How to Configure a Just Enough Administration Endpoint
Applies to: Windows Server 2019, 2022 and 2025.
JEA provides constrained PowerShell endpoints where users can run only approved commands under a controlled virtual identity.
Automation magnifies both correct and incorrect actions. Use source control, peer review, test environments and least privilege. Visit networkmanager.info.
Prerequisites
- Define tasks, commands and parameters.
- Create an AD group for operators.
- Test in a lab.
- Enable transcription and logging.
Procedure
Step 1: Create role capability path
Prepare module structure.
New-Item -ItemType Directory -Path 'C:\Program Files\WindowsPowerShell\Modules\CorpJEA\RoleCapabilities' -ForceStep 2: Create capability
Allow a small command set.
New-PSRoleCapabilityFile -Path 'C:\Program Files\WindowsPowerShell\Modules\CorpJEA\RoleCapabilities\ServiceOperator.psrc' -VisibleCmdlets 'Get-Service',@{Name='Restart-Service';Parameters=@{Name='Name';ValidateSet='Spooler'}}Step 3: Create session configuration
Map AD group to role.
New-PSSessionConfigurationFile -Path C:\ProgramData\CorpJEA.pssc -SessionType RestrictedRemoteServer -RunAsVirtualAccount -RoleDefinitions @{'CORP\Service Operators'=@{RoleCapabilities='ServiceOperator'}} -TranscriptDirectory 'C:\ProgramData\JEA-Transcripts'Step 4: Register endpoint
Publish configuration.
Register-PSSessionConfiguration -Name 'Corp-ServiceOps' -Path C:\ProgramData\CorpJEA.pssc -ForceStep 5: Test as operator
Connect and verify allowed and denied commands.
Enter-PSSession -ComputerName SRV-APP01 -ConfigurationName Corp-ServiceOpsVerification
Inspect endpoint and use Test-PSSessionConfigurationFile.
Get-PSSessionConfiguration -Name Corp-ServiceOps
Test-PSSessionConfigurationFile C:\ProgramData\CorpJEA.psscRollback
Disable-PSSessionConfiguration for immediate rollback, then Unregister-PSSessionConfiguration after confirming no operations depend on it.
Security notes
Review role capabilities like application code; overly broad parameters can bypass the intended restriction.
Official references
Explore Netcloud24 Canada.
