Gateway Version: 2606 2.7.5.21
Extension Version that's been used if it applies
*** The bug **
After enabling Role-Based Access Control (RBAC) and connecting as a non-administrator user assigned to a built-in Windows Admin Center role group (e.g. "Windows Admin Center Readers" or "Windows Admin Center Hyper-V Administrators"), the Server Manager Overview page fails to load server data. The notification panel shows:
Couldn't get server data. Exception: This operation was blocked by role based access control settings
The underlying PowerShell error (captured from the browser's Network tab on the failing invokeCommand request) is a parameter validation error, not a "command not recognized" error:
Cannot validate argument on parameter 'Property'. The argument "Message" does not belong to the set "ModuleName,Namespace,OutputType,Count,HelpUri,Name,CommandType, ResolvedCommandName,DefaultParameterSet,CmdletBinding,Parameters" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again.
To Reproduce
Steps to reproduce the behavior:
- On a standalone (or domain) Windows Server 2025 host running Windows Admin Center 2.7.5 (2606 release), enable RBAC (Settings → Access → Role-based access control).
- Create or use a local user that is a member of the built-in "Windows Admin Center Readers" or "Windows Admin Center Hyper-V Administrators" group only (not a local Administrator).
- Sign in to Windows Admin Center as that user.
- Connect to the server and open Server Manager → Overview.
- Observe the "Couldn't get server data" notification.
This can also be reproduced directly via PowerShell, without the browser, which isolates the issue to the extension code:
$cred = Get-Credential # credentials for the JEA-restricted user
Invoke-Command -ComputerName <hostname> -ConfigurationName "Microsoft.Sme.PowerShell" `
-Credential $cred -ScriptBlock { Get-Command Select-Object }
# CommandType returns as 'Function' (the JEA proxy), not 'Cmdlet',
# confirming Select-Object has been replaced in this session.
Expected behavior
The Server Manager Overview page should load server data successfully for users in the built-in Readers / Hyper-V Administrators roles, the same as it does for full local Administrators (who are not routed through the JEA-constrained session and therefore do not hit this proxy).
Screenshots & Additional context
Desktop/Server
- Windows Admin Center version: 2606, build 2.7.5.21
- Gateway installation type: Administration Mode (aMode), standalone server (workgroup, not domain or Entra-joined)
- OS: Windows Server 2025, Desktop Experience, Hyper-V role
- Extension: Server Manager and Computer Management, version 6.0.15
- Browser: Microsoft Edge (also reproduces via direct PowerShell, so browser is not a factor)
Additional context
- This was found while investigating a broader RBAC-enablement effort on a standalone Hyper-V host. A related but independent issue was also found where Get-WACVMServerInventory (Hyper-V extension) and Get-WACSMServerInventory (Server Manager extension) are referenced by the client but are not exported by the currently installed, fully up-to-date extension modules at all — filed separately.
- Given the coding pattern (unqualified Select-Object inside a module intended to run under JEA), it's possible other functions across WAC extensions have the same latent issue and only surface for genuinely JEA-restricted (non-admin) users, since local Administrators bypass this session type entirely.
Full remote exception detail:
System.Management.Automation.ParameterBindingValidationException: Cannot validate argument on parameter 'Property'. ... ---> System.Management.Automation.ValidationMetadataException: The argument "Message" does not belong to the set "ModuleName,Namespace,OutputType,Count, HelpUri,Name,CommandType,ResolvedCommandName,DefaultParameterSet,CmdletBinding, Parameters" specified by the ValidateSet attribute. at System.Management.Automation.ValidateSetAttribute.ValidateElement(Object element) at System.Management.Automation.ValidateEnumeratedArgumentsAttribute.Validate(...) ... scriptStackTrace: at Get-WACSMCrashEvents, C:\ProgramData\WindowsAdminCenter\Modules\Microsoft.SME.ServerManager
Microsoft.SME.ServerManager.psm1: line 546
The failing request payload confirms the call:
{ "command": "Get-WACSMCrashEvents", "module": "Microsoft.SME.ServerManager", "parameters": { "fromDialog": false } }
Root cause (isolated independently of the WAC UI)
This reproduces even when calling the JEA endpoint directly with Invoke-Command, bypassing the browser and WAC gateway entirely — confirming this is a server-side extension code issue, not a front-end or RBAC-configuration problem.
