SCCM Client extension for Windows Admin Center

Update: v1.2 released, read more here.

Update: v1.1 released, read more here

Have you tried out the Windows Admin Center (WAC) yet? If not, you most definitely should. For those that may not yet be aware of it, Windows Admin Center is a modern take on many of the Windows OS focused infrastructure administration tools that we’ve been so accustomed to over the past decade. Although you should be careful not to bill it as a full replacement, WAC does support many of the administrative tasks historically accomplished via the Microsoft Management Console (MMC). What’s more, you can have all of this for the low price of FREE! You can learn more about the Windows Admin Center here.

One of the best features of Windows Admin Center is its ability to be further extended to perform a variety of useful administrative tasks not included with WAC out of the box. While you can always load extensions from a local directory making it easy to handle extensions internal to your business, there is also a list of available extensions readily found within the settings menu. Extension authors have the option of submitting their self-created WAC extension creations for inclusion in this master list. Once the extension is fully vetted, Microsoft will publish the extension to the extension feed making it available for all WAC Users around the globe.

I use WAC quite often and recommend it to everyone. I am also often working with Configuration Manager clients. I usually manage the clients remotely, but in some cases I must log on locally to one or more to troubleshoot or accomplish a task. There are several solutions out there to handle some of the situations requiring direct logon, but since I am using WAC anyway, I wanted the ability right within that for the convenience and for the added security. Windows Admin Center lives on top of WinRM, so I get an encrypted, Kerberos authenticated connection for my work.

The WAC extension I wrote is now live in the extension feed and available for everybody to use. To use, open WAC and click on the settings button at the top right.

Click on Extensions on the left side below the Gateway section

You will now see a list of extensions available for install. Click on the Configuration Manager Client line then click Install at the top.

You will see WAC reload and then you should be ready to use the new extension as well as a variety of other useful extensions available for use.

Once you connect WAC to a client, if the client has the SCCM Client aka CCMExec aka SMS Agent Host service running, you will see the Configuration Manager Client extension listed as an available tool.  Just click it to get started.

The Configuration Manager Client extension primarily mimics the capabilities of the Configuration Manager Control Panel applet, so the available options should look very familiar.

If you happen to be a user of the Microsoft Premier offering for Configuration Manager Client Health, you will see additional information on the general tab. There is no mention of this functionality within the tool if you have not purchased that offering in case you aren’t seeing it, so your screenshot may not be 100% identical to the one above..

One feature that is really useful about this extension is the ability to remotely view Configuration (baseline) reports. While it is always easy to see the results via your standard SCCM SSRS reports, when troubleshooting an issue. I often do not want to wait for the information to flow through the channels and into those reports – I would rather view the local version to see what the client is reporting immediately after it evaluates its policies and baselines. This functionality is available in the control panel applet, but requires a user with local administrator privileges to be logged in. This means a greater (and costlier) interruption to an end-user as I must ask them to log off just so I can log in and generate the control panel compliance item report. By building this same functionality into the Windows Admin Center extension, I do not have to interrupt the user and they won’t even know I am pulling the report. There is one other tool that I am aware of that can accomplish this – ConfigMgr Remote Compliance from Trevor Jones. I originally reached out to Trevor about reusing his functionality and he blessed the idea. In the end, I went in another direction, but Trevor’s application is still the inspiration for adding this function and I thank him for that.

To view a Compliance Baseline report, click to the Configurations tab, select the desired baseline, and select View report.

This will load the report and you can view the details. I did change things slightly from the built-in report – items that are not detected but optional are displayed in blue, while non-detected and required remain yellow. Items that are not applicable are displayed as gray and are moved to the bottom of the list. I found the report easier to read at a glance versus the built-in reports where non-compliant, not applicable, and all not detected configuration items share the same resulting color. If I select a line in the report, a pane opens at the bottom to display the details of the non-compliance.

The final improvement over the Control Panel applet; one that really wouldn’t make sense for the locally run applet anyway, is the ability to preview or download logs. Simply select a log and choose to preview or download it. Most of the logs are responsive, but connection speeds and log size will affect the speed at which the preview pane opens. Additionally, I added the ability to pull the WindowsUpdate.log. As this requires building the log from .etl files, the Windows Update log currently loads slower than I would like.

The preview is a snapshot of the log at the time you click it, so new lines will not be automatically loaded without clicking refresh. Like CMTrace, the log preview highlights log entries of types 2 and 3. Warnings and errors are often, but not always, tagged with these log entry types. I point this out as the log preview does not look at keywords and highlight those lines in the same manner that CMTrace does. There is also the ability to filter at the top right. Selecting a log brings up the pane at the bottom with a little more detail. If the log entry contained an error code, that error code is looked up for you and automatically highlighted.

I do have some ideas on things to add in the future, but my goal for v1 was to mimic the functionality of the Control Panel applet and adapt the extension for remote use where applicable.

If you have any feedback, suggestions, or find anything not behaving as expected, please reach out to me.

I hope all of you find this Windows Admin Center extension valuable, and I highly recommend you at least give the Windows Admin Center a try with, or without, the Configuration Manager Client extension.