Hyper-V SCADA Server Build on Dell PowerEdge

01 — What you are building

One Dell PowerEdge server, single host, running Windows Server 2022 with the Hyper-V role. Four VMs sit on top: a SQL Server 2022 historian, a KEPServerEX gateway, a SCADA engineering workstation, and a small Linux utility VM. The KEPServerEX VM polls a SEL RTAC over DNP3 on the plant LAN and forwards data to SQL on the management vSwitch. The SCADA workstation reads from SQL and from KEPServerEX OPC UA. Everything is on one physical box. This is the architecture that runs most utility-scale solar plants under about 50 MW.

02 — Hardware: Dell PowerEdge, PERC, 4 SSDs, NICs

Spec sheet for a typical plant SCADA host. Adjust by tag count and historian retention requirement.

03 — RAID configuration

Four SSDs gives three reasonable layouts. The selector below shows the tradeoffs. Pick one before installing the OS; reconfiguring RAID after install means rebuilding the box.

The recommendation for a typical plant SCADA host is RAID 10. Rebuild time on a failed SSD is shorter, write performance is high (SQL log writes love this), and you tolerate one drive failure with capacity for a second-drive failure in the right pair. If historian retention is unusually large and you cannot grow the box, RAID 5 buys you 50% more usable space at the cost of slower writes and longer rebuild.

Configuring RAID 10 via PERC CLI

The Dell PERC CLI tool (perccli64 on Windows, perccli on Linux pre-OS environments) is more reproducible than the iDRAC GUI walkthrough because the syntax doesn't change with firmware revisions. The commands below assume the PERC is at controller index 0 (the default on a single-controller box).

# List physical drives so you know your enclosure and slot IDs
perccli64 /c0 show all

# Create a RAID 10 virtual disk across slots 0:0, 0:1, 0:2, 0:3
# wt = write-through during creation, change to wb (write-back) after BBU verifies
perccli64 /c0 add vd r10 drives=32:0,32:1,32:2,32:3 wt ra direct

# After the BBU (battery-backed cache) reports good, switch to write-back
perccli64 /c0/v0 set wrcache=wb

# Initialize fully (not fast init) before putting data on it
perccli64 /c0/v0 start init full

# Check progress
perccli64 /c0/v0 show initialization

04 — iDRAC, before the OS install

Do this in F2 BIOS Setup on first boot, before you have any OS on the box. If you skip it and install Windows first, you will be redoing it from a freshly racked server in a noisy comms room.

05 — Installing Windows Server 2022

Mount the Windows Server 2022 ISO through iDRAC virtual media. From your laptop: iDRAC web interface → Virtual Console → Virtual Media → Map ISO. Boot the server from virtual CD/DVD. The install runs normally from here.

• Edition: Standard with Desktop Experience. Datacenter only makes sense if you intend to run more than two Windows VMs on the same host (Datacenter licenses unlimited VMs on the host hardware). For this build, Standard is enough.
• Partitioning: Let the installer use the entire RAID virtual disk. Do not pre-partition. The installer creates the system partition, recovery partition, and the C: drive. You will add a data volume after the OS is up.
• Local administrator password: Site password vault, 20+ characters. Never reuse a password across plants.

After first boot:

# Rename the host to something predictable
Rename-Computer -NewName "PLANT01-SCADA01" -Restart

# After reboot, set the time zone (UTC on plant servers is the safest default,
# but if your historian reports in local time, pick the plant local zone)
Set-TimeZone -Id "UTC"

# Install all current updates before adding any roles
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck -AllowClobber
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

# Disable IE Enhanced Security (it gets in the way of downloading drivers from Dell)
$AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}"
Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0

06 — Network: virtual switches and NIC binding

Decide your physical NIC layout before building any vSwitch. The architecture diagram in §01 shows the target. Confirm each physical adapter shows up in Windows and is named obviously.

# See current adapters and their MACs
Get-NetAdapter | Select-Object Name, MacAddress, LinkSpeed, Status

# Rename them so they are not "Ethernet 1" through "Ethernet 4"
Rename-NetAdapter -Name "Ethernet" -NewName "NIC-Plant"
Rename-NetAdapter -Name "Ethernet 2" -NewName "NIC-Mgmt"
Rename-NetAdapter -Name "Ethernet 3" -NewName "NIC-Eng"
# (NIC 4 is the iDRAC port — not visible in Windows, lives behind the BMC)

# Build the three virtual switches
New-VMSwitch -Name "vSwitch-Plant" -NetAdapterName "NIC-Plant" -AllowManagementOS $false
New-VMSwitch -Name "vSwitch-Mgmt"  -SwitchType Internal
New-VMSwitch -Name "vSwitch-Eng"   -NetAdapterName "NIC-Eng" -AllowManagementOS $true

# Verify
Get-VMSwitch | Format-Table Name, SwitchType, NetAdapterInterfaceDescription

The -AllowManagementOS $false on the plant switch is deliberate: the host operating system does not need an IP on the plant LAN. Only the VMs that participate in plant traffic (KEPServerEX) get vNICs there. This keeps Windows Update traffic and corporate network activity entirely off the plant VLAN.

