The Danger of Domain Admins
In traditional Windows Server environments, the principle of least privilege is exceptionally difficult to enforce when it comes to system administration. If a junior helpdesk technician needs to restart the Microsoft Exchange service or clear a DNS cache on a production server, they usually need to execute those commands via an elevated PowerShell session.
Historically, the only way to allow a junior tech to run an administrative PowerShell command on a server was to add them to the local “Administrators” group of that server, or worse, make them a Domain Admin. This violates every security framework in existence. A compromised helpdesk account suddenly has the keys to the entire corporate kingdom.
To solve this, Microsoft introduced Just Enough Administration (JEA). JEA is a security technology that enables delegated administration for anything managed by PowerShell. It allows IT administrators to build highly restricted PowerShell endpoints. When a junior tech connects to this endpoint, they do not get a full shell. They only get access to a strictly defined whitelist of commands (e.g., they can run Restart-Service, but only if the target is MSExchange).
Step 1: Understanding the JEA Architecture
JEA requires two primary configuration files to function:
- Role Capability File (.psrc): This dictates what a user can do. It contains the strict whitelist of allowed cmdlets, functions, and specific parameters.
- Session Configuration File (.pssc): This dictates who can connect to the endpoint and assigns them the specific Role Capabilities. It also determines how the commands are executed in the background (usually by creating a temporary, invisible Virtual Account that has local admin rights).
Step 2: Creating the Role Capability File
First, we must define what the helpdesk is allowed to do. We want them to be able to restart the IIS web service, but absolutely nothing else.
Open an elevated PowerShell prompt and create a new Role Capability file:
New-PSRoleCapabilityFile -Path "C:\JEA_Roles\Helpdesk_WebAdmin.psrc"Open this file in Notepad or the PowerShell ISE. It is a structured text file. You must scroll down to the VisibleCmdlets section and define the strict boundaries.
VisibleCmdlets = 'Restart-Service'If you leave it like this, they can restart any service. We must restrict the parameters.
VisibleCmdlets = @{ Name = 'Restart-Service'; Parameters = @{ Name = 'Name'; ValidateSet = 'W3SVC' } }This explicitly states: The user can run Restart-Service, but the -Name parameter must equal W3SVC (the IIS service). If they try Restart-Service -Name Spooler, JEA will block it and throw an error.
Step 3: Creating the Session Configuration File
Now, we must create the endpoint that the helpdesk will connect to and assign them the role we just created.
New-PSSessionConfigurationFile -Path "C:\JEA_Configs\WebEndpoint.pssc"Open the file and modify the following critical sections:
# Use a virtual, temporary administrator account to execute the commands
RunAsVirtualAccount = $true
# Define who can connect and what role they get
RoleDefinitions = @{
'CONTOSO\HelpdeskGroup' = @{ RoleCapabilities = 'Helpdesk_WebAdmin' }
}Because RunAsVirtualAccount is set to true, the junior tech does not need to be an administrator. When they connect, PowerShell instantly spins up a temporary, invisible local admin account, executes the Restart-Service command under that high-privileged context, and destroys the virtual account the moment the session ends.
Step 4: Registering the JEA Endpoint
With both files created, you must register the configuration on the target server. This creates a custom PowerShell Remoting endpoint.
Register-PSSessionConfiguration -Name "HelpdeskWebManagement" -Path "C:\JEA_Configs\WebEndpoint.pssc" -ForceThis command will automatically restart the WinRM (Windows Remote Management) service to apply the new listener.
Step 5: Testing the Delegated Access
Now, log into a workstation as a standard, non-admin user who belongs to the CONTOSO\HelpdeskGroup.
Attempt to establish a PowerShell remoting session to the server, specifically requesting the custom JEA endpoint:
Enter-PSSession -ComputerName WebServer01 -ConfigurationName "HelpdeskWebManagement"The prompt will change to indicate you are connected to the remote server. However, you are in a highly restricted sandbox.
If you type Get-Command, you will notice that out of the thousands of standard PowerShell commands, only a handful (like Exit-PSSession) and your explicitly whitelisted Restart-Service are available.
If the technician runs:
Restart-Service -Name W3SVCThe command will succeed perfectly, restarting IIS via the invisible Virtual Account.
If they attempt anything malicious or outside their scope:
Restart-Service -Name WinRM
Stop-Process -Name explorerPowerShell will immediately throw a red error stating the command or parameter is not recognized in the current constrained runspace.
Conclusion
Just Enough Administration (JEA) is the ultimate implementation of Zero Trust architecture for Windows Server administration. By utilizing constrained endpoints and Virtual Accounts, IT architects can completely revoke standing administrator privileges from helpdesk staff, entirely eliminating the risk of lateral movement while still empowering them to perform their daily operational duties.