Windows Admin Center

What Is Windows Admin Center?

Windows Admin Center is a locally deployed, browser-based tool set for managing Windows Server and Windows client machines — physical, virtual, on-premises, or in Azure — without sending anything to the cloud. It is the modern evolution of tools administrators have used for two decades: Server Manager, MMC, and the collection of snap-ins that came with them.

Think of Windows Admin Center as a single reception desk for a building full of servers. Instead of walking to each room with its own separate key — an RDP session here, an MMC console there, a PowerShell window for something else — you check in once at the desk, and it hands you whichever tool the room you are heading into actually needs.

It has two main parts: the gateway, a lightweight service that does the actual connecting to target machines, and a set of extensions — modular tools like Certificates, Firewall, Local Users and Groups, Processes, Registry, Roles and Features, and Storage — that run inside it. Microsoft ships the core extensions, and both Microsoft and third parties can publish more through the extensibility SDK.

How the Gateway Works

The gateway manages Windows Server 2016 and later, and Windows 10/11, by using Remote PowerShell and WMI, both carried over WinRM. No agent gets installed on the target machine — WinRM and PowerShell remoting already ship in the box. The gateway itself is a single .msi package, and the current (“modernized”) gateway runs on a .NET 8 backend with an ASP.NET Core Kestrel web server, replacing the older Katana-based backend. That switch also brought HTTP/2 support, which reduces latency through multiplexing and server push.

Internally, the modernized gateway uses a multi-process, microservice-based architecture. A single process manager starts when the gateway launches, and it spins up additional subprocesses on demand as you use different tools — a change from the earlier single-process model, intended to make the gateway more resilient (one misbehaving extension subprocess is less likely to take the whole gateway down).

Why Active Directory Cares About the Gateway

Windows Admin Center is not itself an identity system, but its gateway sits directly on top of your identity model. When the gateway is domain-joined, it authenticates users against Active Directory or local machine groups by default, and gateway administrators can instead point it at Microsoft Entra ID to get conditional access and multi-factor authentication for free. In a workgroup — no domain at all — you fall back to local accounts on both the gateway and every target machine, and WinRM’s default restrictions become something you have to actively work around.

Access to the gateway itself is a separate question from access to a given target server. A user can reach the gateway but still needs credentials with administrative rights on whichever machine they try to manage — the gateway does not grant permissions on its own, it only provides the console.

Installing Windows Admin Center

Before installing, you need admin rights on the target machine and, optionally, a TLS certificate with the Server Authentication EKU (1.3.6.1.5.5.7.3.1). If you skip bringing your own, the installer generates a self-signed certificate valid for 60 days — fine for a lab, not for production.

On the desktop experience, the installer walks you through Express setup (network access and port chosen automatically) or Custom setup (you choose the port, the TLS certificate, the endpoint FQDN, and whether WinRM runs over HTTPS). On Server Core, or when you’d rather script it, use PowerShell instead:

# Download the installer to the local machine
$parameters = @{
    Source      = "https://aka.ms/WACdownload"
    Destination = ".\WindowsAdminCenter.exe"
}
Start-BitsTransfer @parameters

# Install silently, specifying the HTTPS port and certificate thumbprint
.\WindowsAdminCenter.exe /VERYSILENT /HTTPSPortNumber=443 /CertificateThumbprint="1234abcd4567efgh"

# Start the gateway service if it did not start automatically
Start-Service -Name WindowsAdminCenter

A local-client install listens on https://localhost:6516 by default. A gateway-server install typically binds to port 443, which is also why an old, stuck certificate binding on that port is the most common reason a reinstall silently fails to bind — see the troubleshooting table below.

Managing Access — Role-Based Access Control

By default, a user needs full local administrator rights on a target machine to manage it through Windows Admin Center — the same as logging on locally. Role-based access control exists for the case where someone needs to do part of that job without getting full admin rights on the box.

RBAC works by configuring each target server with a PowerShell Just Enough Administration (JEA) endpoint. When a limited-access user connects, Windows Admin Center creates a temporary local administrator account behind the scenes to carry out the actions their role permits, then removes it automatically once they disconnect.

RBAC currently only covers the Server Manager and Failover Cluster solutions, and limited-access users lose file upload/download in the Files tool, and lose the PowerShell, Remote Desktop, and Storage Replica tools entirely regardless of role.

Automating Windows Admin Center with PowerShell

For anything beyond a handful of gateways, the bundled PowerShell modules are worth knowing. ExtensionTools manages feeds and extensions across a gateway from the command line:

# Load the extension management module
Import-Module "$env:ProgramFiles\windows admin center\PowerShell\Modules\ExtensionTools"

# List every extension currently installed on a gateway
Get-Extension "https://wac.contoso.com"

# Install a specific extension from the default feed
Install-Extension -GatewayEndpoint "https://wac.contoso.com" "msft.sme.containers"

# Add a private extension feed (a network share, for internally built extensions)
Add-Feed -GatewayEndpoint "https://wac.contoso.com" -Feed "\\wac-share\our-private-extensions"

ConnectionTools handles bulk import/export of the server and cluster connection list, useful when standing up a new gateway or migrating away from an old tool like Remote Desktop Connection Manager:

# Load the connection management module
Import-Module "$env:ProgramFiles\WindowsAdminCenter\PowerShellModules\Microsoft.WindowsAdminCenter.ConnectionTools"

# Export the current connection list, including tags, to a CSV
Export-WACConnection "https://wac.contoso.com" -fileName "WAC-connections.csv"

# Import a connection list on a new or rebuilt gateway
Import-WACConnection "https://wac.contoso.com" -fileName "WAC-connections.csv" -AccessKey ""

Troubleshooting Cheat Sheet

Final Thoughts

Windows Admin Center earns its keep by removing friction, not by adding features nobody asked for — one browser tab replaces a pile of MMC snap-ins, an RDP session, and a PowerShell window, all authenticated the same way you already authenticate everywhere else in the domain. The gateway model also means the actual protocol underneath is still WinRM and Remote PowerShell — nothing new to open on a firewall that a competent WinRM deployment wasn’t already handling.

Treat the gateway itself as infrastructure worth protecting: it’s a single point that, if compromised, has administrative reach into every server it manages. Put it behind role-based access control where full local admin isn’t warranted, and prefer Entra ID or AD group-based access over ad hoc local accounts wherever the environment allows it.