Windows Admin Center update 1910.2 is now generally available!

[Prasidh_Arora]

Windows Admin Center version 1910.2, which was released to Windows Insiders last month, is now generally available. Version 1910.2 is a cumulative update to our 1910 GA release from last November that includes updates to the platform’s accessibility and numerous bug fixes. Users who have installed version 1910.2 through the Windows Insider Program may continue to use the same version.  

Download Windows Admin Center 1910.2 today! 

In addition to bug fixes, we’ve evaluated user feedback and have implemented some highly requested features. Your contributions through user feedback continue to help inform and prioritize future investments to improve your user experience.

Windows Admin Center 1910.2 new features and updates

 

Cut, copy, and paste in the Files tool 

A major new feature we’ve included is the cut, copy and paste feature in the Files tool. When you select a folder or file in the Files tool, users have the option to cut or copy the file or folder. After the file or folder is cut or copied, the paste option will become available, and a user can paste the file or folder into a different path. 

Service restart 

We’ve also enhanced several other features, including the Services tool. When managing machines using the Services tool, there is now an option to restart a service. There is no longer a need to start and stop a service in order to restart it. 

 

 

Other major additions 

• Cluster quick update – On the cluster dashboard, updates for connected nodes will appear under the “Alerts” section
• File upload – when a large file upload fails, you are now able to retry the file upload 
• Virtual machine filters – When viewing a list of VMs with multiple filters applied, the VMs no longer disappear after some time 
• Azure Update Management login – Users no longer receive a logon error when they try to setup Azure update management after setting up Azure monitoring 
• Active Directory account creation – We’ve fixed an error in Active Directory Domain Services where accounts could be created with passwords that didn’t meet the complexity requirements

In addition to the new features and fixes above, we are continuing to improve usability issues and make improvements to keyboard navigation and narrator support. We’ve also addressed reported bugs around CredSSP authentication.

Partner extensions

You’ll be excited to hear that the Windows Admin Center ecosystem continues to expand with the GA release of new partner extensions and improvements on existing extensions!

 

Azure Security Center (ASC) is now generally available 

The Azure Security Center extension is no longer in preview and is now generally available! This extension brings hybrid cloud security capabilities to the Windows Admin Center managed servers and allows them to be protected by ASC through a one-click setup. Users of this extension will also see security recommendations and alerts in an embedded view in Windows Admin Center.  

This integration is part of a larger Windows Admin Center evolution to offer hybrid Azure services capabilities to on-premises environments. This extends on-premises environments into Azure, allowing them to benefit from cutting edge cloud technologies - an important step as part of a lift and shift motion. 

 

 

HP Enterprises WAC extension is now generally available 

The HPE WAC extension combines the functionality of the HPE Server extension and the HPE Azure Stack HCI extension into a single extension for easier management. This extension utilizes HPE’s iLO technology to give users direct visibility into server inventory and diagnostics to manage and monitor HPE server infrastructure. Using this extension, users can: 

• See the health of their servers and remediation options 
• View the properties of server components (processor, memory, etc.) and BIOS settings 
• Identify and highlight cluster health and node inconsistencies 

 

QCT Management Suite update 

The QCT Management Suite is designed to help users manage and monitor their Windows Server hyper-converged infrastructure and QCT system configuration information on a single dashboard. With the upgrade to version 2.0.0, fixes and additions include: 

• Bug and typo fixes throughout the tool 
• Support for HCI mode on the Overview, Disk, Firmware, and Settings tab 
• Additional tooltips 
• Addition of dialog panels and drop-down lists in HCI mode 
• BMC account settings for Redfish support 
• An updated project site URL 

 

Thomas-Krenn.AG extension update 

Thomas-Krenn.AG’s extension provides detailed information on cluster nodes and drives, cluster information and cluster network connectivity. With the upgrade to version 1.2.0, users can expect a handful of bug fixes as well as improvements targeted at version 1910.2.

 

Download today!

We hope you enjoy this update of Windows Admin Center and all the new content! Learn more about using Windows Admin Center and download it today. 

Windows Admin Center is constantly improving thanks to feedback from the community. All existing customers will receive this update for free (a notification to update will appear in the product). We hope you enjoy this update, and we're already hard at work on the next one!