Get-WACSMCrashEvents (line ~546 of Microsoft.SME.ServerManager.psm1) uses an unqualified Select-Object call:
Get-WinEvent -MaxEvents 5 -FilterHashtable @{...} -ErrorAction SilentlyContinue |
Select-Object Message, Properties, TimeCreated, LogName, ProviderName, Id, LevelDisplayName
Per Microsoft's own JEA documentation, a session created with SessionType = 'RestrictedRemoteServer' (which is what the Microsoft.Sme.PowerShell JEA endpoint uses) operates in NoLanguage mode and exposes only a small default command set, including a constrained proxy version of Select-Object:
"Sessions of this type operate in NoLanguage mode and only have access to the following default commands (and aliases): Clear-Host, Exit-PSSession, Get-Command, Get-FormatData, Get-Help, Measure-Object, Out-Default, Select-Object." — https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/jea/session-configurations
This built-in proxy carries a restricted ValidateSet on its -Property parameter (in this environment, one that appears scoped for Get-Command output properties), and this proxy takes precedence over the real, unconstrained Select-Object cmdlet inside the session unless the call is fully qualified with its source module, e.g.:
Microsoft.PowerShell.Utility\Select-Object Message, Properties, TimeCreated, ...
Notably, other functions in the same module already use this fully-qualified form correctly (e.g. the server inventory script uses Microsoft.PowerShell.Utility\Select-Object csName, Caption, ...), indicating this is a known pattern for the extension authors that was simply missed in Get-WACSMCrashEvents.
Gateway Version: 2606 2.7.5.21
Extension Version that's been used if it applies
*** The bug **
After enabling Role-Based Access Control (RBAC) and connecting as a non-administrator user assigned to a built-in Windows Admin Center role group (e.g. "Windows Admin Center Readers" or "Windows Admin Center Hyper-V Administrators"), the Server Manager Overview page fails to load server data. The notification panel shows:
To Reproduce
Steps to reproduce the behavior:
This can also be reproduced directly via PowerShell, without the browser, which isolates the issue to the extension code:
Expected behavior
The Server Manager Overview page should load server data successfully for users in the built-in Readers / Hyper-V Administrators roles, the same as it does for full local Administrators (who are not routed through the JEA-constrained session and therefore do not hit this proxy).
Screenshots & Additional context
Desktop/Server
Additional context
Full remote exception detail:
System.Management.Automation.ParameterBindingValidationException: Cannot validate argument on parameter 'Property'. ... ---> System.Management.Automation.ValidationMetadataException: The argument "Message" does not belong to the set "ModuleName,Namespace,OutputType,Count, HelpUri,Name,CommandType,ResolvedCommandName,DefaultParameterSet,CmdletBinding, Parameters" specified by the ValidateSet attribute. at System.Management.Automation.ValidateSetAttribute.ValidateElement(Object element) at System.Management.Automation.ValidateEnumeratedArgumentsAttribute.Validate(...) ... scriptStackTrace: at Get-WACSMCrashEvents, C:\ProgramData\WindowsAdminCenter\Modules\Microsoft.SME.ServerManager
Microsoft.SME.ServerManager.psm1: line 546
The failing request payload confirms the call:
{ "command": "Get-WACSMCrashEvents", "module": "Microsoft.SME.ServerManager", "parameters": { "fromDialog": false } }
Root cause (isolated independently of the WAC UI)
This reproduces even when calling the JEA endpoint directly with Invoke-Command, bypassing the browser and WAC gateway entirely — confirming this is a server-side extension code issue, not a front-end or RBAC-configuration problem.
Get-WACSMCrashEvents (line ~546 of Microsoft.SME.ServerManager.psm1) uses an unqualified Select-Object call:
Per Microsoft's own JEA documentation, a session created with SessionType = 'RestrictedRemoteServer' (which is what the Microsoft.Sme.PowerShell JEA endpoint uses) operates in NoLanguage mode and exposes only a small default command set, including a constrained proxy version of Select-Object:
This built-in proxy carries a restricted ValidateSet on its -Property parameter (in this environment, one that appears scoped for Get-Command output properties), and this proxy takes precedence over the real, unconstrained Select-Object cmdlet inside the session unless the call is fully qualified with its source module, e.g.:
Microsoft.PowerShell.Utility\Select-Object Message, Properties, TimeCreated, ...Notably, other functions in the same module already use this fully-qualified form correctly (e.g. the server inventory script uses Microsoft.PowerShell.Utility\Select-Object csName, Caption, ...), indicating this is a known pattern for the extension authors that was simply missed in Get-WACSMCrashEvents.