The Danger of Broad Administrator Privileges
In traditional Windows Server administration, assigning permissions is often an all-or-nothing affair. If a junior administrator or helpdesk technician needs to restart the DNS Server service, they are typically added to the local Administrators group or given domain-wide privileges. This violates the principle of Least Privilege. Once a user has local admin rights, they can do anything: disable antivirus, read sensitive files, or install malicious software.
To solve this massive security vulnerability, Microsoft introduced Just Enough Administration (JEA). Built entirely on PowerShell Remoting, JEA allows you to lock down administrative access to a predefined set of specific PowerShell cmdlets, modules, and executables.
With JEA, a helpdesk user can connect to a server, run exactly three permitted commands (like Restart-Service restricted only to the dns service), and do absolutely nothing else. Furthermore, JEA uses “virtual accounts,” meaning the user does not need to possess actual administrative credentials to execute the command.
Step 1: Creating a Role Capability File (.psrc)
The first step in configuring JEA is defining what the user is allowed to do. This is done by creating a Role Capability file.
Open an elevated PowerShell prompt and create a new directory for your JEA modules:
New-Item -Path "C:\Program Files\WindowsPowerShell\Modules\JEARestartServices\RoleCapabilities" -ItemType Directory -ForceNext, generate a blank Role Capability file:
New-PSRoleCapabilityFile -Path "C:\Program Files\WindowsPowerShell\Modules\JEARestartServices\RoleCapabilities\HelpdeskDNS.psrc"Open the HelpdeskDNS.psrc file in a text editor like Notepad. You must explicitly define which cmdlets the user can run. More importantly, you can restrict the parameters of those cmdlets.
Find the VisibleCmdlets line and modify it:
VisibleCmdlets = @(
@{ Name = 'Restart-Service'; Parameters = @{ Name = 'Name'; ValidateSet = 'DNS', 'Spooler' } },
'Get-Service'
)This configuration dictates that the user can run Get-Service without restrictions, but they can only run Restart-Service if they are targeting the DNS or Spooler services. Attempting to restart any other service will result in an access denied error.
Step 2: Creating a Session Configuration File (.pssc)
While the Role Capability file defines what can be done, the Session Configuration file defines who can do it and how the session operates.
Create a new Session Configuration file:
New-PSSessionConfigurationFile -Path "C:\JEAConfig\DNS_Endpoint.pssc"Open the DNS_Endpoint.pssc file and configure the critical parameters:
- SessionType: Set this to
RestrictedRemoteServer. This locks the session down, hiding standard PowerShell commands likeGet-Processand mathematical operators. - RunAsVirtualAccount: Set this to
$true. This tells PowerShell to spawn a temporary, invisible local administrator account to execute the commands, meaning the connecting user does not need admin rights. - RoleDefinitions: This maps an Active Directory security group to the Role Capability file you created in Step 1.
Example configuration:
SessionType = 'RestrictedRemoteServer'
RunAsVirtualAccount = $true
RoleDefinitions = @{
'COMPANY\Helpdesk_Tier1' = @{ RoleCapabilities = 'HelpdeskDNS' }
}Step 3: Registering the JEA Endpoint
With both files created, you must register the JEA endpoint on the target server. This creates a specific connection point in Windows Remote Management (WinRM).
Register-PSSessionConfiguration -Name "HelpdeskDNS_Endpoint" -Path "C:\JEAConfig\DNS_Endpoint.pssc" -ForceThis command will restart the WinRM service to apply the new endpoint configuration.
Step 4: Testing the JEA Connection
To verify the configuration, log in to a workstation as a user belonging to the COMPANY\Helpdesk_Tier1 group (a standard domain user with no admin rights).
Use the Enter-PSSession cmdlet, specifying the custom -ConfigurationName:
Enter-PSSession -ComputerName "Server01" -ConfigurationName "HelpdeskDNS_Endpoint"Once connected, the prompt will change to indicate a remote session. If you attempt to run an unauthorized command, such as Stop-Process, PowerShell will return a red error stating the command does not exist.
If you attempt to run Restart-Service -Name W3SVC, it will fail because W3SVC is not in the allowed ValidateSet.
If you run Restart-Service -Name DNS, it will execute successfully, even though the connected user is not a local administrator.
Conclusion
Just Enough Administration (JEA) is a revolutionary security paradigm for Windows Server environments. By rigorously restricting the PowerShell remoting environment to specific cmdlets, parameters, and virtual accounts, organizations can empower helpdesk staff to perform critical maintenance tasks while entirely eliminating the risk of accidental damage or malicious privilege escalation.