07 — Enabling Hyper-V

# Install the Hyper-V role with the management tools
Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -Restart

# After reboot, set a sensible default location for VHDX files
Set-VMHost -VirtualMachinePath "D:\VMs" -VirtualHardDiskPath "D:\VHDX"

# Confirm
Get-VMHost | Select-Object VirtualMachinePath, VirtualHardDiskPath

The data volume (D:) is the volume you build on the RAID-10 array after Windows is up. Use Disk Management or the PowerShell New-Volume cmdlet to format it NTFS with 64 KB allocation unit size — SQL Server, Hyper-V, and large-file workloads all benefit from 64 KB clusters.

08 — VM build: SQL Server 2022

SQL Server is the historian backbone. KEPServerEX will write to it through ODBC or the Industrial Data Forwarder; the SCADA workstation reads from it for reports and trends.

Create the VM

$vm = "SQL01"
$path = "D:\VMs\$vm"

# Generation 2 = UEFI + Secure Boot, required for modern Windows VMs
New-VM -Name $vm -Generation 2 -MemoryStartupBytes 16GB -Path $path `
       -NewVHDPath "D:\VHDX\$vm-OS.vhdx" -NewVHDSizeBytes 80GB -SwitchName "vSwitch-Mgmt"

Set-VMProcessor -VMName $vm -Count 4
Set-VMMemory -VMName $vm -DynamicMemoryEnabled $false -StartupBytes 16GB

# Add a second VHDX dedicated to SQL data files
New-VHD -Path "D:\VHDX\$vm-DATA.vhdx" -SizeBytes 500GB -Fixed
Add-VMHardDiskDrive -VMName $vm -Path "D:\VHDX\$vm-DATA.vhdx"

# Add a third VHDX for SQL log files (separate physical-like volume keeps log I/O off data I/O)
New-VHD -Path "D:\VHDX\$vm-LOG.vhdx" -SizeBytes 100GB -Fixed
Add-VMHardDiskDrive -VMName $vm -Path "D:\VHDX\$vm-LOG.vhdx"

Start-VM -Name $vm

Install SQL Server 2022 Standard

Inside the VM, mount the SQL Server 2022 ISO. The GUI installer works, but a configuration file install is reproducible and is what should go in the site runbook. Save the following as ConfigurationFile.ini on the SQL01 VM:

[OPTIONS]
ACTION="Install"
ENU="True"
QUIET="True"
QUIETSIMPLE="False"
UpdateEnabled="True"
ERRORREPORTING="False"
USEMICROSOFTUPDATE="True"
FEATURES=SQLENGINE,FULLTEXT,CONN,BC,SDK,SQL_INST_MR,SQL_INST_MPY
HELP="False"
INDICATEPROGRESS="True"
X86="False"
INSTANCENAME="MSSQLSERVER"
INSTANCEID="MSSQLSERVER"
INSTANCEDIR="C:\Program Files\Microsoft SQL Server\"
INSTALLSHAREDDIR="C:\Program Files\Microsoft SQL Server\"
INSTALLSHAREDWOWDIR="C:\Program Files (x86)\Microsoft SQL Server\"
INSTALLSQLDATADIR="E:\SQLData"
SQLBACKUPDIR="E:\SQLBackup"
SQLUSERDBDIR="E:\SQLData"
SQLUSERDBLOGDIR="F:\SQLLog"
SQLTEMPDBDIR="E:\SQLData"
SQLTEMPDBLOGDIR="F:\SQLLog"
SQLSVCACCOUNT="NT Service\MSSQLSERVER"
SQLSVCSTARTUPTYPE="Automatic"
AGTSVCACCOUNT="NT Service\SQLSERVERAGENT"
AGTSVCSTARTUPTYPE="Automatic"
SQLSYSADMINACCOUNTS="BUILTIN\Administrators"
SECURITYMODE="SQL"
TCPENABLED="1"
NPENABLED="0"
BROWSERSVCSTARTUPTYPE="Disabled"

# Run the unattended install (replace SA_PASSWORD with the actual one from your vault)
.\setup.exe /ConfigurationFile=ConfigurationFile.ini /IAcceptSQLServerLicenseTerms /SAPWD="REDACTED" /PID="YOUR-LICENSE-KEY"

Inside SQL Server Management Studio after install, create the historian database with pre-grown files. Setting initial size to the expected one-year footprint avoids autogrow events during heavy DNP3 traffic, which can stall writes and bunch up SCADA alarms.

