Hello, Cloud Gurus, and welcome back for this lesson,
where we're going to take a look
at deploying Windows Admin Center.
Let's take a look at what we're going to cover.
First up, we'll understand what exactly
is Windows Admin Center.
We'll take a look at deploying Windows Admin Center.
We'll also take a look
at how you can configure the target machines
that you plan to manage with Windows Admin Center.
And then we'll do a demo where we will deploy
and do the initial setup for Windows Admin Center.
Let's get started.
So what exactly is Windows Admin Center?
Well, Windows Admin Center is a web-based console
for managing Windows Server.
It includes management capabilities
for server manager, failover clusters,
hyper-converged clusters and Windows 10 clients.
And it's a website that runs PowerShell commands
and uses Windows Management Instrumentation
or WMI in the background
mostly using Win Rm and Kerberos authentication.
And it can also be integrated with Azure to provide support
for deploying Azure resources, migrating to Azure,
and you can use Azure Active Directory for authentication,
but it's not meant to be a complete replacement
for all the previous management tools.
Rather, it's designed to supplement them
and extensions can be installed to expand
the default capabilities available
with Windows Admin Center.
Now, there are 2 main components to Windows Admin Center.
The first is the web server and user interface,
and it's a separate web server
that doesn't use Windows Server
internet information services,
more commonly known as IIS.
And the second component is the Gateway
and it's used to manage servers
through PowerShell remoting and WMI.
Now Windows Admin Center can be installed on Windows 10
version 1709 or later.
And in this mode, you don't get the gateway server.
Instead it's installed as a local client
and you manage the servers directly.
And this mode is mostly intended
for testing purposes or alternatively
it can also be installed on Windows Server 2016
or later in Gateway mode, and then accessed
via web browser from another Windows computer.
It's also worth pointing out
that you can install Windows Admin Center directly
on the management targets
like your Windows service and failover clusters.
The Server Core installation option is also supported
and it's also important to point out
that Windows Admin Center is not supported when
it's deployed on a domain controller
and there's no support for Internet Explorer.
You'll need to use a modern browser
like Microsoft Edge or Google Chrome.
And finally, as you would expect,
you need to be a local administrator
on the server to install Windows Admin Center.
All right, let's take a moment to understand how
you can configure target machines for Windows Admin Center.
Firstly, it's important to point
out that you can manage Windows client computers that run
a supported version of Windows 10 or later.
And Windows Server 2012
and newer versions are fully supported.
And there's also limited functionality available
for managing Windows Server 2008 R2
but that's no longer supported.
And you can also manage Hyper-V hosts
and hyper-converged infrastructure.
And hyper-converged infrastructure is just
a combined cluster of storage and Hyper-V hosts,
but they require the File Services role
to be installed, the Powershell module
for Hyper-V, and additional firewall rules for storage.
And you can also manage failover clusters,
which don't have any special requirements except
for potentially using CredSSP in very limited scenarios.
No matter which target you'd like to configure,
you'll also need Windows Management Framework 5.1
and remote management enabled on your target machine.
And you'll likely also need Kerberos delegation.
And if you want to work cross forest
this will need to be resource-based,
constrained Kerberos delegation
that we covered in the previous lessons.
All right, let's take a look at a demo
of deploying Windows Admin Center.
I've deployed and set up
a new virtual machine CORP-BNE-WAC01.
And this will be used to host Windows Admin Center
and I've already acquired an SSL certificate
for Windows Admin Center.
So I will use that when we deploy Windows Admin Center
on that server.
And then we will log on
to our administrative server CORP-BNE-ADM01.
We will add management targets
and we will test and configure Kerberos delegation
for management, via Windows Admin Center.
And finally, we will explore managing our domain controller,
CORP-BNE-DC01, using the Active Directory extension
for Windows Admin Center.
Let's take a look at the demo.
All right, so here I am logged onto our new server
that we're going to deploy Windows Admin Center to.
Firstly, we need to grab the certificate thumbprint
for the certificate that I've pre-installed
on this server that we're going to use
with Windows Admin Center.
To do that we need to use certificate manager.
So I'm going to go ahead and search for certificates
and then we'll select manage computer certificates
and I'll just move this over and resize it a little bit.
We'll navigate into the personal folder,
then we'll navigate into the certificates folder,
and then we can see the certificate that I've pre-installed
for our Windows Admin Center server.
So I'll go ahead and double click that
and then we'll navigate to the Details tab
and then we'll scroll down
and find the certificate thumbprint.
There's our thumbprint there.
So we'll go ahead and copy that.
Okay, we can go ahead and close Certificate Manager now.
Let's go ahead and install Windows Admin Center.
So we'll just double click to launch the installer.
We'll accept the license terms and then click Next.
We'll send just the required diagnostic data.
So we'll click Next and we'll use Microsoft Update
because that's always a good idea.
And then we'll click Next.
And because we're installing on Windows Server,
it's going to install both the web server component
and the gateway server component.
Let's go ahead and click Next.
Now we're going to allow Windows Admin Center
to modify this machine's trusted host settings
so we can manage work group computers,
and we're going to automatically
update Windows Admin Center.
