Windows Admin Center topics

WAC vMode fails validating SMB

OJsvk — Tue, 16 Jun 2026 09:23:59 GMT

Reviewing vMode and try add a Hyper-V 2025 (non hyperconverged) cluster with a FC SAN. Fails on Validating "SMB port accessibility". Have gone through firewall settings and opened all neccesary ports that i can find mentioned. Even tried without FW turned off without any success so hit the wall now. WAC vMode is installed on a vm running Win2025std and in same domain as the cluster (and hosts) i try to add. Probably some obvious thing i have missed so any suggestions?

Certificate Error Connecting to only to some of the Cluster's resources

Asea2022 — Mon, 15 Jun 2026 21:32:05 GMT

Latest version of WAC, winrm configured to connect over HTTPS. No issues connecting to the servers that are members of the cluster, or clients and other servers in our AD. No issues connecting to the cluster Dashboard (I can see health, CPU usage, etc.) and some of the resources (such as Drives, Volumes, Servers). Configuration -> Settings or Security works fine.

It's only when I go to some resources, such as virtual switches, GPU's or a handful of others that I get errors connecting to member servers; Specifically, the error will state that for each server:

Connecting to remote server servername.local failed with the following error message : The server certificate on the destination computer (servername.local:5986) has the following errors: The SSL certificate contains a common name (CN) that does not match the hostname.

The one oddity I see is that .local is being added to the end of the server name. Also, servername will not contain the domain extension, just the name. Here's what I've checked so far:

DNS is correct for the member servers and the cluster, both with Host (A) and PTR entries, can be pinged and resolved.
As far as I can tell the certificates are setup correctly, no issues connecting to the member servers individually, or the cluster at first.
The AD entry for the cluster is in place with the correct permissions for the cluster's service account

I've read that .local is appended if the server/cluster is not part of AD, but that's not the case. We have two additional clusters and this issue does not appear on them. I also have not been able to identify any obvious differences between the setup of the two fully functioning clusters and this one.

In the Event Viewer on the WAC server, under Applications and Service Logs _> WindowsAdminCenter, I can see Error Entries ID 304 for each member server with a similar message as above:

Unable to create PowerShell session on node, status: 400, error code:PSRemotingTransportException, error message:Connecting to remote server server.local failed with the following error message : The server certificate on the destination computer (server.local:5986) has the following errors:
The SSL certificate contains a common name (CN) that does not match the hostname. For more information, see the about_Remote_Troubleshooting Help topic..

As a side note, opening a remote Powershell session to each member server via WAC works fine and by contrast, in the WAC Event viewer there will be corresponding Information entries list the server's FQDN. Here's an example

Category: Microsoft.AspNetCore.Hosting.Diagnostics
EventId: 2
SpanId: 50d2635d1f6eb737
TraceId: b8c8e1de80ac2f84f1230c5ec3305b38
ParentId: 3e0619ce2c5decca
ConnectionId: 0HNMB39BE0AS7
RequestId: 0HNMB39BE0AS7:0000009F
RequestPath: /api/PowerShell/nodes/serverFQDN/invokeCommand

Request finished HTTP/2 POST https://WACserverFQDN:6601/api/PowerShell/nodes/serverFQDN/invokeCommand - 200 - application/json;+charset=utf-8 230.3283ms

It seems that when it comes to accessing only some of the cluster's resources WAC no longer has the member servers FQDNs, and I'm not sure where to look for changing that. Anyway, any guidance would be appreciated.

Entra Connect

Bridgman1 — Thu, 14 May 2026 14:26:07 GMT

Is user writeback available?

What about group writeback?

Devices Writeback?

How to use / enable them?

Do we know when this write-back will be GA? I have a cx who wants extensive write-back capabilities for all fields.

