5.1 Windows Admin Center (WAC) Deployment On-Premises and in Azure
Key Takeaways
- Windows Admin Center (WAC) employs a lightweight, browser-based client-side architecture that translates user actions into PowerShell remoting and WMI calls over WinRM without deploying heavyweight agents or requiring internet access for core on-premises management.
- Gateway Mode installs WAC on Windows Server listening on HTTPS port 443 with a production SSL/TLS certificate to serve as a centralized multi-user administrative portal, whereas Desktop Mode installs on Windows 10/11 listening on port 6516 for local single-user management.
- High Availability for WAC gateways is implemented by deploying WAC onto a Windows Server Failover Cluster (active-passive configuration) with a shared cluster storage volume or file share witness and active Kerberos constrained delegation.
- Onboarding WAC to Azure registers a Microsoft Entra ID enterprise application, enabling native hybrid integrations such as Azure Arc, Azure Backup, Azure File Sync, Azure Monitor, and Azure Network Adapter directly from the WAC interface.
- Azure IaaS VMs can be managed natively from the Azure portal using the Windows Admin Center VM extension, which establishes secure outbound communication over port 443 through the Azure management fabric without requiring public inbound ports.
Windows Admin Center (WAC) Deployment On-Premises and in Azure
Modern hybrid infrastructure management requires unified, secure, and scalable tooling capable of administering physical servers, virtualization hypervisors, and cloud virtual machines. Windows Admin Center (WAC) is Microsoft's premier management platform for Windows Server. It consolidates fragmented Microsoft Management Consoles (MMCs), Server Manager, Task Manager, Device Manager, and PowerShell scripts into a single, responsive, browser-based management plane.
Unlike traditional enterprise management suites that require complex database backends and invasive software agents, Windows Admin Center leverages existing remote management protocols—primarily PowerShell Remoting and Windows Management Instrumentation (WMI) over WinRM—to deliver agentless, modular server administration.
1. Windows Admin Center Architecture & Evolution
Windows Admin Center separates the presentation layer from the execution layer through an extensible client-gateway architecture.
+-----------------------------------------------------------------------------------------+
| WINDOWS ADMIN CENTER ARCHITECTURE & DATA FLOW |
| |
| [Web Browser Client] |
| - Chrome, Edge, Firefox |
| - HTML5 / Angular UI |
| | |
| | HTTPS (Port 443 or 6516) - REST API Calls / WebSocket |
| v |
| +-----------------------------------------------------------------------------------+ |
| | WAC GATEWAY SERVICE (Lightweight Node) | |
| | - Gateway Web Server (Kestrel / HTTP.sys) | |
| | - REST API Engine & Authentication Broker (Kerberos, Smart Card, Entra ID) | |
| | - Extension Manager (UI plugins & PowerShell execution pipelines) | |
| +-----------------------------------------------------------------------------------+ |
| | | |
| | WinRM (TCP 5985/5986) | HTTPS / REST API |
| | (PowerShell / WMI / CIM) | (Azure REST Endpoints) |
| v v |
| +-------------------------------------+ +-----------------------------------+ |
| | MANAGED TARGET NODES | | AZURE HYBRID SERVICES | |
| | - Windows Server 2016/2019/2022/2025| | - Azure Arc for Servers | |
| | - Azure Stack HCI Clusters | | - Azure Backup / Azure Monitor | |
| | - Azure IaaS Windows / Linux VMs | | - Microsoft Entra ID Authentication| |
| +-------------------------------------+ +-----------------------------------+ |
+-----------------------------------------------------------------------------------------+
Core Architectural Principles:
- Client-Side Rendering: The user interface runs entirely inside the administrator's modern web browser (Edge, Chrome, Firefox). The browser downloads JavaScript, HTML5, and CSS assets from the WAC gateway and issues asynchronous REST API calls to the gateway backend.
- Stateless Gateway Processing: The WAC gateway processes incoming REST requests and translates them dynamically into native PowerShell cmdlets or WMI/CIM queries directed at managed target nodes. The gateway does not maintain an operational SQL database; it functions as a lightweight protocol translator and authentication proxy.
- Agentless Target Communication: Managed endpoints require no proprietary WAC agents. Communication relies strictly on standard WinRM (TCP 5985 for HTTP or TCP 5986 for HTTPS) and WMI over CIM. Target servers running Windows Server 2016, 2019, 2022, or 2025 have WinRM enabled by default.
- PowerShell Visibility & Script Logging: WAC displays the exact underlying PowerShell scripts executed during GUI actions. Administrators can copy these generated cmdlets directly from the interface for inclusion in automated operational pipelines.
