PowerShell JEA
Just Enough Administration creates a constrained remoting endpoint where a user can run a short list of commands, with specific parameters and specific values, and nothing else. The session runs under a privileged virtual account while the user themselves stays unprivileged.
Documentation: Microsoft Learn
Overview
That is the point worth understanding. Instead of granting someone service-restart rights across the estate, you grant them access to an endpoint that can restart exactly the services you named. Their own account gains nothing.
Two files define it. A role capability file, .psrc, created by New-PSRoleCapabilityFile, lists visible cmdlets, functions and providers, and can pin parameters to allowed values. A session configuration file, .pssc, created by New-PSSessionConfigurationFile, maps security groups to role capabilities and sets RunAsVirtualAccount. Register-PSSessionConfiguration activates it.
Users then connect with Enter-PSSession -ComputerName host -ConfigurationName HelpDesk.
Test as a real member of the target group, not as an administrator. Administrators often bypass the constraints, so testing as yourself proves nothing about what a help desk operator can actually do.
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$caps = [pscustomobject]@{
RoleCapability = 'HelpDeskServices.psrc'
VisibleCmdlets = 'Restart-Service -Name Spooler, Print*'
RunAsVirtualAccount = $true
Endpoint = 'HelpDesk'
}
$caps | Format-List- Stage 1$caps
Positional values or no named parameters - Stage 2Format-List
Positional values or no named parameters
An example to inspect
Preview the example. Sign in for the full lesson and activities.
$caps = [pscustomobject]@{
RoleCapability = 'HelpDeskServices.psrc'
VisibleCmdlets = 'Restart-Service -Name Spooler, Print*'
RunAsVirtualAccount = $true
Endpoint = 'HelpDesk'
}
$caps | Format-ListWhat happens
This prints the four settings that define a minimal endpoint. VisibleCmdlets shows parameter and value constraints: the operator can restart Spooler or anything matching Print*, and no other service. RunAsVirtualAccount is what supplies the privilege without giving it to the user's own account.
Worth remembering
- A .psrc lists what is visible; a .pssc maps groups to roles.
- VisibleCmdlets can pin parameters to specific allowed values.
- RunAsVirtualAccount supplies privilege the user does not have.
- Connect with -ConfigurationName to reach the endpoint.
Primary documentation
Try it
Illustrative output · values vary by environment
Example reader
Inspect this page's example
Run supported commands against the practice data, or inspect the example without executing it.
Ready to inspect.
Prints the settings that define a constrained JEA endpoint.
Show reference output
Illustrative output · values vary by environment
RoleCapability : HelpDeskServices.psrc VisibleCmdlets : Restart-Service -Name Spooler, Print* RunAsVirtualAccount : True Endpoint : HelpDesk