How to set up WAC on an Azure Local Cluster
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 94%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
GabeCz
6
Reputation points
I'm having trouble setting up WAC on my local test cluster.
I followed this article's instructions:
I have set firewall rules better said enabled the built in rules
inbound:
WacInboundOpenException to local port 6516 is enabled
i created an inbound called WAC to local port 443 to test.
outbound:
WacOutboundOpenException to remote port 6516 is enabled
i created an extra called WAC to remote port 443 to test... but outbound as is works for any target.
and when i run test-netconnection -computername pas.windows.net -port 443 on any node and type in any website the result is True so the outbound rule must be ok for all the required websites.
Yet i get the error below when trying to install wac extension on the portal.
please let me know what to check and how to install wac on my nodes.
Now that i think, our actual production firewall is blocking port 6516 for incoming. Should i open 6516 for my nodes on the production firewall? and/or what ports to open inbound to my test nodes? (everything outgoing is allowed)
UPDATE: I have opened the ports 6516 and 443 for all the nodes inbound but it didn't work. i just read the error message and it says "timed out" but the error appears not longer than a couple of seconds of clicking on the set up button. the rest of the error message looks and feels like a standard next-next-finish way of cleaning things up, setting up firewall rules, and installing the extension. (which never happens) but it tires to start the service.
weird.
in addition i see "Windows Admin Center (v2)" installed with today's date on all the nodes.
i set the wac service logon from network to local user. and set the service to enabled and started the service via command line.
no change.
then after removing the installed versions of wac (v2) from all nodes, it errors out just the same. absolutely no difference.
any suggestion is welcome
Extension failed to install. Extension Install command timed out. Extension error output: std error: . Extension Message: Installing Windows Admin Center, UninstallingLegacyWindowsAdminCenter: Legacy Windows Admin Center is not installed, SearchingForWindowsAdminCenter: Windows Admin Center is not installed, UninstallingWindowsAdminCenter: Windows Admin Center is not installed, NewOutboundFirewallRule: Create outbound firewall rule to WAC service, CheckingCompatibility: Checking if system is compatible with Windows Admin Center, ExecutingWindowsAdminCenterInstaller: Executing Windows Admin Center installer (attempt number: 1), AttemptingToInstallWindowsAdminCenter: Attempting to install Windows Admin Center, StoppingWindowsAdminCenterService: Stopping Windows Admin Center service
Azure Local
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 6%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJH%3C/text%3E%3C/svg%3E)
Jilakara Hemalatha 340 Reputation points Microsoft External Staff Moderator2025-08-26T09:13:35.1266667+00:00 Hi GabeCz,
Could you please help confirm the following details
Is the Azure Connected Machine (Arc) agent installed and up to date on all nodes?
What is the current version and operational status of the Windows Admin Center service on the nodes?
Are you deploying WAC directly from the Azure Portal, or attempting it via a local installation?
Is the account used to deploy WAC a Local Administrator on all nodes?
Have you tried running the installation with a known local admin account to rule out domain GPO restrictions?
-
GabeCz 6 Reputation points
2025-08-26T18:09:07.0666667+00:00 hi thanks for your reply
(my nodes are on 24H2 26100.4349)
all nodes are azure arc connected
i have removed wac from all nodes, because it errored out within a couple of seconds even when they were up and running. service set to automatic, and running, logon as local user. network user didn't work and i found an article suggesting use local user.
so to answer your 2nd question, as of this second, none of the nodes have wac installed. i'm always downloading from https://aka.ms/WACdownload so without knowing the actual version number, i can safely say: the latest.
i went to the portal, picked the cluster "node" then settings / windows admin center (preview) and clicked on set up. which after i clicked on refresh button on the page not the browser and it already failed on all nodes with the error below.. above. within 1-2 seconds. maximum 3.
yes ourdomain\lcmuser is a local administrator on all nodes.
what i will try now, is that i go to the individual nodes' console log in as ourdomain\lcmuser and attempt the install 'locally' and make sure the service is running.
i can make happen that on all nodes wac is running. let's assume that is already done. why is going to the cluster 'node' then settings / windows admin center (preview) set up still does not install it or saying what it is saying?
i used /verysilent option when installing so if defaults aren't the ones i need id' like to know what options i need to pick for azure to be happy
-
GabeCz 6 Reputation points
2025-08-27T18:34:40.28+00:00 i am now installing wac on the nodes manually and register them with azure doing the entra app registration and whatnot.
which was once again never mentioned nowhere that it needs to be done. but what's new.
do i need to create an entra app for every individual node?
-
Jilakara Hemalatha 340 Reputation points Microsoft External Staff Moderator
2025-08-28T11:32:33.68+00:00 No, you don’t need to create a separate Entra app for every single node. One Entra app registration is enough for the entire cluster, as long as you give it the right permissions.
Once all your nodes are Arc-connected and reachable on port 6516. This single app will handle authentication and authorization for all nodes in the environment, simplifying the management process.
please refer below documents:
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
Please let me know if you have any queries.
Sign in to comment
Sign in to answer