2. Deployment Models: Gateway Mode vs. Desktop Mode
Windows Admin Center can be deployed in two primary installation topologies depending on whether the requirement is local single-user management or enterprise multi-user shared infrastructure.
+-----------------------------------------------------------------------------------------+
| GATEWAY MODE VS DESKTOP MODE ARCHITECTURAL COMPARISON |
| |
| [DESKTOP MODE] (Single-User) [GATEWAY MODE] (Multi-User Shared) |
| +--------------------------+ +----------------------------------+ |
| | Windows 10 / 11 Client | | Windows Server (Dedicated/Shared)| |
| | - Installs on OS Client | | - Installs on Windows Server | |
| | - Port: 6516 (Default) | | - Port: 443 (Default HTTPS) | |
| | - Self-signed local cert | | - Trusted CA SSL/TLS Certificate | |
| | - Single Administrator | | - Multi-User Concurrent Access | |
| | - Access: https://loca...| | - Access: https://wac.contoso.com| |
| +--------------------------+ +----------------------------------+ |
| | | |
| v (WinRM) v (WinRM) |
| [Target Servers] [Target Server Fleet] |
+-----------------------------------------------------------------------------------------+
Detailed Topology Comparison
| Deployment Property | Desktop Mode | Gateway Mode (Server Installation) |
|---|---|---|
| Supported Operating System | Windows 10, Windows 11 | Windows Server 2016, 2019, 2022, 2025, Azure Stack HCI |
| Default Listening Port | TCP 6516 (Configurable) | TCP 443 (HTTPS default; configurable to custom ports) |
| Target Audience | Single administrator managing local/remote PCs | IT enterprise teams, Help Desk, Cloud Operations |
| Certificate Requirement | Auto-generated self-signed certificate | Production CA-signed SSL/TLS certificate (CN matching FQDN) |
| High Availability | Not Supported | Supported via Windows Server Failover Clustering |
| Credential Delegation | Direct Kerberos from local desktop | Kerberos Constrained Delegation (KCD) or explicit prompt |
| Azure Arc Integration | Limited to local management | Full enterprise onboarding and Azure Arc gateway bridge |
[!IMPORTANT] Exam Trap: Port Assignments: When installing Windows Admin Center on Windows 10 or 11 (Desktop Mode), the default listening port is 6516. When installing on Windows Server (Gateway Mode), the installer defaults to 443 (or prompts for an alternative port if port 443 is already bound to another service such as IIS). Do not confuse these two default port assignments on the AZ-800 exam.
Gateway Mode Installation Script via PowerShell
# Automated silent installation of WAC Gateway Mode on Windows Server
$MSIPath = "C:\Install\WindowsAdminCenter.msi"
$Thumbprint = "E5B4C2A1890123456789ABCDEF0123456789ABCD"
Start-Process msiexec.exe -ArgumentList @(
"/i", "`"$MSIPath`"",
"/qn",
"/L*v", "C:\Install\wac_install.log",
"SME_PORT=443",
"SSL_CERTIFICATE_OPTION=installed",
"SME_THUMBPRINT=$Thumbprint",
"GENERATE_SELFSIGNED_CERTIFICATE=0"
) -Wait
3. High Availability for WAC Gateways (Failover Clustering)
In mission-critical enterprise environments, a single WAC gateway represents a single point of failure (SPOF) for centralized management. Windows Admin Center supports high availability (HA) deployment using Windows Server Failover Clustering (WSFC).
+-----------------------------------------------------------------------------------------+
| WAC HIGH AVAILABILITY FAILOVER CLUSTER TOPOLOGY |
| |
| [Client Web Browsers] ---> Virtual Cluster DNS Name / IP: https://wac-cluster.corp.com |
| | |
| v |
| +-----------------------------------------------------------------------------------+ |
| | TWO-NODE WINDOWS SERVER FAILOVER CLUSTER | |
| | | |
| | +-------------------------------+ +-------------------------------+ | |
| | | NODE 1 (Active) | | NODE 2 (Passive Standby) | | |
| | | - WAC Gateway Service Running | <---> | - WAC Gateway Service Stopped | | |
| | | - Bound to Port 443 | | - Ready for Fast Failover | | |
| | +-------------------------------+ +-------------------------------+ | |
| | \ / | |
| | \ / | |
| | v v | |
| | [Cluster Shared Volume / SMB Witness / Shared Configuration Directory] | |
| +-----------------------------------------------------------------------------------+ |
| | |
| v WinRM (TCP 5985/5986) |
| [Managed Production Server Fleet] |
+-----------------------------------------------------------------------------------------+
HA Cluster Implementation Requirements:
- Active-Passive Gateway Model: WAC HA clustering operates in an active-passive configuration. The active cluster node hosts the WAC service and processes inbound HTTPS connections. If the active node fails, the cluster resource group automatically transfers the service, IP address, and network name to the passive standby node.
