JEA(Just Enough Administration)

  

We will done this configuration by PowerShell,

Step 1

Open PowerShell in Domain controller and execute

New-PSSessionConfigurationFile -Path 'C:\Program Files\WindowsPowerShell\spooler_conf.pssc'

notepad 'C:\Program Files\WindowsPowerShell\spooler_conf.pssc'

After executed that command also execute this command to open notepad filev

 

Now Change the notepad file that have open. You should not change the all, Just change I mention here

 

Step-2

To Creating a folder for JEA execute this command

New-Item –Path 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities' -ItemType Directory

 

 

Step-3 (Creating the PS Role Capability File for the Spooler Admins (psrc file):

Put this command in PowerShell

New-PSRoleCapabilityFile -Path 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities\spooler_admins.psrc'

After executed that command also execute this command to open notepad file

notepad 'C:\Program Files\WindowsPowerShell\Modules\JEA\RoleCapabilities\spooler_admins.psrc'

 

Now Change the notepad file that have open. You should not change the all, Just change I mention here

 

 

 

Step-4 (Registering the Configuration)

To execute this step you have to create a group and a user under the group

Put this command in PowerShell

Register-PSSessionConfiguration -Name Spooler_Admins -Path 'C:\Program Files\WindowsPowerShell\spooler_conf.pssc'

Restart the spooler service

Restart-Service WinRM

We have done our ADDS configuration now logon into client as Spooler_Admins users

Step-5

Login as member user of Spooler_Admins group into a domain member machine and Open the PowerShell & execute below command

Enter-PSSession -ComputerName ADDS -ConfigurationName spooler_admins

Get-Command

Restart-Service spooler

whoami