<3,

The Windows Admin Center team at Microsoft 

[Marc Laflamme]

Any chance an auto-update function will be implemented in the application? After some headaches with getting this installed on a core server and getting certificates running, I'm hesitant to run the installer again if I don't have to!

[Prasidh_Arora]

@Marc Laflamme Unfortunately, auto-update will not be available for this release. If you have Microsoft Update set up, this release will be coming down through that pipeline in the next couple weeks.

[Marc Laflamme]

@Prasidh_Arora Thanks for the reply. I had no idea that this application would come down MS Update, that's pretty neat.

A question about updating the application via installer. Will it detect that it's already installed and just update necessary files or do I need to re-configure the application again?

[Prasidh_Arora]

@Marc Laflamme It should detect that it is already installed and keep your configurations the same.

[jdrch]

Still waiting for proper Windows 10 Pro support (as claimed in the documentation) to arrive ...

[Damon Villar]

I just ran the update hoping that it would fix some of the issues that I have such as connecting to remote machines.  The machines that I am trying to connect to are Server 2012r2 or server 2016 and live on the same subnet; however when I try to connect and enter my credentials they do not work. I can rdp to the remote server and log in with my credentials without issue but if I try and connect using WAC it will not work. BTW my user is a member of the local admin group on the remote servers. There are no firewalls between my admin w10 workstation and these remote servers. I have tried enabling remoting 'winrm quickconfig', but nothing I do seems to help and I can find nothing on the internet about this issue.

Anyone else have these issues?

[jdrch]

@Damon VillarAre both the admin and target machines in question on a domain? If not, then this is a known issue (the same one I mentioned in my comment.)

I gotta say, I can't help but notice how Microsoft seems intent on crowing about WAC when the documented functionality doesn't work for 1 of the 2 possible machine domain states despite claiming quite clearly to support both. At least release some kind of official statement (not a blog comment) acknowledging the problems.

[jdrch]

@Marc LaflammeI think it depends on which release you installed most recently. If your last installation or update was a GA release, updates come via Microsoft Update. If either was Preview release, the updates are manual.

I'm on Preview and keep track of releases by subscribing to the blog and setting a search feed for "Windows Admin Center" in Inoreader. For all WAC's shortcomings Microsoft does seem to be blogging about it a fair bit, so you shouldn't miss anything either way.

[Marc Laflamme]

@jdrch I ran the installer manually and it updated no problem (good thing because I did not want to futz around with that certificate again!

@Damon Villar Are you granting the server hosting WAC the allowed to delegate to account rights for the double-hop scenario?

For WAC's configured as a gateway you want to manage using SSO you need to allow kerberos delegation which configured the gateway computer as trusted to delegate to the target. I have a simple PS script if you're interested.

[Damon Villar]

@Marc Laflamme  I am interested in your PS script - thank you. Also if you have information on the double-hop scenario I am interested in that as well.

@jdrch Both the admin workstation and the target machines are in the same domain.

[Marc Laflamme]

@Damon Villar 

The super nitty gritty double-hop article is here:

https://docs.microsoft.com/en-us/archive/blogs/askds/understanding-kerberos-double-hop

The general MS doc that talks about using it in WAC is here:

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/user-access-co...

The scrip they have listed there works perfect for a single server. To apply this to all servers I use this one. If you want to only specify a few servers to apply this to you can specify them by uncommenting out the second $servers line and commenting out the one that gets all windows servers

Since we have some DC's that aren't 2012, I've added a variable to specify a 2012DC. If you don't need that you can eliminate $domainController line as well as the switch -server $domainController in the Set-ADComputer line.

$wac = "wacservername" # Server that's running WAC
$servers = Get-ADComputer -Filter {OperatingSystem -Like "Windows Server*"}
# $servers = "server1", "server2", "server3"
$domainController = "2012dcname" # force using 2012 DC.
$wacObject = Get-ADComputer -Identity $wac

foreach ($server in $servers)
{
$serverObject = Get-ADComputer -Identity $server
Set-ADComputer -Identity $serverObject -PrincipalsAllowedToDelegateToAccount $wacObject -Server $domainController
}

One thing to note, you need to do this BEFORE attempting to connect to the server using SSO or else you'll run into a KDC Cache issue. When the attempt to use SSO is made, a kerberos ticket is granted. This ticket will not have the allow to delegate permission and be invalid. The only options here are to either wait 15 minutes so it times out and another one is granted or else you need to manually purge the KDC Cache with this command.

DISCLAIMER: I've never had to use this command before because I usually add delegation before attempting to connect so I'm not sure if it works or not. You may need to tweak it.

Invoke-Command -ComputerName servername -ScriptBlock {
    klist purge -li 0x3e7
}

Finally, this delegation step needs to be performed for every new server added to WAC/domain. There may be some automation that can be performed somehow or hopefully this gets added into WAC in the future.

[Damon Villar]

@Marc Laflamme 

Sweet! - thanks very much for the information.

[Philip416]

@Prasidh_Arora 

Thank you for developing this amazing tool.

I do have an issue with an upgrade to 1910.2 from 1910 this morning in our Server 2019 domain attached WAC gateway. The SSL thumbprint and everything else is the same. I don't have SSO configured, but now when I log in to WAC, it no longer prompts me for creds to each individual server I'm trying to manage. Usually, I had to put in my creds when connecting to any machine, but now they seem to be cached. When a connection attempts, it comes back with the generic:

"WinRM cannot complete the operation. Verify that the specified computer name is valid..." 

When I try and do a Manage As to force a new cred, it comes back with:

"Error occurred while decoding OAEP padding."

When I try to connect to the WAC gateway via WAC, I get:

"The server certificate on the destination computer (serverFQDN:5986) has the following errors: The SSL certificate could not be checked for revocation. The server used to check for revocation might be unreachable."

I did try to clear the KDC cache via:

Invoke-Command -ComputerName servername -ScriptBlock {
klist purge -li 0x3e7
}

But that didn't help. I also can't seem to find an installer for the previous version, as at this point, I'd love to just reverse the upgrade so that everyone can get back to work.

Any help or tips at all would be infinitely appreciated.

Thank you,

Philip

[Prasidh_Arora]

@Philip416 Could you take the following steps to help rule out some problems?

1. Clear Browser cache

2. Close browser

3. Restart the Windows Admin Center service on the server

4. share a screenshot of what you see in certificates under Local Machines\My

The last option which should work is uninstalling and re-installing Admin Center. Note: Doing this will remove your entire server list and you will have to re-add every one. Reverting back to 1910 would do the same thing.

I hope this helps!

[Philip416]

@Prasidh_Arora I figured it out. I had accidentally checked the use WinRM over HTTPS box during install. Duh! All is good now. Thanks!

[tjgcolo]

Hello, I'm excited to start using this tool to manage (and delegate management) of our windows 2019 AD servers.  I have it set up on a lab where there are 4 systems, a 2019 gateway server, and 3 2019 servers running active directory. 2DC's are core and 1DC is desktop experience, the gateway is desktop experience and that is where I'm running my browser to connect from.  I'm seeing the same problem with connecting to any of the servers.   From the start I have received the same error message when trying to connect to one of the systems i've added to manage.  Note that remote powershell is working between the nodes, they are all able to be managed through a server manager group in the server manager console, and I've run winrm quickconfig on all nodes.   The install msi I used to install WAC on the gateway host is WindowsAdminCenter1910.2.  The error message being thrown no matter what I do when attempting to connect with WAC is:

Connection error
Connecting to remote server w2k19-1.example.com failed with the following error
 message : WinRM cannot complete the operation. Verify that the specified
 computer name is valid, that the computer is accessible over the network, and
 that a firewall exception for the WinRM service is enabled and allows access
 from this computer. By default, the WinRM firewall exception for public profiles
 limits access to remote computers within the same local subnet. For more
 information, see the about_Remote_Troubleshooting Help topic.

For the last 10 days I've been working on getting the actual connection to a host to work, I have read a large number of blogs and postings trying to get things to work, including stepping through the about_Remote_Troubleshooting and enabling the group policies indicated for the service, access, firewall, etc.  As I have progressed through the troubleshooting I've also applied the indicated kerberos constrained delegation discussed in the user access sect of the documentation of the following in powershell:  Set-ADComputer -Identity (Get-ADComputer w2k19-1) -PrincipalsAllowedToDelegateToAccount (
Get-ADComputer w2k19-gw)

I've repeated that for each node (-2 and -3).  

The Gateway node is in the same subnet as the hosts I'm trying to manage.  The one esoteric thing is these are on a /27 subnet, but I cant imagine that would be a problem as all networking is functining and all the domain controllers are replicating properly between each other, and powershell remote is working between all nodes.  I'm using chrome on the windows 2019 gateway because MS Edge does not work on 2019 based on the documentation.   