- Shared State & Extension Repository: Cluster nodes share configuration metadata, connection lists, and installed extensions using a shared storage location (Cluster Shared Volume [CSV] or an enterprise SMB 3.0 file share).
- Cluster Installation Command: The WAC MSI installer is executed on each cluster node using the cluster-aware parameter set:
# Installing WAC on an existing Failover Cluster Node msiexec /i WindowsAdminCenter.msi /qn /L*v C:\wac_cluster.log ` SME_PORT=443 ` SSL_CERTIFICATE_OPTION=installed ` SME_THUMBPRINT='E5B4C2A1890123456789ABCDEF0123456789ABCD' ` CLUSTER_NAME='wac-cluster.corp.contoso.com' - Kerberos Constrained Delegation (KCD): The Active Directory computer accounts of both cluster nodes (and the virtual cluster name) must be configured with Kerberos Constrained Delegation to the
WSMANandHOSTService Principal Names (SPNs) of all managed target servers to allow seamless credential delegation across failovers.
4. WAC Extension Ecosystem & Azure Hybrid Onboarding
Windows Admin Center is built on a modular, pluggable extension model. Extensions deliver domain-specific administrative tools and provide direct hooks into Microsoft Azure hybrid management services.
+-----------------------------------------------------------------------------------------+
| WAC EXTENSION & HYBRID CLOUD INTEGRATION |
| |
| +-----------------------------------------------------------------------------------+ |
| | WINDOWS ADMIN CENTER EXTENSION ECOSYSTEM | |
| | +-------------------+ +-------------------+ +--------------------------------+ | |
| | | CORE OS TOOLS | | CLUSTER & FABRIC | | AZURE HYBRID SERVICES | | |
| | | - Certificates | | - Hyper-V Manager | | - Azure Arc for Servers | | |
| | | - Registry | | - Storage Spaces | | - Azure Backup | | |
| | | - File Shares | | Direct (S2D) | | - Azure File Sync | | |
| | | - Firewall / Event| | - SDN Infrastructure| - Azure Monitor Metrics | | |
| | | Viewer / Updates| | - Storage Migration| - Azure Network Adapter (P2S VPN)| | |
| +-----------------------------------------------------------------------------------+ |
| | |
| (Azure Registration Wizard) |
| v |
| +-----------------------------------------------------------------------------------+ |
| | MICROSOFT ENTRA ID & AZURE SUBSCRIPTION | |
| | - Entra ID Enterprise App: 'WindowsAdminCenter-https://wac.contoso.com' | |
| | - Delegated Permissions: Azure Resource Manager API / Graph API | |
| | - Target Azure Subscription & Resource Group Binding | |
| +-----------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------------+
Key Core and Fabric Extensions:
- Hyper-V Extension: Enables VM lifecycle operations (create, modify, start, stop, checkpoint, live migrate), virtual switch configuration, and nested virtualization.
- Storage Spaces Direct (S2D): Visualizes cluster pools, drives, virtual disks, resilient volumes, IOPS/latency performance telemetry, and health alerts.
- Software-Defined Networking (SDN): Manages Virtual Networks, Network Security Groups (NSGs), Software Load Balancers (SLBs), and gateway connections.
- Storage Migration Service (SMS): Orchestrates multi-server file server inventory, transfer, and cutover from legacy Windows Server 2003/2008/2012 to modern Windows Server or Azure VMs.
Step-by-Step Azure Registration Workflow:
To enable hybrid capabilities, the WAC gateway must be registered with Microsoft Entra ID:
- Navigate to Settings > Azure in the WAC interface.
- Click Register with Azure and select the Azure Cloud environment (Azure Global, Azure US Government, or Azure China).
- Enter the Microsoft Entra Directory (Tenant) ID.
- Sign in with a Global Administrator or Privileged Role Administrator account to grant admin consent. WAC automatically provisions an App Registration (Enterprise Application) in Entra ID named
WindowsAdminCenter-https://<WAC-FQDN>. - Once registered, administrators can link on-premises servers to Azure Arc, configure Azure Backup vaults, deploy Azure File Sync agent endpoints, and establish one-click point-to-site VPNs using Azure Network Adapter directly from server management panes.
5. Managing Azure IaaS Virtual Machines via Azure Portal WAC Extension
Microsoft extends Windows Admin Center directly into the Azure control plane. Administrators can manage Windows Server Azure IaaS Virtual Machines directly within the Azure Portal without establishing VPN tunnels, ExpressRoute circuits, or exposing public inbound RDP/WinRM ports.
