Unable to Connect to Windows Admin Center for Arc-Enabled Servers

Question

Unable to Connect to Windows Admin Center for Arc-Enabled Servers

Nate Gagne 0

Experiencing issues connecting to Windows Admin Center (WAC) for Arc-enabled servers. The extension installs successfully without errors in the Event Log, but attempts to connect result in the following error:

Couldn't connect to Windows Admin Center.
Error message:
{"message":"Failed to fetch","stack":"TypeError: Failed to fetch\n at https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:24683\n at https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:24904\n at mt (https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:7352)\n at https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:11270\n at Array.forEach (<anonymous>)\n at https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:11258\n at Object.mt (https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:170:7352)\n at b (https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:59:1903)\n at v (https://portal.azure.com/Content/Dynamic/dXsp65hcv53l.js:59:1734)","isError":true}

Steps Taken:

Verified that nothing is being blocked at the firewall.
Confirmed there is no SSL inspection on this traffic.
Rebooted the servers.
Ensured the WAC service is running.
Executed Invoke-RestMethod -Method GET -Uri https://eastus.service.waconazure.com, which returned the expected response: Microsoft Certificate and DNS service for Windows Admin Center in the Azure Portal.

Any suggestions for resolving this connectivity issue?

Pranay Reddy Madireddy 4,415 Reputation points Microsoft External Staff

2025-04-25T22:14:30.8966667+00:00
Hi Nate Gagne

Confirm that the HIMDS service is running. You can restart it using the following PowerShell command:

Restart-Service -Name himds

Verify that the extension version is 0.0.0.169 or higher. If the version is lower, please uninstall and reinstall the extension.

Verify that the WAC service is running. You can check this in Task Manager under the Services tab.

Run the following command to verify that the required port is enabled for the reverse proxy session:

azcmagent config list

Make sure the port used by WAC appears under incomingconnections.ports

Outbound Connectivity: Please ensure the hybrid machine has outbound access to the following endpoints:

*.wac.azure.com

pas.windows.net

*.servicebus.windows.net

Although your firewall is not blocking traffic, we recommend double-checking for any other network-related issues that may be affecting connectivity.
https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/support/troubleshooting
https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-arc-hybrid-machines#failed-to-connect-with-404-endpoint-not-found

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".

Nate Gagne 0

Thank you. The service is running and I have already tried restarting it. The WAC port is listening:

Local Configuration Settings
  incomingconnections.enabled (preview)                 : true
  incomingconnections.ports (preview)                   : [6516]

The extension version is higher than 0.0.0.169:

PS C:\WINDOWS\system32> azcmagent extension list
INFO    Stopping and disabling service: Extension Service
Extension: AdminCenter
Version: 0.49.0.0
Extension Path: C:\Packages\Plugins\Microsoft.AdminCenter.AdminCenter
State: ENABLED
Extension: WindowsOsUpdateExtension
Version: 1.0.28.0
Extension Path: C:\Packages\Plugins\Microsoft.SoftwareUpdateManagement.WindowsOsUpdateExtension
State: ENABLED
Extension: AzureMonitorWindowsAgent
Version: 1.34.0.0
Extension Path: C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent
State: ENABLED
Extension: ChangeTracking-Windows
Version: 2.29.0.0
Extension Path: C:\Packages\Plugins\Microsoft.Azure.ChangeTrackingAndInventory.ChangeTracking-Windows
State: ENABLED
Extension: WindowsPatchExtension
Version: 1.5.71
Extension Path: C:\Packages\Plugins\Microsoft.CPlat.Core.WindowsPatchExtension
State: ENABLED
INFO    Enabling and starting service: Extension Service

And finally, all endpoints are reachable:

PS C:\WINDOWS\system32> azcmagent.exe check
INFO    Testing connectivity to endpoints that are needed to connect to Azure... This might take a few minutes.
Use Case  |Endpoint                                              |Reachable  |Private  |TLS      |Proxy
core      |https://agentserviceapi.guestconfiguration.azure.com  |true       |false    |TLS 1.2  |not used
core      |https://eastus-gas.guestconfiguration.azure.com       |true       |false    |TLS 1.2  |not used
core      |https://gbl.his.arc.azure.com                         |true       |false    |TLS 1.2  |not used
core      |https://gbl.his.arc.azure.com/eus/his                 |true       |false    |TLS 1.2  |not used
core      |https://login.microsoftonline.com                     |true       |false    |TLS 1.2  |not used
core      |https://management.azure.com                          |true       |false    |TLS 1.2  |not used
core      |https://pas.windows.net                               |true       |false    |TLS 1.2  |not used

Ashok Gandhi Kotnana 6,675 Reputation points Microsoft External Staff

2025-04-28T18:34:29.21+00:00

Hi @Nate Gagne

Please let me know if your issue has been resolved.

Thankyou
Nate Gagne 0 Reputation points

2025-04-28T19:04:55.09+00:00

The issue has not been resolved.
Pranay Reddy Madireddy 4,415 Reputation points Microsoft External Staff

2025-04-29T22:31:32.87+00:00
Hi Nate Gagne

Verify there are no firewall rules blocking port 6516, which is required for WAC. Even if the port appears to be listening, firewall configurations can still prevent successful connections.

Confirm that the Windows Admin Center service is running. You can do this by opening Task Manager, navigating to the Services tab, and verifying that ServerManagementGateway (Windows Admin Center) is active.

To verify that the Microsoft Certificate and DNS services for WAC are accessible, run the following command in PowerShell:

Invoke-RestMethod -Method GET -Uri https://<your_region>.service.waconazure.com

Replace <your_region> with your appropriate Azure region. You should receive a valid response if connectivity is working as expected.

If you haven’t already, try restarting the HIMDS service again. Occasionally, a second restart can help clear up residual issues.

If the issue persists, we recommend reviewing the logs on both the Azure portal and the hybrid machine. This can help identify any specific errors or configuration issues affecting the connection.

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-hci-clusters#the-windows-admin-center-extension-failed-to-install

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Nate Gagne 0 Reputation points

2025-04-30T13:11:01.17+00:00

Thanks. The service (and machine) have been restarted multiple times. There is an inbound Windows Firewall rule allowing 6516/tcp from any. I can reach the Cert/DNS services via the Powershell command. I have a service named Windows Admin Center which is running, but no service named ServerManagementGateway.
Vinay B 255 Reputation points Microsoft External Staff

2025-05-01T13:23:23.6633333+00:00
Hi Nate Gagne,

Thanks for confirming the previous steps. Since core components like the service, port, and endpoints check out, Please check the following steps and confirm.

WAC Service Health

The missing ServerManagementGateway service suggests an incomplete WAC deployment.

Run the command Get-WinEvent -LogName "Microsoft-ServerManagementExperience" - MaxEvents 50

Check HTTPS Binding

Ensure WAC is correctly bound to port 6516:
netsh http show sslcert netstat -anob | findstr :6516

Test WAC Endpoint Directly

Try accessing WAC from a browser:
https://<servername>:6516

Note any certificate or login errors.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Nate Gagne 0

PS C:\Windows\system32> Get-WinEvent -LogName "Microsoft-ServerManagementExperience" -MaxEvents 50
Get-WinEvent : There is not an event log on the localhost computer that matches "Microsoft-ServerManagementExperience".

PS C:\Windows\system32> netsh http show sslcert
SSL Certificate bindings:
-------------------------
PS C:\Windows\system32>
PS C:\Windows\system32>     netstat -anob | findstr :6516
  TCP    0.0.0.0:6516           0.0.0.0:0              LISTENING       3000
  TCP    [::]:6516              [::]:0                 LISTENING       3000

I can browse to https://server:6516 and get a certificate warning. If I proceed past it, I can see that the cert was issued by Azure. The site displays {"error":{"message":"File not found","code":"NotFound","detail":""}}

Your answer

Pranay Reddy Madireddy 4,415 Reputation points Microsoft External Staff

2025-04-25T22:14:30.8966667+00:00

Hi Nate Gagne

Confirm that the HIMDS service is running. You can restart it using the following PowerShell command:

Restart-Service -Name himds

Verify that the extension version is 0.0.0.169 or higher. If the version is lower, please uninstall and reinstall the extension.

Verify that the WAC service is running. You can check this in Task Manager under the Services tab.

Run the following command to verify that the required port is enabled for the reverse proxy session:

azcmagent config list

Make sure the port used by WAC appears under incomingconnections.ports

Outbound Connectivity: Please ensure the hybrid machine has outbound access to the following endpoints:

*.wac.azure.com

pas.windows.net

*.servicebus.windows.net

Although your firewall is not blocking traffic, we recommend double-checking for any other network-related issues that may be affecting connectivity.
https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/support/troubleshooting
https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-arc-hybrid-machines#failed-to-connect-with-404-endpoint-not-found

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Ashok Gandhi Kotnana 6,675 Reputation points Microsoft External Staff

2025-04-28T18:34:29.21+00:00

Hi @Nate Gagne

Please let me know if your issue has been resolved.

Thankyou
Nate Gagne 0 Reputation points

2025-04-28T19:04:55.09+00:00

The issue has not been resolved.
Pranay Reddy Madireddy 4,415 Reputation points Microsoft External Staff

2025-04-29T22:31:32.87+00:00

Hi Nate Gagne

Verify there are no firewall rules blocking port 6516, which is required for WAC. Even if the port appears to be listening, firewall configurations can still prevent successful connections.

Confirm that the Windows Admin Center service is running. You can do this by opening Task Manager, navigating to the Services tab, and verifying that ServerManagementGateway (Windows Admin Center) is active.

To verify that the Microsoft Certificate and DNS services for WAC are accessible, run the following command in PowerShell:

Invoke-RestMethod -Method GET -Uri https://<your_region>.service.waconazure.com

Replace <your_region> with your appropriate Azure region. You should receive a valid response if connectivity is working as expected.

If you haven’t already, try restarting the HIMDS service again. Occasionally, a second restart can help clear up residual issues.

If the issue persists, we recommend reviewing the logs on both the Azure portal and the hybrid machine. This can help identify any specific errors or configuration issues affecting the connection.

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/manage-hci-clusters#the-windows-admin-center-extension-failed-to-install

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Nate Gagne 0 Reputation points

2025-04-30T13:11:01.17+00:00

Thanks. The service (and machine) have been restarted multiple times. There is an inbound Windows Firewall rule allowing 6516/tcp from any. I can reach the Cert/DNS services via the Powershell command. I have a service named Windows Admin Center which is running, but no service named ServerManagementGateway.
Vinay B 255 Reputation points Microsoft External Staff

2025-05-01T13:23:23.6633333+00:00

Hi Nate Gagne,

Thanks for confirming the previous steps. Since core components like the service, port, and endpoints check out, Please check the following steps and confirm.

WAC Service Health

The missing ServerManagementGateway service suggests an incomplete WAC deployment.

Run the command Get-WinEvent -LogName "Microsoft-ServerManagementExperience" - MaxEvents 50

Check HTTPS Binding

Ensure WAC is correctly bound to port 6516:
netsh http show sslcert netstat -anob | findstr :6516

Test WAC Endpoint Directly

Try accessing WAC from a browser:
https://<servername>:6516

Note any certificate or login errors.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.
Nate Gagne 0 Reputation points

2025-05-01T16:54:04.26+00:00

PS C:\Windows\system32> Get-WinEvent -LogName "Microsoft-ServerManagementExperience" -MaxEvents 50 Get-WinEvent : There is not an event log on the localhost computer that matches "Microsoft-ServerManagementExperience".

PS C:\Windows\system32> netsh http show sslcert SSL Certificate bindings: ------------------------- PS C:\Windows\system32> PS C:\Windows\system32> netstat -anob | findstr :6516 TCP 0.0.0.0:6516 0.0.0.0:0 LISTENING 3000 TCP [::]:6516 [::]:0 LISTENING 3000

I can browse to https://server:6516 and get a certificate warning. If I proceed past it, I can see that the cert was issued by Azure. The site displays {"error":{"message":"File not found","code":"NotFound","detail":""}}

Share via

Unable to Connect to Windows Admin Center for Arc-Enabled Servers

Your answer