CREATE DATABASE PlantHistorian
ON PRIMARY (
    NAME = 'PlantHistorian_data',
    FILENAME = 'E:\SQLData\PlantHistorian.mdf',
    SIZE = 50GB,
    MAXSIZE = 400GB,
    FILEGROWTH = 5GB
)
LOG ON (
    NAME = 'PlantHistorian_log',
    FILENAME = 'F:\SQLLog\PlantHistorian_log.ldf',
    SIZE = 10GB,
    MAXSIZE = 50GB,
    FILEGROWTH = 1GB
);
GO
ALTER DATABASE PlantHistorian SET RECOVERY SIMPLE;
GO

09 — VM build: KEPServerEX

KEPServerEX (now formally Kepware Server, but everyone calls it KEPServerEX) is the protocol gateway. It speaks DNP3 to the RTAC, OPC UA to the SCADA workstation, and ODBC to SQL.

Create the VM

$vm = "KEP01"
New-VM -Name $vm -Generation 2 -MemoryStartupBytes 8GB -Path "D:\VMs\$vm" `
       -NewVHDPath "D:\VHDX\$vm-OS.vhdx" -NewVHDSizeBytes 80GB
Set-VMProcessor -VMName $vm -Count 4
Set-VMMemory -VMName $vm -DynamicMemoryEnabled $false -StartupBytes 8GB

# KEPServerEX needs two vNICs: one on plant LAN to talk DNP3 to the RTAC,
# one on management to serve OPC UA and ODBC
Add-VMNetworkAdapter -VMName $vm -SwitchName "vSwitch-Plant" -Name "Plant"
Add-VMNetworkAdapter -VMName $vm -SwitchName "vSwitch-Mgmt"  -Name "Mgmt"
Set-VMNetworkAdapter -VMName $vm -Name "Plant" -MacAddressSpoofing Off

Start-VM -Name $vm

Install and harden KEPServerEX

Inside the KEP01 VM, install Windows Server 2022 Standard or Windows 10/11 Pro (KEPServerEX runs fine on either; Server is preferred for licensing alignment). Then install KEPServerEX with the DNP Master Suite and OPC UA Server features selected. Defaults are fine until you get to OPC UA security — those defaults are not safe.

10 — Connecting KEPServerEX to SEL RTAC over DNP3

The central question of this article. The SEL RTAC presents itself on the plant LAN as a DNP3 outstation at a known IP address with a known DNP outstation address (the address you assigned in AcSELerator RTAC when you configured its DNP3 Server task). KEPServerEX is the DNP3 master that polls it.

Step A: Confirm the RTAC outstation is configured

On the RTAC, AcSELerator RTAC must have a DNP3 Server (outstation) configured with:

• Listening on TCP port 20000 (default DNP3 over TCP port)
• An outstation DNP address (typically 1 for a single-plant configuration; document this)
• The point map you developed using the DNP3 point list design process
• Unsolicited responses configured for Class 1 events

Step B: Add the DNP3 Master channel in KEPServerEX

1. Open KEPServerEX Configuration. Right-click "Connectivity" → New Channel.
2. Driver: DNP Master Ethernet. (Requires the DNP Master Suite license.)
3. Channel name: RTAC_DNP3
4. Default Datatypes: leave as defaults; KEP figures these out from the point map.
5. On the network interface page, bind the channel to the IP address that lives on the plant vNIC, not the management vNIC. This forces DNP3 traffic out the correct interface.

Step C: Add the RTAC as a Device under that channel

Step D: Build the tag list

KEP's DNP3 driver can auto-build the tag list from the outstation's response to a class poll, or you can manually create tags matching the point list. Auto-build is faster on initial commissioning; manual is what you need for production because it forces you to document every tag's data type, deadband, and scaling.

# Example tag definitions (KEP CSV import format)
# Group_Variation maps to DNP3 object/variation as defined in IEEE 1815

Tag Name,         Address,                       Data Type, Scaling, Notes
POI_Active_Power, Group32_Var3_Index0,           Float,     1.0,     AI3 from RTAC, kW
POI_Reactive_Pwr, Group32_Var3_Index1,           Float,     1.0,     AI3 from RTAC, kVAR
POI_Voltage_A,    Group32_Var3_Index2,           Float,     1.0,     AI3, line-to-ground volts
Main_Bkr_52a,     Group2_Var1_Index0,            Boolean,   ,        BI1 with timestamp
Q_Setpoint_Echo,  Group32_Var3_Index10,          Float,     1.0,     AI3 echo of AO setpoint
Q_Setpoint_Cmd,   Group41_Var3_Index0,           Float,     1.0,     AO3 to RTAC, kVAR
Trip_Plant_Cmd,   Group12_Var1_Index0,           Boolean,   ,        BO1 SBO required