All the nodes are joined to the domain.  They all have proper CA issued certificates installed and working, the Gateway is running WAC on HTTPS using the installed CA issued cert.  Everything has been rebooted.   I have no idea where to go next to isolate why things are failing... thanks in advance for any pointers. 

[jdrch]

@tjgcolo  That's approximately the same problem I have. Interesting that you're experiencing it on AD machines. Let me know if you find a fix; the issues has been known since January and to my knowledge absolutely NOTHING has been done about it.

[Jim Holloway]

I would like to see windows update to be implemented so I can easily do check windows updates for both my hyperv servers as well as my VM and standalone workstations.

[AL-The-Admin]

Uninstalled 1910.2 and reinstalled 1910.  Our one 2008 server was getting an error that WMF needed to be at 5.0 or greater.  Checked and double checked.  Not a problem in 1910.

Anyone else have this issue? 

[Martin_Hubka]

... and still is not corrected credentials, why I still must entering it??? It terrible!!!!

[Lukas35]

Where I can download 1910? On 1910.2 our server is not connecting

[James_Edwards]

I also would like to be able to download 1910.  I have 1910.2, but it does not work with our Oracle VM (not Virtual Box) virtual machines.  Physical servers seem to be fine.  When I try to connect to the VMs, I get a log of messages like "RemoteException: The property 'Product' cannot be found on this object. Verify that the property exists." and a lot of functionality doesn't work.  I've seen claims that 1910 is not affected by these types of issues, and I'd like to try it.

Edit: I found the download link on the Known Issues page: https://aka.ms/wacprevious.  This currently goes to 1910.  I'll update once I determine if it resolves my issue.

Update: After installing 1910, I am able to manage my Oracle VM virtual machines with it with no issues so far.  Something in 1910.2 broke this.  Hopefully it will be fixed in the next update.

[A_x_S]

@Prasidh_Arora The update still isn't provided through MS-Update. Neither using WSUS with the product (Windows Admin Center) check nor via direct update from Microsoft. Is there any chance your assumption will become real?

[powellbc]

@Prasidh_Arora I am planning on upgrading to this new release, but first want to export my connections in case of issues. I am attempting this as a logged in Gateway Admin, and even by using the -Credential flag. In all cases I get a 401 unauthorized error. Am I missing something obvious? I am following the document here: https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/use-powershell...

[Prasidh_Arora]

@A_x_S Due to the bugs that were reported by users above, we decided not to push this update through MS Update. Our next release with these bug fixes will be released and pushed through MS Update Instead.

@powellbc Are you running the command remotely or on the machine on which WAC is installed?

[powellbc]

@Prasidh_Arora On the machine with WAC installed.

[nileshmatere]

@tjgcolo I am facing exactly the same Issue, I had configured trustedhosts to make it work.

@Prasidh_Arora 

Is it mandatory to configure trusted hosts? I am using domain credentials, still I had to configure Trustedhosts to make it work. I have all my machines joined to AD Domain.
Under common troubleshooting steps it is mentioned that "This is required in a workgroup environment, or when using local administrator credentials in a domain"

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/support/troubleshooting#...

[dfeifer]

AL-The-Admin

 I am getting the exact same issue. Did they remove support for 2008r2 in this release? I can connect to my 2016/2019 servers fine but the 2008r2 servers that worked before have issues. WAC connects and the tools menu on the right propagates but I get the following errors and the and a spinning loading icon in the center.

and 5.1 IS installed..

Have to wonder if maybe there is an issue with the wmf 5.1 install package maybe missing modules?

[LincolnStLuce]

Team I have had Admin Center installed on server core for a bit now and one thing that's been  a constant issue is the service not starting up on system reboot. Is anyone else experiencing this?

[powellbc]

@praror Update on my export issue: I tried using the FQDN instead of the CNAME in use for our Windows Admin Center install and that allowed the connections export to complete without issue. So, problem solved.

[Prasidh_Arora]

Hello all, check out Windows Admin Center version 2007 and let me know if some of your issues persist! aka.ms/wac2007

[IshtarIS]

@Damon Villar et al

One early problem I found was that my server farms network connections were set up as Public.   Changing them from Public to Private networks resolves many an issue.