Skip to content

Unqualified Select-Object call in Microsoft.SME.ServerManager breaks under JEA RestrictedRemoteServer session (affects non-admin RBAC users) #413

Description

@bobthebigbat

Gateway Version: 2606 2.7.5.21
Extension Version that's been used if it applies

*** The bug **
After enabling Role-Based Access Control (RBAC) and connecting as a non-administrator user assigned to a built-in Windows Admin Center role group (e.g. "Windows Admin Center Readers" or "Windows Admin Center Hyper-V Administrators"), the Server Manager Overview page fails to load server data. The notification panel shows:

Couldn't get server data. Exception: This operation was blocked by role based access control settings
The underlying PowerShell error (captured from the browser's Network tab on the failing invokeCommand request) is a parameter validation error, not a "command not recognized" error:
Cannot validate argument on parameter 'Property'. The argument "Message" does not belong to the set "ModuleName,Namespace,OutputType,Count,HelpUri,Name,CommandType, ResolvedCommandName,DefaultParameterSet,CmdletBinding,Parameters" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again.

To Reproduce
Steps to reproduce the behavior:

  1. On a standalone (or domain) Windows Server 2025 host running Windows Admin Center 2.7.5 (2606 release), enable RBAC (Settings → Access → Role-based access control).
  2. Create or use a local user that is a member of the built-in "Windows Admin Center Readers" or "Windows Admin Center Hyper-V Administrators" group only (not a local Administrator).
  3. Sign in to Windows Admin Center as that user.
  4. Connect to the server and open Server Manager → Overview.
  5. Observe the "Couldn't get server data" notification.

This can also be reproduced directly via PowerShell, without the browser, which isolates the issue to the extension code:

$cred = Get-Credential   # credentials for the JEA-restricted user
Invoke-Command -ComputerName <hostname> -ConfigurationName "Microsoft.Sme.PowerShell" `
    -Credential $cred -ScriptBlock { Get-Command Select-Object }
# CommandType returns as 'Function' (the JEA proxy), not 'Cmdlet',
# confirming Select-Object has been replaced in this session.

Expected behavior
The Server Manager Overview page should load server data successfully for users in the built-in Readers / Hyper-V Administrators roles, the same as it does for full local Administrators (who are not routed through the JEA-constrained session and therefore do not hit this proxy).

Screenshots & Additional context
Desktop/Server

  • Windows Admin Center version: 2606, build 2.7.5.21
  • Gateway installation type: Administration Mode (aMode), standalone server (workgroup, not domain or Entra-joined)
  • OS: Windows Server 2025, Desktop Experience, Hyper-V role
  • Extension: Server Manager and Computer Management, version 6.0.15
  • Browser: Microsoft Edge (also reproduces via direct PowerShell, so browser is not a factor)

Additional context

  • This was found while investigating a broader RBAC-enablement effort on a standalone Hyper-V host. A related but independent issue was also found where Get-WACVMServerInventory (Hyper-V extension) and Get-WACSMServerInventory (Server Manager extension) are referenced by the client but are not exported by the currently installed, fully up-to-date extension modules at all — filed separately.
  • Given the coding pattern (unqualified Select-Object inside a module intended to run under JEA), it's possible other functions across WAC extensions have the same latent issue and only surface for genuinely JEA-restricted (non-admin) users, since local Administrators bypass this session type entirely.

Full remote exception detail:
System.Management.Automation.ParameterBindingValidationException: Cannot validate argument on parameter 'Property'. ... ---> System.Management.Automation.ValidationMetadataException: The argument "Message" does not belong to the set "ModuleName,Namespace,OutputType,Count, HelpUri,Name,CommandType,ResolvedCommandName,DefaultParameterSet,CmdletBinding, Parameters" specified by the ValidateSet attribute. at System.Management.Automation.ValidateSetAttribute.ValidateElement(Object element) at System.Management.Automation.ValidateEnumeratedArgumentsAttribute.Validate(...) ... scriptStackTrace: at Get-WACSMCrashEvents, C:\ProgramData\WindowsAdminCenter\Modules\Microsoft.SME.ServerManager
Microsoft.SME.ServerManager.psm1: line 546

The failing request payload confirms the call:
{ "command": "Get-WACSMCrashEvents", "module": "Microsoft.SME.ServerManager", "parameters": { "fromDialog": false } }

Root cause (isolated independently of the WAC UI)
This reproduces even when calling the JEA endpoint directly with Invoke-Command, bypassing the browser and WAC gateway entirely — confirming this is a server-side extension code issue, not a front-end or RBAC-configuration problem.

Get-WACSMCrashEvents (line ~546 of Microsoft.SME.ServerManager.psm1) uses an unqualified Select-Object call:

Get-WinEvent -MaxEvents 5 -FilterHashtable @{...} -ErrorAction SilentlyContinue |
    Select-Object Message, Properties, TimeCreated, LogName, ProviderName, Id, LevelDisplayName

Per Microsoft's own JEA documentation, a session created with SessionType = 'RestrictedRemoteServer' (which is what the Microsoft.Sme.PowerShell JEA endpoint uses) operates in NoLanguage mode and exposes only a small default command set, including a constrained proxy version of Select-Object:

"Sessions of this type operate in NoLanguage mode and only have access to the following default commands (and aliases): Clear-Host, Exit-PSSession, Get-Command, Get-FormatData, Get-Help, Measure-Object, Out-Default, Select-Object." — https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/jea/session-configurations

This built-in proxy carries a restricted ValidateSet on its -Property parameter (in this environment, one that appears scoped for Get-Command output properties), and this proxy takes precedence over the real, unconstrained Select-Object cmdlet inside the session unless the call is fully qualified with its source module, e.g.:
Microsoft.PowerShell.Utility\Select-Object Message, Properties, TimeCreated, ...
Notably, other functions in the same module already use this fully-qualified form correctly (e.g. the server inventory script uses Microsoft.PowerShell.Utility\Select-Object csName, Caption, ...), indicating this is a known pattern for the extension authors that was simply missed in Get-WACSMCrashEvents.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    aModeBugs/feedback for Windows Admin Center: Administration ModebugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions