Windows admin center не запускается

После некоторых обновлений перестал запускаться Windows Admin Center со следующими ошибками.

Версия установки: WindowsAdminCenter2311.msi

Ошибка WAC

Имя сбойного приложения: SmeDesktop.exe, версия: 1.5.2407.23001, метка времени: 0x9a70c5cc
Имя сбойного модуля: KERNELBASE.dll, версия: 10.0.19041.3930, метка времени: 0x9141f979
Код исключения: 0xe0434352
Смещение ошибки: 0x000000000002cf19
Идентификатор сбойного процесса: 0x2bc8
Время запуска сбойного приложения: 0x01db1b1ec9639ed1
Путь сбойного приложения: C:\Program Files\Windows Admin Center\SmeDesktop.exe
Путь сбойного модуля: C:\WINDOWS\System32\KERNELBASE.dll
Идентификатор отчета: 21ee1ef3-fd4b-41c2-bd35-be3c515203a9
Полное имя сбойного пакета: 
Код приложения, связанного со сбойным пакетом: 

Приложение: SmeDesktop.exe
Версия платформы: v4.0.30319
Описание. Процесс был завершен из-за необработанного исключения.
Сведения об исключении: Microsoft.ManagementExperience.PackageManagement.ExtensionSignatureException
   в Microsoft.ManagementExperience.PackageManagement.SignatureValidationPolicy.ApplyTo(Microsoft.ManagementExperience.Common.ValidationResult)
   в Microsoft.ManagementExperience.FrontEnd.Startup.Start(Microsoft.ManagementExperience.Common.Gateway.GatewayMode)
   в Microsoft.ManagementExperience.Desktop.Program.Launch(Boolean)
   в Microsoft.ManagementExperience.Desktop.Program.Main(System.String[])

Лечение:

Причиной этого стал отозванный корневой сертификат: Microsoft Root Certificate Authority

Серийный номер: 79ad16a14aa0a5ad4c7358f407132e65

Удалите данный сертификат.

Дополнение:

Как часто бывает, надо решить по-быстрому небольшую проблемку, но на пути попадаешь в некий адский круг и маленькая проблемка затягивает тебя в решение других проблем.

В данном случае так и произошло и где ожидалось решить за пол часика, пришлось потратить более полу дня.

Сам путь поиска проблемы был долгий и тернистый и лезть в код это было уже последней надеждой.

Ошибка была в модуле: Microsoft.ManagementExperience.PackageManagement.dll

Я не поленился и декопилировал модуль, чтоб понять, что происходит. Код, в котором происходило не обработанное исключение

public class SignatureValidationPolicy
{
 public bool IsDevMode { get; }

 public bool IsDebugBuild { get; }
 public bool ShouldValidate { get; }
 public SignatureValidationPolicy(bool developerMode, bool debugBuild)
 {
  IsDevMode = developerMode;
  IsDebugBuild = debugBuild;
  ShouldValidate = !developerMode && !debugBuild;
 }
 public void ApplyTo(ValidationResult validationResult)
 {
  if (validationResult.IsValid)
  {
   return;
  }
  if (ShouldValidate)
  {
   throw new ExtensionSignatureException("Error(s) validating platform integrity.", validationResult.InvalidFiles.Select((FileInfo f) => f.FullName));
  }
  foreach (FileInfo invalidFile in validationResult.InvalidFiles) ////-> в этом месте
  {
   Trace.TraceWarning(FormattableString.Invariant($"Unsigned file identified: {invalidFile.FullName}.  When run in Production Mode, this will cause the gateway to not run."));
  }
 }
}

Далее я подключался дебагером, смотрел, ломал, пытался ….

В итоге получилось выдернуть список файлов, что не нравилось системе:

Недопустимые файлы:

C:\Program Files\Windows Admin Center\Microsoft.AspNet.SignalR.Core.dll
C:\Program Files\Windows Admin Center\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll
C:\Program Files\Windows Admin Center\NuGet.Core.dll
C:\Program Files\Windows Admin Center\System.Net.Http.dll
C:\Program Files\Windows Admin Center\System.Net.Http.Formatting.dll
C:\Program Files\Windows Admin Center\System.Numerics.Vectors.dll
C:\Program Files\Windows Admin Center\System.Runtime.InteropServices.RuntimeInformation.dll
C:\Program Files\Windows Admin Center\System.Security.Cryptography.Algorithms.dll
C:\Program Files\Windows Admin Center\System.Security.Cryptography.Encoding.dll
C:\Program Files\Windows Admin Center\System.Security.Cryptography.Primitives.dll
C:\Program Files\Windows Admin Center\System.Security.Cryptography.X509Certificates.dll
C:\Program Files\Windows Admin Center\System.ValueTuple.dll
C:\Program Files\Windows Admin Center\System.Web.Cors.dll
C:\Program Files\Windows Admin Center\System.Web.Http.Cors.dll
C:\Program Files\Windows Admin Center\System.Web.Http.dll
C:\Program Files\Windows Admin Center\System.Web.Http.Owin.dll

Взял самый первый и Microsoft.AspNet.SignalR.Core.dll — имел не действующий сертификат … ну а дальше вы все знаете.