Step E: Verify the link is up and points are good

In KEP Configuration, right-click the device → Quick Client. The Quick Client opens an OPC UA browser that lets you watch tag values update in real time. What to look for:

• Quality Good on every tag. Quality Bad on a single tag points to a wrong index or wrong group/variation. Quality Bad on every tag points to a link-layer problem (wrong IP, wrong port, wrong master/outstation address pair).
• Values updating at the expected rate. If POI_Active_Power stays static for a minute then jumps, you are getting integrity polls only and unsolicited is broken.
• No "Master/Slave Address Mismatch" in the event log. This means KEP is sending master address X and the RTAC expects Y. Fix on whichever side is wrong.

Step F: Forward to SQL

The Industrial Data Forwarder (IDF) plugin in KEPServerEX or the ODBC Client driver can write tag values into the historian database. IDF is the modern path. Configure an IDF Agent pointing at the SQL Server VM on the management network, with the agent's connection string targeting PlantHistorian and using SQL authentication with the scada-historian user. Throttle the write batch size — without throttling, a noisy DNP3 update can spike SQL log writes and cause queue back-pressure.

11 — VM build: SCADA / engineering workstation

This VM hosts the SCADA designer (Ignition Designer, GPM screens, or whatever platform the plant uses) and the operator-facing HMI. Spec: 4–8 vCPU, 16 GB RAM, 200 GB OS VHDX. Connect both vSwitch-Mgmt (to talk to KEP and SQL) and vSwitch-Eng (so operators can reach the screens from the engineering LAN). This VM has no plant LAN access — it never needs to talk DNP3 directly.

12 — VM build: Linux utility

Smallest VM on the box — 2 vCPU, 4 GB RAM, 60 GB VHDX, single vNIC on vSwitch-Mgmt. Pick a long-term support distribution: Ubuntu Server 22.04 LTS or Debian 12. Three common roles for this VM:

• Mosquitto MQTT broker. If the plant publishes to a cloud SCADA or to N3uron's MQTT module, the broker runs here. See the N3uron MQTT bridge article for the publish-side configuration.
• InfluxDB or TimescaleDB historian. An alternative to SQL Server for plants that prefer open-source historians or need higher write throughput than SQL's row-store handles comfortably.
• Packet capture box. tcpdump or Wireshark on a mirrored switch port. When the plant has intermittent DNP3 link drops or GOOSE timing issues, having a Linux capture VM ready to record on demand is faster than scrambling to set one up during the incident.

13 — Time sync — why this matters for DNP3

DNP3 carries timestamps. SOE (sequence of events) records carry exact times for faults. If the RTAC clock and the SCADA host clock disagree by even a few seconds, your historian shows fault events out of order. Worse: if the Hyper-V host clock jumps backwards (it can, on first boot or after a sync correction), the VMs inherit that jump and SQL Server logs writes with timestamps earlier than the previous write. This can corrupt the transaction log.

What to configure

1. Host: Point Windows Time service at a real NTP source. On a substation that means the GPS-synchronized substation clock (often a Meinberg or Tekron device) on the plant LAN, not time.windows.com. w32tm /config /manualpeerlist:"10.x.x.x" /syncfromflags:manual /reliable:yes /update
2. VMs: Either disable Hyper-V Integration Services Time Sync and run NTP inside the VM, OR keep Integration Services Time Sync on and disable in-VM NTP. Not both. The two fighting each other gives unpredictable drift.
3. Inside SQL VM: Confirm SQL Server's transaction log timestamps are monotonic after any clock correction. SELECT MAX(begin_time) FROM sys.dm_db_log_info(DB_ID('PlantHistorian')) should never go backwards.

14 — Backup and recovery

Three layers to think about:

• Hyper-V VM-level backup. Windows Server Backup is free and works for single-host. Veeam Community Edition is free for up to 10 VMs and is what most plants use. Schedule full weekly, incremental nightly. Target a NAS on the management VLAN, not the same physical box.
• SQL Server native backup. Full database backup nightly, transaction log backup every 15 minutes during the day. Restore takes longer from VM snapshot alone than from SQL backups, because SQL knows how to roll forward.
• Config-level backup. The KEPServerEX project file, the SCADA project archive, AcSELerator RTAC project file. These are small and version-controllable. Push them to a Git repository on the engineering LAN or to the corporate file share. Restoring a plant from VHDX backup is hours; restoring from config-level backup onto a fresh OS is days. Both matter, for different recovery scenarios.

15 — Commissioning checklist

→ Continue to SEL RTAC as Power Plant Controller · → N3uron MQTT bridge · → DNP3 Point List Design