Just-Enough-Administration (JEA) in Windows Server 2016/2019

 

PowerShell: Implementing Just-Enough-Administration (JEA), Step-by-Step

Video Link:   https://youtu.be/2bTHpj7kvwc

 *****************Configuration in Server ***************

1st Step:

1. New-PSSessionConfigurationFile -Path 'C:\Program Files\WindowsPowerShell\spooler_conf.pssc'

2. notepad  'C:\Program Files\WindowsPowerShell\spooler_conf.pssc

# Author of this document

Author = 'Mushfiq'

# Session type defaults to apply for this session configuration. Can be 'RestrictedRemoteServer'                        (recommended), 'Empty', or 'Default'

SessionType = 'RestrictedRemoteServer'

# Directory to place session transcripts for this session configuration

TranscriptDirectory = 'C:\Transcripts\'

# Whether to run this session configuration as the machine's (virtual) administrator account

RunAsVirtualAccount = $true

# User roles (security groups), and the role capabilities that should be applied to them when applied to a session

RoleDefinitions = @{ 'itbd.local\Spooler_Admins' = @{ RoleCapabilities = 'Spooler_Admins' }} 

2nd Step(Creating a folder for JEA):

New-Item -Path 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities' -ItemType Directory

3rd Step(Creating the PS Role Capability File for the Spooler Admins (psrc file):

1. New-PSRoleCapabilityFile -Path 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities\spooler_admins.psrc'

2. notepad 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities\spooler_admins.psrc'

# Cmdlets to make visible when applied to a session

VisibleCmdlets = @{ Name = 'Restart-Service'; Parameters = @{ Name = 'Name'; ValidateSet = 'Spooler'}}

# External commands (scripts and applications) to make visible when applied to a session

VisibleExternalCommands = 'C:\Windows\System32\Whoami.exe'

4th Step(Registering the Configuration):

a. Create a group named "Spooler_Admins". Create an user who will member of Spooler_Admins group

b. Register-PSSessionConfiguration -Name Spooler_Admins -Path 'C:\Program Files\WindowsPowerShell\spooler_conf.pssc'

c. Restart-Service WinRM

********Configuration in Client ********

1. Login as member user of Spooler_Admins group into a domain member machine

2. Open the powershell & execute below command

a. Enter-PSSession -ComputerName ADDS -ConfigurationName spooler_admins

                *** Here, ADDS is my Domain server's name  &  Spooler_admins is cretaed group

b. Get-Command 

*** See, you will able to see only specified command

c. Restart-Service spooler

*** Here you will be restart the specified service, not other service

d. Restart-Service lmhosts

*** You will not be able to restart this service

e. whoami

*** You will be able to execute this command since you have permission to do this as external command