Windows Admin Center Connectivity Models for Azure IaaS VMs
| Management Method | Network Path | Inbound Public Ports Required | Security & Protocol Characteristics |
|---|---|---|---|
| Azure Portal WAC Extension | Azure Management Fabric to VM Extension Agent | None (0 Inbound Ports) | Outbound HTTPS (Port 443) from VM to Azure control plane; authenticated via Microsoft Entra RBAC. |
| On-Premises WAC Gateway (Direct) | Hybrid Site-to-Site VPN / ExpressRoute | None (Private IP over VPN) | Internal WinRM (TCP 5985/5986) over private hybrid network links; Kerberos authentication. |
| On-Premises WAC Gateway (Public IP) | Direct Internet via Public IP / NSG | TCP 5985 / 5986 Inbound | Highly Discouraged. Exposes WinRM to internet; requires TLS certs and strict NSG source IP filtering. |
| Azure Bastion + WAC Desktop | Azure Bastion PaaS to Internal Jumpbox | None (Port 443 to Bastion) | Browser-based RDP session to jumpbox hosting WAC Desktop Mode; jumpbox reaches VMs over VNet. |
Mechanics of the Azure Portal WAC VM Extension:
- VM Extension Deployment: In the Azure Portal, selecting Windows Admin Center under the VM's Settings menu installs the
AdminCenterVM extension (Microsoft.Azure.Security.AdminCenteragent). - Outbound Reverse Tunneling: The extension initiates an outbound, encrypted reverse WebSocket tunnel over HTTPS (Port 443) to the Azure management endpoint. Target VMs require no public IP addresses and no inbound NSG rules allowing ports 5985, 5986, or 3389.
- Identity & Access Enforcement: Portal users must possess the Windows Admin Center Administrator Login Azure RBAC role on the target virtual machine resource (or parent resource group) to successfully authenticate into the embedded WAC session.
6. Access Control, Security Hardening & Role-Based Access Control (RBAC)
Securing the Windows Admin Center gateway and delegated server management involves multiple authorization layers.
+-----------------------------------------------------------------------------------------+
| WAC MULTI-LAYER ACCESS CONTROL MODEL |
| |
| [Layer 1: Gateway Authentication] |
| - Local Users vs Local Administrators on Gateway OS |
| - Microsoft Entra ID Authentication (Enables Conditional Access & MFA) |
| - Smart Card / PKI Client Certificate Mapping |
| | |
| v |
| [Layer 2: Target Node Authorization (JEA / PowerShell RBAC)] |
| - Full Administrator vs Readers vs Network/Hyper-V Admins |
| - Gateway configures Just Enough Administration (JEA) endpoints automatically |
| | |
| v |
| [Layer 3: Credential Delegation] |
| - Kerberos Constrained Delegation (KCD) across gateway boundaries |
| - Avoids CredSSP security vulnerabilities for multi-hop management |
+-----------------------------------------------------------------------------------------+
Gateway Access Roles:
- Gateway Users: Can connect to the WAC gateway service and manage target servers for which they have valid administrative credentials, but cannot modify gateway settings, install extensions, or alter gateway security.
- Gateway Administrators: Possess full administrative authority over the WAC gateway instance, including extension installation/upgrades, certificate management, Azure hybrid registration, and user access configuration.
[!TIP] Entra ID Conditional Access Integration: When the WAC gateway is onboarded to Microsoft Entra ID, administrators can enforce Microsoft Entra Conditional Access policies on the WAC Enterprise Application. This enables mandatory Phishing-Resistant Multi-Factor Authentication (FIDO2 / Windows Hello for Business), device compliance checks (Intune-managed devices), and named IP location restrictions for all incoming IT administrative sessions.
An administrator is preparing to deploy Windows Admin Center in Gateway Mode across a dedicated physical server running Windows Server 2025. Which configuration represents the standard default listening port and recommended certificate deployment?
You need to design a highly available Windows Admin Center deployment to ensure that administrative access to on-premises hyper-converged clusters remains uninterrupted if a gateway host fails. What is the Microsoft-recommended architecture?
An infrastructure architect wants to manage Azure IaaS Windows Server virtual machines directly inside the Azure portal using the Windows Admin Center extension. What network security configuration is required on the Azure Network Security Group (NSG) securing the VMs?
An organization requires that access to the Windows Admin Center gateway be secured with phishing-resistant Multi-Factor Authentication (MFA) and restricted only to Intune-compliant corporate laptops. How should the administrator enforce these requirements?