But because WinRM over HTTPS requires certificates
that we don't have deployed,
we're going to leave this option disabled,
but I'd highly recommend enabling this option
in a production environment
and deploying the required certificates.
Let's go ahead and click Next.
Now we're going to use the default port
for Windows Admin Center of 443.
If you were deploying this to our Windows client
it would use port 6516 and we want to use
an SSL certificate that we've pre-installed
on this computer.
So I'm going to select that option
and then paste in the certificate thumbprint.
And then we're going to select to redirect HTTP traffic
to HTTPS so that all of our traffic connecting
to Windows Admin Center is secure by default.
We'll go ahead and click Install.
And this will just take a moment to install.
So we'll come back when this is done.
All right, the installation is now complete.
Now, if you need to update the certificate
at any point in the future
you can just go ahead and rerun the installer
or you can select the change option from add/remove programs
and then that'll rerun the installer.
And then you can select to update the certificate thumbprint
with your new certificate.
All right, let's move across to our administrative server
and then we'll access the Windows Admin Center website
from there.
All right, so here I am on our administrative server.
We'll go ahead and launch Microsoft Edge
and then we'll go ahead
and access the Windows Admin Center website.
We can go ahead and close the welcome message.
Now I'll quickly show you what's available
to manage using Windows Admin Center.
So I'll select the all connections option
in the top left hand corner.
And you can see here that you get server manager,
which is similar to the default server manager
that you get with Windows Server.
We get computer management, which is used
for managing Windows clients,
like Windows 10 and Windows 11.
And we get the cluster manager
which is used to manage Windows Server failover clustering.
Now let's go ahead and add a server, which will be one
of our management targets, to Windows Admin Center.
We'll go ahead and click Add,
we'll select Add under Servers
and then we're going to use Active Directory.
So we'll select Search Active Directory and
because all of our servers start with the domain name CORP,
I'm just going to go ahead
and do a wildcard search for Corp and then hit Search.
And I'll go ahead and add all
of our service from Active Directory and then click Add.
Now let's go ahead and select our domain controller
so we can manage our domain controller,
which is CORP-BNE-DC01.
Now you'll notice there that when I selected
that CORP-BNE-DC01 server, it didn't ask for credentials
for me to connect to that server and manage it.
And that's because our preconfigured Kerberos delegation
to allow the Windows Admin Center server
to send delegated credentials to our domain controller.
I just want to quickly show you that in Windows PowerShell.
So I'll just launch Windows PowerShell.
All right, and now let's get the identity
for our domain controller
and we'll save that to our variable.
And now let's see which identities are allowed
to delegate credentials to our domain controller.
And to do that, we'll use
the Get-ADComputer PowerShell command again.
And we can see here
that our Windows Admin Center server is allowed
to delegate credentials to our domain controller.
And you'll likely want to configure this
for all of the servers that you want to manage
from Windows Admin Center.
All right, we can go ahead and close Windows PowerShell now.
Now, let's see if we can manage Active Directory users
and computers on this domain controller.
What we can see here
that we can manage local users and groups,
but that's not going to help us on a domain controller.
So to manage Active Directory users and computers,
we're going to need to install an extension.
To do that we're going to navigate to Settings
and then we'll navigate to Extensions.
And then we're going to select
the Active Directory extension and then we'll click Install,
and the page will reload once it's completed.
All right, that's now successfully installed.
Now we'll take a look
at how you can manage Active Directory users
and computers using the extension in just a moment.
I want to quickly show you this Shared Connections options
under the Gateway.
If you configure shared connections,
this allows you to configure server connections
in Windows Admin Center that can be used
by anyone who accesses this gateway server.
And this will be great
if you have a Windows Admin Center server
that's shared by a bunch of admins.
All right, now let's navigate back
to our domain controller and take a look
at how we can manage active directory users and computers.
So we'll navigate back home
and we'll navigate into our domain controller
and then we'll navigate into Active Directory.
And if we navigate
to Browse and I'll just accept the default
to use my current credentials to manage Active Directory
and we can see here, we're able to browse Active Directory
and we can use the create option to create users, groups,
and organizational units just like you would
using the traditional Active Directory management tools.
Now there's a lot more
to Windows Admin Center than I've shown you in this demo.
And we'll explore it a bit more in the following lessons.
And then we'll come back to Windows Admin Center,
when we look at managing storage later on in the course
but that concludes this demo.
Let's wrap up with a bit
of a summary of what we've covered in this lesson.
All right.
So what have we covered in this lesson?
Windows Admin Center complements your existing management
tools with web-based management.
And it's important to remember that Windows Admin Center
requires remote management configured Kerberos delegation
and Windows management framework 5.1.
And you need to use resource based Kerberos delegation
for cross domain and cross forest scenarios.
And you can integrate Windows Admin Center
with Azure to enhance its capabilities.
And we'll take a look at this
in more detail throughout the remainder of this course.
And you can also extend the capabilities
of Windows Admin Center
with extensions from Microsoft and third parties.
All right, thanks for being with me
in this lesson and I hope you found it useful.
And I look forward to seeing you in the next lesson.