Windows Admin Center - Couldn't configure PowerShell authentication error

shipwreck78 — Fri, 10 Apr 2026 17:27:41 GMT

We have a lab setup to test migrating VMWare VMs to Hyper-V. Everything was working fine, however today whenever we try and access the settings of a VM we get an error. We're going through Cluster Resources -> Virtual Machines -> VMName -> Settings. The error is:

Notification details

Error

Couldn't configure PowerShell authentication

1:25:15 PM

SourceGo to Virtual machines.

Type

Error

Message

Unable to configure either CredSSP or local PowerShell options. Error: RemoteException: You cannot call a method on a null-valued expression.

Now, the two Hyper-V hosts had been disconnected from the network for quite a while during some network upgrades and were only reconnected to the network this morning, having been disconnected for 56 days. domain health is fine. we're using an admin account. not really sure what the issue is.

Thanks

package ssu and online windows update service

zoomzoom — Mon, 06 Apr 2026 00:33:35 GMT

Hi,

i've a new installation, i update online Windows server 2022. the windows update service install the last cumulative package.

I don't see previous ssu update installed package are mandatory because it's online update ?

No way to import shared connections WAC 2.6.4

SamBasch — Tue, 31 Mar 2026 22:06:22 GMT

hello, reaching out to to see if I am missing anything with the import-wacconnections change in the powershell module.

Previous versions i had everything scripted and running smoothly where I could scrape AD for servers and tags and then import as shared connections for other engineers to use.

Now, despite being a gateway admin, if I try and import a CSV via the windows admin center gui, I get an error that only personal connections can be imported.

if I use powershell, despite providing the generated access token, I get a 403 error.

my issued PKI certificate is good, I am a gateway and server admin, I even corrected the errors in the powershell module regarding $credential vs $credentials that copilot spotted

Any advice or pointers to push forward?

New implementations in AD DS

santhosh_1983 — Mon, 23 Mar 2026 08:55:34 GMT

Can anyone tell me about the latest AD DS implementations?

Need a detailed SOP. Please!

How to add a new domain controller to an existing Active Directory domain?

peanut123 — Mon, 16 Mar 2026 14:57:48 GMT

The specific situation is as follows:

The company has one forest and domain, and two Active Directory (AD) servers. These two servers communicate and synchronize data.
One server is deployed in the local data center, and the other is deployed on Azure Cloud.
The forest and domain functional levels are both Windows Server 2008 R2. Both servers are running Windows Server 2016 Standard.
Because there are computers running Windows XP and Windows 7 in the domain, upgrading the forest and domain functional levels is not possible. Windows Server 2008 R2 must be retained.
The company now needs to add a new AD server on Huawei Cloud and join it to the company's forest and domain.

The main questions are:

How do I determine which operating system the new server should run? Excluding Windows Server 2016.

How should I choose between Windows Server 2019, 2022, and 2025?

How do I determine how to allocate CPU, memory, disk, and network resources during system deployment?
How to determine which operating system is best suited for running a domain controller without conflicts or incompatibility?
What preparations should be made before deploying a new server?

Groups and roles issues

PAM77 — Fri, 06 Mar 2026 11:04:51 GMT

Hello,

We use two user accounts, one that is a server administrator and that we use to connect to the servers via RDP (ADMaccounts).

The other is not an administrator and we use it on our workstations (USRaccounts).

I deleted from Gateway Users the Builtin\users group because I don't want users to access even though they can't do anything. For now I added another group as Gateway Users with our USR accounts. ADM accounts are member of Gateway Administrators.

When Im logged into WAC with the ADM user and access to WAC, the browser asks me for credentials, I enter the ADM credentials, and I log in.

When I am at my workstation, I access the URL and log in without being asked for credentials with the USR account session.

I do not understand this behavior. I need to access from my workstation with the ADM account.

How can I make the browser ask me for credentials?

Do I have to open the browser with the admin credentials every time I want to manage WAC?

Thanks,

Best regards

WAC can connect to itself or to other servers.

PAM77 — Thu, 26 Feb 2026 11:01:17 GMT

Hello,

I have installed WAC with an internal certificate of my company. I can login to the web, the certificate appears correct in the browser.

When I try to connect to the gateway itself or to other servers.

