColor Cyan

# 1. Check iSCSI sessions
$Sessions = Get-IscsiSession
Write-Host "  Active iSCSI Sessions: $($Sessions.Count)" -ForegroundColor White
$Sessions | ForEach-Object {
    Write-Host "    Target: $($_.TargetNodeAddress) Connected: $($_.IsConnected)" -ForegroundColor White
}

# 2. Check MPIO paths
Write-Host "`n  MPIO Paths:" -ForegroundColor White
$MPIODisks = Get-MSDSMGlobalDefaultLoadBalancePolicy
Write-Host "    Default LB Policy: $MPIODisks" -ForegroundColor White

# 3. Check visible disks
$Disks = Get-Disk | Where-Object { $_.BusType -ne "NVMe" -and $_.BusType -ne "SATA" -and $_.Number -gt 0 }
Write-Host "`n  SAN Disks Visible: $($Disks.Count)" -ForegroundColor White
foreach ($Disk in $Disks) {
    Write-Host "    Disk $($Disk.Number): $([math]::Round($Disk.Size / 1GB, 2)) GB - $($Disk.BusType) - $($Disk.OperationalStatus)" -ForegroundColor White
}

# 4. Quick storage latency test (write to iSCSI disk if available)
if ($Disks.Count -gt 0) {
    Write-Host "`n  Running basic I/O test..." -ForegroundColor Yellow
    # Simple sequential write test using diskspd or a basic file operation
    # For a proper baseline, use DiskSpd:
    # https://aka.ms/diskspd
    Write-Host "  (Use DiskSpd for production-grade storage baseline testing)" -ForegroundColor Gray
}

# --- Role and Feature Validation ---

Write-Host "`n=== Role and Feature Validation ===" -ForegroundColor Cyan

$RequiredFeatures = @(
    "Hyper-V", "Failover-Clustering", "Multipath-IO",
    "RSAT-Clustering-PowerShell", "Hyper-V-PowerShell"
)

foreach ($Feature in $RequiredFeatures) {
    $Installed = Get-WindowsFeature -Name $Feature
    $status = if ($Installed.InstallState -eq "Installed") { "PASS" } else { "FAIL" }
    $color = if ($status -eq "PASS") { "Green" } else { "Red" }
    Write-Host "  $($Feature): $status" -ForegroundColor $color
}

# Verify Hyper-V hypervisor is running
$HypervisorPresent = (Get-CimInstance Win32_ComputerSystem).HypervisorPresent
$color = if ($HypervisorPresent) { "Green" } else { "Red" }
Write-Host "  Hypervisor Present: $HypervisorPresent" -ForegroundColor $color

# --- Cluster Validation ---
# Run this when ALL nodes are prepared
# Replace node names with your actual hostnames

$Nodes = @("HV-NODE-01", "HV-NODE-02")

Write-Host "`n=== Running Cluster Validation ===" -ForegroundColor Cyan
Write-Host "This will take 10-30 minutes depending on configuration." -ForegroundColor Yellow

# Run all validation tests
Test-Cluster -Node $Nodes -Verbose

# The report is saved to:
# C:\Windows\Cluster\Reports\Validation Report <DateTime>.html
$ReportPath = Get-ChildItem "$env:SystemRoot\Cluster\Reports" -Filter "Validation*" |
    Sort-Object LastWriteTime -Descending | Select-Object -First 1
Write-Host "`nValidation report saved to: $($ReportPath.FullName)" -ForegroundColor Green

# If you only want to run specific test categories:
# Test-Cluster -Node $Nodes -Include "Network","Inventory","System Configuration"
# Available categories: Cluster Configuration, Hyper-V Configuration,
#   Inventory, Network, Storage, System Configuration

# ============================================================
# Phase 7: Basic Host Hardening
# ============================================================

# Enable Windows Defender (should be on by default)
Set-MpPreference -DisableRealtimeMonitoring $false

# Add exclusions for Hyper-V (prevents performance issues)
$HyperVExclusions = @(
    "D:\VMs",
    "D:\VHDs",
    "%ProgramData%\Microsoft\Windows\Hyper-V",
    "%SystemRoot%\System32\vmms.exe",
    "%SystemRoot%\System32\vmwp.exe",
    "%SystemRoot%\System32\vmcompute.exe"
)
foreach ($Exclusion in $HyperVExclusions) {
    Add-MpPreference -ExclusionPath $Exclusion
}
Add-MpPreference -ExclusionExtension "vhd","vhdx","avhd","avhdx","vhds","iso"

# Enable Credential Guard (protects domain credentials)
# Requires UEFI Secure Boot and TPM 2.0
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
    -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
    -Name "LsaCfgFlags" -Value 1 -Type DWord

# Disable unnecessary services
$DisableServices = @(
    "Browser",      # Computer Browser
    "lltdsvc",      # Link-Layer Topology Discovery Mapper
    "rspndr",       # Link-Layer Topology Discovery Responder
    "SharedAccess",  # Internet Connection Sharing
    "WlanSvc"       # WLAN AutoConfig (no WiFi on servers)
)
foreach ($Svc in $DisableServices) {
    $Service = Get-Service -Name $Svc -ErrorAction SilentlyContinue
    if ($Service) {
        Set-Service -Name $Svc -StartupType Disabled -ErrorAction SilentlyContinue
        Stop-Service -Name $Svc -Force -ErrorAction SilentlyContinue
    }
}

# Enable SMB encryption for cluster communication
Set-SmbServerConfiguration -EncryptData $true -Force

Write-Host "Basic host hardening applied." -ForegroundColor Green