Ну еще чуток кода, что проверяет система

private static void ValidatePlatformSignatures()
	{
		SignatureValidator signatureValidator = new SignatureValidator();
		ValidationResult validationResult = new ValidationResult();
		signatureValidator.Validate(Path.Combine(StaticFileConfiguration.Instance.RootFolder, StaticFileConfiguration.PluginsFolderName), validationResult);
		signatureValidator.Validate(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), validationResult);
		if (validationResult.IsValid)
		{
			Trace.TraceInformation("Validation complete.  All assemblies have valid signatures.");
		}
		else
		{
			new SignatureValidationPolicy(GatewayHostInformation.IsDevelopmentMode, StaticFileConfiguration.IsDebug).ApplyTo(validationResult); // вот сюда мы попадали
		}
	}

Следствием того, что все пошло плохо стало обновление сертификатов на Windows 10.

Windows Admin Center enables management of Windows Server instances from any location, whether on-premises, in Azure, or across various cloud environments. However, users face many connection issues when accessing the utility. In this post, we will see how to resolve the Windows Admin Center connection errors like

Microsoft.PowerShell.LocalAccounts

This site/page can’t be reached error

Can’t connect securely to this page

You are not authorized to view this page

Картинка с сайта: www.thewindowsclub.com

The following are the Windows Admin Center connection errors that we are going to discuss in detail.

Microsoft.PowerShell.LocalAccounts

Картинка с сайта: www.thewindowsclub.com

If the installer fails to receive the message: The Module ‘Microsoft.PowerShell.LocalAccounts’ cannot be loaded. This can happen if the default PowerShell module path has been modified or removed. If you want to resolve it, check your PSModulePath environment variable and make sure that %SystemRoot%\system32\WindowsPowerShell\v1.0\Modules is the first item.

To resolve this issue, you can run the following command in PowerShell’s elevated mode.

[Environment]::SetEnvironmentVariable("PSModulePath","%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules;" + ([Environment]::GetEnvironmentVariable("PSModulePath","User")),"User")

This site/page can’t be reached error

Картинка с сайта: www.thewindowsclub.com

If you get a message saying the site or the page can’t be reached in your web browser, you need to first check if Windows Admin Center Desktop/SmeDesktop.exe is running in the Task Manager > Services if you have installed the utility as an app. If it is not running, restart it and see if it is crashing. Also, check if there is a Windows update available. You should also ensure that Windows Admin Center opens in either Edge or Chrome. If it opens with a different browser, change your default browser.

If you have installed Windows Admin Center as a default gateway, update the client and the server. Make sure that ServerManagementGateway/Windows Admin Center is running in the Task Manager. Finally, you can test the network connection to the Gateway using the following command, make sure to run in PowerShell (elevated mode).

Test-NetConnection -Port <port> -ComputerName <gateway> -InformationLevel Detailed

• Test-NetConnection: The cmdlet for testing network connections.
• Port <port>: Specifies the port number you want to test.
• ComputerName <gateway>: Specifies the name or IP address of the remote computer or gateway.
• InformationLevel Detailed: Provides detailed output, including diagnostic information about the connection.

This command is helpful for troubleshooting network issues, verifying port accessibility, and ensuring that specific services are reachable on a remote machine.

If you are using Windows 10 version 1703 or earlier, Windows Admin Center is not compatible with your version of Microsoft Edge. Upgrade to a newer version of Windows 10 or use Google Chrome. If you are on an insider preview version with a build between 17134 and 17637, a known bug may cause issues. Please switch to a supported version of Windows to fix this.

Картинка с сайта: www.thewindowsclub.com

Additionally, you need to check if the Windows Remote Management (WinRM) Service is running. Open the Services app, look for Windows Remote Management (WinRM), double-click on it, and check if it’s running, if it’s stopped, click on the Start button and set its Startup type to Automatic.

Hopefully, this will resolve the issue for you.

Can’t connect securely to this page

Картинка с сайта: www.thewindowsclub.com

Can’t connect securely to this page

This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website’s owner.

If you can’t connect securely to this page, your machine is restricted to HTTP/2 connections, and Windows Admin Center’s integrated Windows authentication is not supported with HTTP/2. To remove these restrictions, we need to add two registries. To do that, follow the steps mentioned below.

1. First of all, backup Registry, so that if something wrong happens, we can restore it.
2. Then, open the Registry Editor, and go to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters.
3. Right-click on the space and click on New > DWORD (32-bit) value.
4. Name it EnableHttp2Cleartext and then set its value to 0.
5. Then, create a new value, EnableHttp2Tls, and set it to 0 as well.

Finally, reboot your machine and check if the issue is resolved.

You are not authorized to view this page

Картинка с сайта: www.thewindowsclub.com

You are not authorized to view this page. If you recently updated Windows Admin Center, you may need to restart your browser, and then refresh the page.

When launching Windows Admin Center for the first time, ensure you select the Windows Admin Center Client certificate. Choosing another certificate will cause an error. If you encounter errors, restart your browser and select the correct certificate. If issues continue, clear your browser cache, switch browsers, or consider uninstalling and reinstalling Windows Admin Center.

Read: How to configure Secured-core Server for Windows Server

Why is my connection not private in Windows Admin Center?

The “connection is not private” error in Windows Admin Center usually occurs due to SSL certificate issues. If you are using a self-signed certificate, browsers like Microsoft Edge and Google Chrome will flag the connection as insecure, so installing a valid SSL certificate from a trusted certificate authority (CA) can fix this. Additionally, an expired SSL certificate will cause this error, which can be resolved by renewing the certificate. Lastly, ensure that the certificate is correctly installed and configured in the Windows Admin Center to avoid this issue.

Read: How to install and configure Windows Admin Center

How do I restart Windows Admin Center service?

You can restart the Windows Admin Center Service from the Services app. Open the Services app, search for Windows Admin Center, right-click on it, and select Restart. This will resolve the issue that you might be facing.

Also Read: Connect Windows Server to Azure.