How to pass "ajax error 500" with Windows Admin Center 24.10 (v2)

I spent way too long on this, but the post from @Randall Okwei as well as a lot of trial and error allowed me to get this working without changing the service account from Network Service to Local System. This has to be some kind of bug in WAC. Anyway, hopefully the below helps some folks that are stuck, and maybe someone else facing this issue can pinpoint which step below actually fixed things:

1. When the ajax 500 error appeared, I noticed the following Schannel error in the System event log:

   A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030D. The internal error state is 10001. The SSPI client process is WindowsAdminCenter (PID: 9948).

   If you are importing a PEM cert, you may want to try this article to convert your certificate to PFX via OpenSSL. I already had a PFX cert and this article ultimately didn't fix things for me, but may be useful for some.
2. I noticed the self-signed cert (which works properly under the Network Service account) has Basic Constraints enabled. So, within my Windows CA, I duplicated the Web Server template, changed the compatibility to Server 2008 R2 and enabled the extension "Basic Constraints" and made it critical.
3. Probably the most important step: With a cert from the new template imported into my Personal computer store, I right-clicked the cert --> All Tasks --> Managed Private Keys... I added the following permissions to match self-signed cert:
   1. Network Service account for the local machine: Full Control
   2. Users group for local machine: Read
4. Probably the second most important step: Reinstall WAC and point to the new certificate. I was unable to get the Set-WACCertificateSubjectName command to actually apply the new cert. The Set-WACCertificateAcl gave an error in the WAC configuration log that was unfortunately overwritten during the reinstall, but it implied it couldn't read the private key properly.

I would recommend starting with steps 3 and 4 to see if that fixes it, otherwise it appears the Basic Constraints extension is required. I was NOT able to get this to work just by changing the private key permissions on an existing setup that was broken, which makes me think the private key permissions change plus the reinstall is what will fix it.

@Henry ofor, Thanks, it worked.

I had this same ajax 500 error after upgrading from 2311 to 2410. I reinstalled WAC using the self-signed certificate (expire in 60 days) and am no longer getting ajax 500 errors. Seems to me that this is a CERTIFICATE issue per se. WAC didn't seem to like the published certificate and associated permissions for the "NETWORK SERVICE".

Based on this error and what I can see, here are some more specific troubleshooting steps:

1. Check the WAC logs: Look in %ProgramData%\Microsoft\Windows Admin Center\Logs for detailed error logs that might reveal what's causing the 500 error.
2. Test PowerShell Remoting specifically:

Enter-PSSession -ComputerName hyperpilvi

This will verify if basic PS remoting works between your client and server.

1. Check the HTTP listener configuration:

winrm enumerate winrm/config/listener

Make sure both HTTP and HTTPS listeners are properly configured.

1. Verify that your TLS certificate is properly trusted by the client machine.
2. Try modifying the WAC gateway to use HTTP temporarily (for testing only):

powershell

1. Since this is a v2 build (2.4.2.1, 2410), it's possible there are compatibility issues with Windows Server 2019. Have you considered testing with a more recent OS version like Windows Server 2022?
2. Check if there are any constraints with accessing a Server Core installation - though this shouldn't be an issue as WAC is designed to work with it.
3. Try removing and readding the connection with different credentials or using a domain account if available.

Find the machine certificate Make sure that the subject is not blank, as well manage the keys by adding the network service account with full control.