{"id":67620,"date":"2016-09-05T15:45:08","date_gmt":"2016-09-05T15:45:08","guid":{"rendered":"https:\/\/www.simple-talk.com\/?p=67620"},"modified":"2026-05-08T15:12:56","modified_gmt":"2026-05-08T15:12:56","slug":"powershell-just-enough-administration","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/sysadmin\/powershell\/powershell-just-enough-administration\/","title":{"rendered":"PowerShell Just Enough Administration (JEA): Role Capabilities, Session Configurations, and Constrained Endpoints for Least-Privilege Admin"},"content":{"rendered":"\n
\n
\n\n

In summary:<\/strong> PowerShell Just Enough Administration (JEA) is a Windows security feature that enables least-privilege delegated administration. Users can run a specific allow-listed set of PowerShell commands with elevated privileges, without<\/em> granting them full local or domain administrator rights. <\/b><\/p>\n\n<\/div>\n<\/div> \n\n\n

Example scenario: <\/b>a helpdesk analyst needs to restart services on application servers but shouldn’t have admin access to those servers. Traditional approaches (add to local admins group, use runas, grant specific service rights via GPO) give too much or aren’t granular enough. JEA solution: define a role capability (which commands this role can run, with which parameters, against which targets), expose it via a session configuration as a constrained PowerShell remoting endpoint, and grant users access.<\/p>\n\n\n\n

When the user connects via Enter-PSSession -ConfigurationName YourJEAEndpoint, they get a constrained shell that only allows the permitted commands – they can’t launch cmd, can’t run Invoke-Expression, can’t escape the allowlist. <\/b><\/p>\n\n\n\n

Commands run under a virtual admin account (or other designated service account), not the user’s own identity, so they have the access needed without the user being an admin. Introduced in Windows Management Framework 5.0, improved in later releases.<\/p>\n\n\n\n

Core components: role capability .psrc files (what commands are allowed), session configuration .pssc files (who gets which role, transcription settings, virtual account configuration), JEA endpoint deployment (Register-PSSessionConfiguration -Path …). Transcripts capture everything JEA users do for audit. Widely used for delegating SQL Server admin, AD account management, Exchange admin, file server admin to ops teams without making them full admins.<\/p>\n\n\n\n

Continue reading to learn everything you need to know about PowerShell Just Enough Administration (JEA).<\/strong><\/p>\n\n\n\n

What is JEA?<\/h2>\n\n\n\n

PowerShell, with its numerous cmdlets, has made System administration very simple, but there are two problems still to solve before we can take advantage of this simplicity to allow a wider group of users to perform system management. The first problem is to prevent a user from accidentally harming another part of the system, and the other problem is security.<\/p>\n\n\n\n

The whole problem of managing access rights via PowerShell is sometimes forgotten or set aside in order to simplify the administration task. When you allow someone to access your system, you increase the risk of a user accidentally damaging part of the system, or the risk of a security breach. You can imagine what would happen if the administrator\u2019s credentials were stolen while a sysadmin was performing actions as administrator. Once that happens, your entire system is vulnerable.<\/p>\n\n\n\n

Basically, you need to assign just the sufficient rights to the user to achieve the particular admin task, and no wider rights than that. This is where “Just Enough Administration” intervenes – also known as \u201cJEA\u201d. You certainly know “Role-based access control” (RBAC)? RBAC is an approach to restricting system access to authorized users of a particular role. JEA provides a RBAC platform for Windows PowerShell that authorizes users to perform the rights to perform specific actions on your machines without giving them blanket administrative rights.<\/p>\n\n\n\n

JEA works as a whitelist and not as a blacklist. This means that you must explicitly allow the actions that your users will be able to perform.<\/p>\n\n\n\n

I have thus summarized this in a diagram of the JEA concept. Take the example of a helpdesk operator who needs to reset the Active Directory account of a blocked user. Our operator will use PowerShell and its numerous cmdlets in order to resolve this incident. But this means that he can also delete the user account or restart the domain controller through ignorance or by a simple error.<\/p>\n\n\n\n

So, to avoid this kind of damage, we will use JEA to limit the actions of our operator by allowing him to use some pre-defined cmdlets.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Figure 1 \u2013 Just Enough Administration<\/p>\n\n\n\n

The main advantages of JEA:<\/p>\n\n\n

\n