Sometimes it is the easiest way to analyze/fix userprofile related issues by deleting the userprofile of the affected user...

It would be awesome if Honolulu could list all userprofiles, and allow to delete or "disable" them if the userprofile is currently not in use.

What do I mean with "disable/enable" a userprofile?
Currently we use a script to rename existing userprofiles (like "UserId_disabled"), so a new profile will be loaded when the user logs on to the computer next time.

If the problem is not fixed with the newly created userprofile, the user logs off again, the admin "restore" the previous userprofile (delete the new one, and rename the previous user profile to it's original Name)

Querying active directory domain for list of machines, when adding servers to the gateway is working properly.
Managing gateway access, can't add any allowed groups (local or domain) - Gateway users or administrators.

Message:
Couldn't add security group
Error: The LDAP server is unavailable.
localhost

Event log:
500 - LdapException: The LDAP server is unavailable.
Stack trace: at System.DirectoryServices.Protocols.LdapConnection.Connect()
at System.DirectoryServices.Protocols.LdapConnection.SendRequestHelper(DirectoryRequest request, Int32& messageID)
at System.DirectoryServices.Protocols.LdapConnection.SendRequest(DirectoryRequest request, TimeSpan requestTimeout)
at System.DirectoryServices.AccountManagement.PrincipalContext.ReadServerConfig(String serverName, ServerProperties& properties)

WAC installed as gateway on Windows Server 2016 (OS Build 14393.2969) - connected to domain
WAC version 1904.1 & 1906 preview
Acces to WAC from Windows 10 1803 build 17134.829
Browsers Edge,Firefox 67, Chrome 75

https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/user-access-control#active-directory-or-local-machine-groups

Active Directory or local machine groups

By default, Active Directory or local machine groups are used to control gateway access. If you have an Active Directory domain, you can manage gateway user and administrator access from within the Windows Admin Center interface.

On the Users tab you can control who can access Windows Admin Center as a gateway user. By default, and if you don't specify a security group, any user that accesses the gateway URL has access. Once you add one or more security groups to the users list, access is restricted to the members of those groups.

If you don't use an Active Directory domain in your environment, access is controlled by the Users
and Administrators
local groups on the Windows Admin Center gateway machine.

Step1: Add new AD group to access list:

Step2: Success notification:

Step3: List of groups:

Problem:

After adding new AD security gruop to access list it takes no effect. It still uses local groups for WAC access. Is this known bug or what?

In order to offer Windows Admin Center ( WAC ) as a product internally at our company, we are investigating whether it is possible to add groups programmatically ( e.g. via a script ) instead of manually as the case now where one has to go via the route Settings > Access > Allowed Groups. We did not find any script or API as part of the WAC installation or any documentation about it anywhere.

On investigating the calls being made by WAC via the browser console, we discovered the following :

The call being made to add an allowed group in WAC is to the SecurityGroup endpoint. The URI of the call contains a UUID which is derived from the group name and seems to be tied locally to the machine. Thus for example adding a group Users on machine A and machine B will generate 2 different UUIDs. The formula or function call to generate these IDs is not provided anywhere and is being generated internally by the product. On a Win 2016 machine hostA, the call URI is :

https://hostA/api/gateway/access/users/VXNlcnM/type/SecurityGroup

But on the IPC machine hostB, the corresponding URI is :

https://hostB/api/gateway/access/users/hGKwAer/type/SecurityGroup

The method for generating the IDs : VXNlcnM or hGKwAer from the group Users is unknown. It is possible that the hostname/IP/AD connection details are also involved. On Azure machines where a local AD connection does not exist, the SecurityGroup call never happens, this fact supports the theory that the AD is polled before the SecurityGroup call is made. It is also possible that AD details, maybe the bind DN of the group is used to construct the ID.

This particular API is essential in order to automate the provisioning of WAC for various clients internal to our company, without it, we will need a manual step in the provisioning pipeline where someone has to manually log onto the WAC instance and add all the required groups. Any request for allowing additional groups access or denying existing groups will also require manual work.