No connection could be made because the target machine actively refused it:

servergw.domain.com:6601

On event viewer: Event Winrest:

Hosting failed to start

Exception:

System.InvalidOperationException: The requested certificate E=email address removed for privacy reasons could not be found in LocalMachine/My with AllowInvalid setting: False.

The certificate is correct like other from company that used in other services, It has private key, and server authentication:

E = email address removed for privacy reasons

CN = email address removed for privacy reasons

OU = company

O = company bla bla

L = City

S = City

C = Country

I tried to create with other SAN:

DNS=servergw.domain.com

DNS=servergw

DNS=localhost

I have also tried to give permissions to the private key to Network Service, change the service to run with Local System.

WinRM and trusted hosts are correctly.

It only works when I install it with the self-signed certificate that WAC creates and it will say 60 days.

What else can I try?

Thanks !!

WAC 2511 Setup file (.EXE) SHA256 / MD5 Hash

JesseMos — Thu, 19 Feb 2026 08:01:49 GMT

I use out of band enviroument.
For obvious IS reason i require the Hash of wac setup file (SHA256/MD5).

Also couldn't find an MSI package.

Any ideas?

Best,

Jesse

Modernized Gateway Extension Support via WAC SDK

robco — Thu, 05 Feb 2026 19:05:18 GMT

Hello, I would like to build a gateway plugin for the latest WAC v2511 but according to this documentation, the latest SDK package does not support the latest modernized gateway extensions. Is there a way to workaround this without downgrading WAC version?

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/extend/develop-gateway-plugin

“The Windows Admin Center SDK and developer tools have not yet been updated to support development of gateway plug-ins compatible with the Windows Admin Center modernized gateway. Following this guide will not result in a .NET 8 extension compatible with the modernized gateway.

Windows Admin Center - Vmware migration to HyperV

bobtimmons1 — Fri, 09 Jan 2026 18:41:01 GMT

We have a vCenter (multiple hosts) with about 30 VMs and need to migrate them to a single HyperV host. I installed the Windows Admin Center and the other components (https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/use/migrate-vmware-to-hyper-v). I migrated 2 servers, one at a time, and both seemed to work, though I had to set the IP manually. I then chose 2 servers to migrate both at the same time and it seems to be hung. The sync process completed successfully. The migration process for both got to 25% and has been stuck there for a day now. The disks aren't that big and, presumably most of that was created/copied during the sync process.

I also don't see an option to stop the process or restart it. I know the VM Conversion is a Preview function, so I'm sure support it limited. Any help or direction would be appreciated.

Unable to use a certificate from my Windows CA

JCSR — Fri, 12 Dec 2025 11:38:25 GMT

I am trying to use my own certificate signed by my CA, instead of the self-signed SSL certificate it offers by default.

In fact, with the self-signed SSL certificate, WAC runs on HTTPS:

However, when I switch to the certificate I have generated in my CA:

When I try to access the link, it returns me:

So if I switch back to self-signed SSL certificate:

The WAC console is working properly again:

What I doing wrong when I generate that certificate?

Unable installing extensions from a different feed

JCSR — Fri, 05 Dec 2025 09:47:20 GMT

I added a new feed from a path, and WAC is telling me it can't read the feed or update the corresponding catalog.

I followed the instructions in this link: "https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/using-extensions#installing-extensions-from-a-different-feed".

In fact, since my network isn't connected to the internet, I also followed the instructions in this other link: "https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/using-extensions#installing-extensions-on-a-computer-without-internet-connectivity".

Regarding adding a file share as a source, it must meet the criteria outlined in this link: "https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/using-extensions#installing-extensions-from-a-different-feed".

However, I'm getting these error messages and therefore don't have any extensions available to add:

Admin Center choosing the wrong certificate

chapbak — Tue, 02 Dec 2025 00:53:25 GMT

Windows Admin Center version 2410, build 2.4.2.1.

