How to Install Windows Admin Center and Fix WinRM Errors

Windows Admin Center (WAC) is a free web tool from Microsoft. You use it to manage Windows Servers from a browser. This guide covers setting up Windows Admin Center on a VPS; then you will learn how to fix WinRM connection errors.

Before you install Windows Admin Center, you must check that you have these requirements ready. Here is what to prepare first:

• A VPS running Windows Server 2016 or later. Microsoft lists Windows Server 2016 or later as supported for the gateway.
• Administrator access to the VPS.
• A browser: Microsoft Edge or Google Chrome, fully updated.
• A domain name (FQDN) that points to your VPS, such as wac.example.com.
• A TLS certificate for Server Authentication, if you plan to use it in production.

If you do not have a server yet, a Windows VPS Server with full administrator access and a web console is a good option for a WAC gateway.

Console safety: Before you change firewall rules or WinRM settings, make sure you can open your provider's web console, such as VNC or similar. If you block RDP by mistake, the console is your way back in. Also, take a snapshot or backup of the VPS if your panel supports it.

WAC runs as a gateway. You open the gateway in your browser over HTTPS. Then, the gateway talks to each managed server using WinRM (Windows Remote Management). So, there are two paths to protect:

1. Browser to gateway: HTTPS on the WAC port.
2. Gateway to managed server: WinRM, TCP 5985 (HTTP) or 5986 (HTTPS).

Most problems in a Windows Admin Center setup come from the second path.

Windows Admin Center runs as a gateway on your VPS. You install it once, and then you manage your servers from any browser. 

This part covers each step, from the download to the first login. Follow them in order, and test as you go.

You can download the installer from the Microsoft Evaluation Center, then copy it to your VPS. Or you can directly download it with the following PowerShell command:

Microsoft says to use a certificate from a trusted certificate authority in production. The installer can make a self-signed certificate, but it expires after 60 days and is for testing only.

If you have your own certificate, it must be in the LocalMachine\My store. Also, it must match the name you type in the browser. Find the thumbprint with:

Now it's time to run the installer. Use Custom setup, so you can pick your own port and certificate. 

1. Run the installer and accept the license terms.
2. On Select installation mode, choose Custom setup.
3. Set the HTTPS port. Read the final port on the Ready to install page.
4. On Select TLS certificate, pick your installed certificate.
5. Choose your update and diagnostic data options.
6. Select Install, then Finish.

At this point, you can let people reach the gateway by opening its port in the firewall. Open only the WAC HTTPS port, and nothing else. If you can, allow only your own IP address, so fewer people can reach it.

Replace 443 and the IP with your values:

Note: Do not open WinRM ports (5985 or 5986) to the whole internet.

Now check that the gateway works. Make sure the service is running and the port answers. Replace <Port> and <Gateway> with your values:

Then, open https://wac.example.com in your browser. On the first launch, select the Windows Admin Center Client certificate if prompted by the browser. Choosing another certificate causes a not authorized error.

In any Windows Admin Center setup, delegated management means each admin signs in with their own account and gets only the rights they need.

• Create a named account for each admin. Do not share the built-in Administrator account.
• On each managed server, the account must be in the local Administrators group. In some cases, it also needs the Remote Management Users group.
• Keep the list of WAC users short and review it.
• Use a certificate-based HTTPS name, so nobody clicks through browser warnings.

WinRM is how the gateway talks to your servers, so it needs to be set up with care. This section shows how to set it up for domain and workgroup servers. You will also learn how to use HTTPS and keep the settings tight.

Domain servers are the easiest to set up. Your domain already handles trust between the gateway and the servers, so there is little to configure. You only need to check that WinRM works. To do this, run:

Workgroup servers need a little more work. They are not part of a domain, so the gateway does not trust them by default. You can fix this by adding each server to the TrustedHosts list.

First, save your current list, because the next command overwrites it:

Then, add only the servers you manage:

Microsoft shows the * wildcard as a quick test option. Avoid it on a live server, because it trusts every machine. To clear the list when you finish testing, run:

HTTP on 5985 is fine inside a private network. For anything that crosses a public network, you must use HTTPS on 5986. The Custom setup page of the installer has a WinRM over HTTPS option. On the target server, you need a certificate and a listener:

Note: The hostname must match the certificate name.

When a connection fails, you must test from the gateway, outside the browser. Then, work through the checks below. Most errors come from a stopped service, a blocked port, or a missing TrustedHosts entry.

First, test from the gateway with:

If it connects, the network and permissions are fine. If it fails, use the checks below.

The most common cause is that WinRM is not running on the target server. Without the service or a listener, the gateway has nothing to connect to.

Run the commands below on the target server to check and fix it:

If the firewall blocks WinRM, the gateway can't reach the server. WinRM uses port 5985 for HTTP and port 5986 for HTTPS. First, test the port from the gateway:

If the test fails, check the Windows firewall and your VPS provider's firewall. A workgroup server on a different subnet must allow TCP port 5985. On Windows Server, run this command on the target:

This rule lets every IP address connect. Once it works, change it so only your gateway IP can connect.

If you see an error that says the server is not trusted, or that Kerberos can't be used, the target is not in the TrustedHosts list. You can add it using the steps above. Big Windows updates can clear this list, so check it again after them.

Sometimes the connection works, but the sign-in still fails. This usually means the account doesn't have enough rights on the target server. Check the account, and then change the policy if needed.

By default, WinRM does not pass your sign-in details on to a second machine. A few actions need this. You can allow it with CredSSP, but only for a short time. Turn it off when you finish, so your credentials do not stay exposed.

If you see "Can't connect securely to this page", your browser may be using HTTP/2. WAC uses Windows sign-in, and that does not work over HTTP/2. On the machine that runs the browser, run this:

Restart the browser after this change. Also, check that the certificate name matches the URL and has not expired.

Sometimes WAC won't start after you reinstall it. An old install may still be holding the port. You must clear the old settings with the commands below, and then try again.

Some WAC tools, like Remote Desktop, Events, and PowerShell, may fail while the rest of the dashboard works fine. These tools need WebSockets to run, and proxies and firewalls usually block them. You may see a blank screen, a loading circle that never ends, or a connection error.

You must check your proxy and firewall first and allow WebSockets on the path to the gateway.

One wrong firewall or WinRM change can lock you out of your VPS. Follow this short checklist each time you change a setting. It helps you get back in if something goes wrong.

• Keep the provider's web console open in another tab while you edit firewall rules.
• Never remove the RDP rule (TCP 3389) before you have tested another way in.
• Back up the TrustedHosts value before you change it.
• Change one setting and test after each change.
• Use -RemoteAddress in firewall rules to limit who can connect.
• Remove temporary changes, such as wildcard TrustedHosts and CredSSP, when you are done.

Tips: If one VPS is not enough for a bigger setup, try a dedicated server for Windows workloads. It can run many virtual machines, and you can manage all of them from the same gateway.

A good Windows Admin Center setup needs a supported Windows Server, a trusted HTTPS certificate, a locked-down firewall, and named admin accounts. When something breaks, test WinRM from the gateway. Then, check the service, the firewall, TrustedHosts, permissions, and TLS. 

Test after every change, and keep your VPS console open so you can always get back in.