If you administer Windows (and not Linux)

Most Lattice sites are run by Windows / Active Directory people. That is the default reader. You do not need to become a Linux administrator. You do need a few copy-paste habits on the Ubuntu VM that hosts Lattice.

Linux-fluent readers can skip this page. The operations are the same; this page makes the Windows translations explicit.

Install next: install-prerequisites. First console login: first-login. Relays (ip helper-address): relays. AD DNS keytab: ad-ddns. Many sites (one console): Fleet — a different tarball; not DHCP. Also on the site: Docs.

Just show me the steps — copy-paste at the bottom, without the translations.

Vendor documentation (SSH clients, Ubuntu networking, and WinSCP UIs change). Use these for the latest installer checkboxes; this page is the Lattice-specific path.

1. What lives where

Lattice is not a Windows Server role. It is not DHCP on the domain controller. It is software on Ubuntu, talking to the same relays and AD DNS you already run.

After install, day-to-day is the website on port 443. SSH is for install, upgrade, and “the console will not load.”

2. Translation (Windows → this VM)

Do not paste Linux commands into cmd.exe or a PowerShell window on your PC unless the doc says “from Windows.” Almost every sudo … line in our docs runs after you SSH into the Ubuntu VM.

3. Open a session on the VM (SSH)

Windows 10/11 already include OpenSSH. In Windows Terminal or PowerShell:

ssh [email protected]

First time: type yes to accept the host key. Then the Linux user password (or a key if you set one up).

You can also use PuTTY. Host = the VM IP, port 22, connection type SSH.

If SSH is refused: the Ubuntu installer asked whether to install OpenSSH — that box must be checked. From the hypervisor console (Hyper-V / vSphere / Proxmox), log in locally and fix networking there; you cannot RDP this guest.

YOURUSER is the account you created in the Ubuntu installer. To run privileged commands:

sudo -i
# prompt becomes root. When finished: exit

Or prefix one command: sudo timedatectl. Ubuntu will ask for your password, not a separate “root password.”

4. Copy files from your PC (WinSCP)

This is how the tarball and lattice.entitlement.json get onto the VM.

1. Install WinSCP on your PC.
2. New site: SFTP, host = VM IP, user = the Linux account, password (or key).
3. Left pane = your PC. Right pane = the VM.
4. Drag lattice-*-linux-amd64.tar.gz to /tmp on the VM (or /home/YOURUSER).
5. For a paid entitlement, drag lattice.entitlement.json to /tmp as well. The installer / wizard can paste JSON; a file is less error-prone.

PowerShell equivalent (OpenSSH):

scp .\lattice-*-linux-amd64.tar.gz [email protected]:/tmp/
scp .\lattice.entitlement.json [email protected]:/tmp/

Then on the VM (SSH):

sudo tar -C /opt -xzf /tmp/lattice-*-linux-amd64.tar.gz
cd /opt/lattice-*-linux-amd64
sudo ./scripts/lattice-install

tar is unzip for this kind of archive. -C /opt means “extract into /opt.” You will see a folder named like lattice-0.x.y-linux-amd64.

5. Commands you will actually type

Run these on the VM after SSH. Copy the whole line.

giaddr in the test command must be an address inside a Lattice subnet you created (usually the gateway). That is how dhcpd knows which pool to use. Details: relays.

6. Edit a file with nano

sudo nano /etc/netplan/00-installer-config.yaml

• Arrow keys move. Type to insert.
• Save: Ctrl+O, Enter.
• Quit: Ctrl+X.
• Cancel: Ctrl+C if you are lost, then Ctrl+X and don’t save.

Paste from Windows: right-click in Windows Terminal, or PuTTY’s right-click paste. YAML cares about spaces. Do not use tabs.

7. What chmod 600 means (and why we say it)

A keytab, TSIG secret, or HMAC file is a password on disk. chmod 600 = only the owner can read/write. That is the NTFS equivalent of removing Everyone / Domain Users.

sudo chown lattice:lattice /etc/lattice/lattice.keytab
sudo chmod 600 /etc/lattice/lattice.keytab

You do not need to memorize numeric modes. When a doc says 0600 or 0640, paste the line.

Never email a keytab, paste it into Slack, or attach it to a ticket. ad-ddns.

8. Docker, without becoming a Docker person

The installer puts Lattice in containers (isolated processes). Think “a small set of Windows services,” not Kubernetes.

You should not docker rm things to “fix DHCP.” Use:

• Console Cluster / Overview for health
• lattice-install --mode upgrade for patches (tarball README — also in the archive as README.md)
• troubleshooting for logs

Community: dhcpd is inside Docker. A laptop on the same VLAN sending a broadcast Discover often never reaches it. That is not “DHCP is down.” Point an ip helper-address at the VM, or run lattice-dhcptest on the node. relays.

9. Hyper-V / VMware notes

• Guest OS: Ubuntu Server 22.04 or 24.04, not Ubuntu Desktop, not a Windows Server VM with WSL.
• One virtio/synthetic NIC is enough. Give it a static IPv4 in Ubuntu (netplan), not a DHCP reservation you might lose.
• Enable OpenSSH in the Ubuntu installer.
• Generation 2 Hyper-V is fine; disable Secure Boot if the Ubuntu ISO will not boot, or use the Ubuntu UEFI image.
• HA: three VMs on the same Hyper-V virtual switch / VMware port group. The VIP is a fourth unused IPv4 on that subnet — do not assign it in Ubuntu. ha.

10. You will not “just apt install DHCP”

Ubuntu’s isc-dhcp-server / kea must not be installed on this VM. Lattice is the DHCP server. Two listeners on port 67 fight.

Same for BIND on port 53 if you want lattice-dns. If something else already owns 53, Lattice UI and DHCP still work; embedded DNS will not.

11. Reading path (Windows-first)

1. This page
2. install-prerequisites → lattice-install
3. first-login → first-subnet → relays
4. Keep Microsoft DHCP until proven: migrate
5. Names in AD: integrations / ad-ddns
6. Tickets: helpdesk · troubleshooting
7. Optional — many clusters, one console: fleet-deploy (not the cluster tarball; fleet-ha if you want two Fleet VMs). Same pages at /docs.
8. Later — new cut: upgrade (Fleet first, then rolling cluster; do not skip more than two cluster cuts under this Fleet).

Just the steps

On the Windows PC (PowerShell / Windows Terminal):

ssh [email protected]
scp .\lattice-*-linux-amd64.tar.gz [email protected]:/tmp/
scp .\lattice.entitlement.json [email protected]:/tmp/

(Or copy those files with WinSCP.)

On the VM:

sudo tar -C /opt -xzf /tmp/lattice-*-linux-amd64.tar.gz
cd /opt/lattice-*-linux-amd64
sudo ./scripts/lattice-install
sudo cat /etc/lattice/bootstrap.token
curl -sf http://127.0.0.1:8080/readyz && echo OK
lattice-dhcptest -server 127.0.0.1:67 -giaddr 10.20.20.1

Browser: https://<vm-or-vip> — accept the self-signed warning — paste the lattice_live_… token. More commands: install-prerequisites.