We're encountering an issue following the instructions outlined here when replacing the WAC certificate. We've installed a certificate from a third-party CA in the local machine store. The common name matches the DNS FQDN and hostname of the server. Despite specifying the thumbprint of the 3rd party CA cert with the "Set-WACCertificateSubjectName" cmdlet, WAC binds to a different certificate issued by our internal CA for WinRM. The WinRM cert shares the same common name, but it has a later expiration date. I suspect WAC is picking the certificate with the latest expiration date. This also happens when using the GUI, even when we specify the 3rd party cert during customization. We've confirmed that the NETWORK SERVICE account has rights to the private key on the cert as well.

I tried deleting the binding using netsh and rebinding to the updated thumbprint. While this is successful, and the output from "netsh http show sslcert" shows the 3rd party CA cert on the port 443 binding, the browser still presents the Internal-CA cert on 443 even after restarting the WinRM and Windows Admin Center services (and rebooting). It seems like there is an issue when multiple valid certificates exist with the same common name in the machine store. Additionally, the "Set-WACCertificateAcl" seems to fail in this case. The Configuration log contains the error below whenever it is run.

Set-WACCertificateAcl: Unable to find machine key path for certificate. Skipping setting access control list.

We'd prefer to use the 3rd party cert for the HTTPS port and the internal CA cert for WinRM. Is this possible?

VM Load balance is not working

rajneeshsaraswatNTT — Wed, 19 Nov 2025 17:32:17 GMT

Hi All,

I have 4 node cluster in which VMs are manually distributed and now when i enabled the load balance feature via Windows Admin Center it not load balancing the VMs i double checked the load feature via PowerShell and it shows true. kindly suggest form where i should start the troubleshooting.

Windows Admin Center 2410 not updating Server 2025

Hucklebarry — Tue, 18 Nov 2025 05:17:27 GMT

Hi, I have 3 new 2025 servers all updated and on the domain. Windows Admin center is working fine with all other servers (2012, 2016, 2019, and 2022). For these 3 new servers, I can connect and login through Adm Center and when I choose the "updates" tab the circle in the middle of the screen spins indefinitely.

It never even shows if updates are available or not, it just spins. If I log onto the servers locally, I can see and install updates manually. But when I go back and connect through ADM Center, I just get the spinning circle. I currently only have 3 2025 servers, so for me it appears to be an issue with how they talk to ADM Center concerning updates. (and this makes me hesitate to update other servers)

I've tried RDP, registry, Powershell, etc (all through ADM Center). It ALL works, but updates never do. Additionally the 2025 servers are able to communicate just fine to report update status to our WSUS server.

If I click the "update history" tab on the updates page in Admin Center, I then see an error, but not sure what would be denying anything, when the connection already seems to be made: "Message

We couldn't check update history. Error: (1) RemoteException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) (2) RemoteException: The property 'ServerSelection' cannot be found on this object. Verify that the property exists and can be set. (3) RemoteException: You cannot call a method on a null-valued expression. (4) RemoteException: You cannot call a method on a null-valued expression."

I tried to temporarily disable the firewall with no change in behavior. The account I'm using is a domain admin account and also added to the local admin group for testing.

WAC Extension VM Conversion: Pre-checks failed: PowerCLI is not installed

ofekih — Fri, 12 Sep 2025 18:39:56 GMT

Hi,

i have Windows Administration Center Version 2410 Build 2.4.2.1, i try to migrate VMware VMs to Hyper-V using WAC Extension VM Conversion and when i start sync i get this error:
Pre-checks failed: PowerCLI is not installed. Please install PowerCLI and try again.. Check the logs for details. (1%)
but PowerCLI is already installed with offline installation procedure because no internet connexion available in my environment, i can import vmware.powercli module in powershel but same error in WAC

Than you for your help

cannot use RDP in Windows Admin Center - just getting a spinning circle

Michael54 — Wed, 10 Sep 2025 17:05:50 GMT

Hello,

i installed the Windows Admin Center and whenever i try to connect to a server or VM using the RDP it never connects and all i see is a spinning circle. any fix for this issue?