Windows Admin Center 2511 generally available

Posted by odaniel99@reddit | sysadmin | View on Reddit | 20 comments

Microsoft announced the release of Windows Admin Center 2511 [https://techcommunity.microsoft.com/blog/windows-admin-center-blog/windows-admin-center-version-2511-is-now-generally-available/4477048](https://techcommunity.microsoft.com/blog/windows-admin-center-blog/windows-admin-center-version-2511-is-now-generally-available/4477048)

Reply to Post

20 Comments

[-]

redrumdk@reddit

Have anyone had success in getting the dhcp extention to actually show the scopres in 2511 ?

[-]

hmw_ruckus@reddit

Nopes - doesn't work. Tried every browser and then some. What a mess

[-]

Jazzlike-Love-9882@reddit

Not a great experience so far: I can’t use it with my own wildcard certificate anymore, it just errors out when try access any server, whereas using self-signed works. And it does not appear to address Windows Updates endless spinning on Server 2025 targets. Back to 2410 🤷‍♂️

[-]

Jazzlike-Love-9882@reddit

Answering to my own comment: fixed the cert issue by following their doco (shocker) https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/update-certificate?tabs=wac (“Private Key not configured to be accessed by the network service”) I don’t remember this step being needed for 2410 but out now works as intended :)

[-]

Jkabaseball@reddit

I want to love this so much, but I always have run into the fact it's so slow in the past. Anyone know if it's gotten any better?

[-]

Arkios@reddit

Nope, it’s still crazy slow. I don’t understand why they’re continuing to waste resources on it, it’s a lost cause. They should have built something from scratch that integrated natively into Windows. Instead, they built a web GUI that just runs a bunch of Powershell under the hood. It’s never going to be good and it’s never going to be fast.

[-]

bbqwatermelon@reddit

FWIW it seems to perform best if not using a self signed cert and connect to hosts using FQDN and not just Netbios name

[-]

Brandhor@reddit

it's slow because it's basically running powershell scripts in the background and then it has to transform the command output to json and send it to the browser which has to render it

[-]

sysacc@reddit

IF you have defender and havent whitelisted the admin center directory it can slow down to a crawl.

[-]

Stratbasher_@reddit

Can't use this on an Entra ID-joined machine, as it says no domain controller connectivity. Unlike ADUC where we could type in the domain to connect to, we don't have that option in the admin center.

[-]

JerikkaDawn@reddit

It's almost as if Microsoft is able to start building something, but when they get to the hard parts, they can't figure it out, so they nuke and start over. That's why nothing has any capabilities beyond the basics.

[-]

AP_ILS@reddit

I really wish they would fix the Active Directory plugin so you don't have to be a domain admin to use it. It's been broken for years.

[-]

Reaper19941@reddit

If you're not a domain admin, what are you expecting? FWIW, i just read through most of the default groups in AD and didn't find one that can manage just the AD. I found domain admins and enterprise admins as expected but that was it. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups

[-]

Legal2k@reddit

Really, you are doing something very wrong. Help desk resetting passwords do not need to be domain admins. Otherwise we would have hundreds of domain admins.

[-]

RainStormLou@reddit

I don't let help desk interface directly with AD at all lol. They get a web form with very particular access levels, and it sends an smtp message to that person's supervisor with instructions on how to change the password from the temporary pw. I have like 3 domain admins and over 100,000 users.

[-]

Cormacolinde@reddit

And how does the supervisor change the password? With domain admin privileges? You’ve just moved the target, slowed down the process horribly and increased the number of people involved in a password reset from 2 to 3.

[-]

Emiroda@reddit

wut? AD has discretionary access control. You can grant Domain Users the same privileges on the domain as Domain Admins, or deny Domain Admins read access to a single attribute on a single object. Or give Bob from IT write access to the password attribute on every User object in the Finance OU. Microsoft calls it "delegation" in AD, but it's DACL based access control like everything else in Windows. I havn't used WAC in a while, but WAC should *absolutely* be able to handle someone using the Active Directory plugin without being Domain Admin. There's no excuse for it not being able to, other than Microsoft being daft.

[-]