Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
Just Enough Administration (JEA) is a security feature for PowerShell that limits what administrators can do. It follows the principle of least privilege, meaning users get only the permissions they absolutely need to perform their specific job, not full control over a server.
Setting up JEA requires two main types of files. First, you create a PowerShell session configuration file. This file acts as the blueprint for the JEA endpoint, defining its basic settings and linking to the roles that can use it. Second, you create one or more role capability files. These files are where you specify the exact PowerShell cmdlets, parameters, and modules that a particular role (like a backup operator or help desk technician) is allowed to use. By carefully choosing what goes into these files, you build a constrained environment where users can only run approved commands.
After the configuration files are created, you must install them on the servers you want to manage. You use PowerShell commands to register the session configuration. This process makes the JEA endpoint available on the server. Once registered, users connect to this special endpoint instead of a regular PowerShell session, which immediately restricts them to the capabilities you defined.
Two more layers of security are applied to lock down the endpoint. Security descriptors control who can connect to the JEA endpoint in the first place. You configure these to allow only specific user accounts or security groups. Virtual accounts control the permissions during the session. When a user connects, PowerShell creates a temporary, local virtual account for that session. This account has only the privileges needed for the session's tasks and disappears when the session ends. This prevents a compromised session from being used to attack other parts of the network.
The overall goal is to ensure that only authorized people can connect and that they can only do authorized things. By combining session configurations, role capabilities, security descriptors, and virtual accounts, you create a secure, task-focused administrative channel. This is essential for safely managing servers in hybrid environments where administrators might be connecting from the cloud to on-premises machines or vice versa.
StudyCerts
StudyCerts