PowerShell JEA (Just Enough Administration): How to Give Help Desk PowerShell Access Without Making Them Domain Admins

The role capability file (.psrc) defines what a user can do in the JEA session.

# Create the role capability file directory structure
# JEA looks for role capabilities in: <module>\RoleCapabilities\
$modulePath = 'C:\Program Files\WindowsPowerShell\Modules\JEA-HelpDesk'
New-Item -ItemType Directory -Path "$modulePath\RoleCapabilities" -Force

# Create the role capability file
New-PSRoleCapabilityFile -Path "$modulePath\RoleCapabilities\HelpDesk.psrc"

Edit the generated .psrc file to define the allowed capabilities:

# HelpDesk.psrc -- allowed operations for tier 1 help desk
@{
    # PowerShell edition
    SchemaVersion = '2.0.0.0'
    GUID = '<generate-with-New-Guid>'
    Author = 'Security Team'
    Description = 'Help desk tier 1: user unlock, password reset, service restart'

    # Allow specific commands (Cmdlet name + allowed parameters)
    VisibleCmdlets = @(
        # Unlock AD accounts
        @{ Name = 'Unlock-ADAccount'; Parameters = @{ Name = 'Identity' } },
        # Reset AD passwords (force change at next logon)
        @{ Name = 'Set-ADAccountPassword'; Parameters = @{ Name = 'Identity'; Name = 'Reset'; Name = 'NewPassword' } },
        # Get user info (read-only)
        'Get-ADUser',
        'Get-ADGroupMember',
        # Restart specific services
        @{ Name = 'Restart-Service'; Parameters = @{ Name = 'Name'; ValidateSet = @('Spooler', 'W32Time', 'BITS') } },
        @{ Name = 'Get-Service'; Parameters = @{ Name = 'Name' } },
        # Clear print queue
        @{ Name = 'Clear-PrintJobList'; Parameters = @{ Name = 'PrinterName' } },
        'Get-Printer'
    )

    # Allow these modules (imports their exported commands, filtered by VisibleCmdlets)
    ModulesToImport = @('ActiveDirectory', 'PrintManagement')

    # Visible functions (you can define custom functions here)
    VisibleFunctions = @('Get-HelpDeskTicketStatus')

    # Visible aliases (tab completion and shorthand)
    VisibleAliases = @()

    # Visible providers (filesystem paths visible in session)
    # Leave empty to restrict all drive access
    VisibleProviders = @()
}

The session configuration file (.pssc) ties roles to AD groups and sets the virtual account.

# Create the session configuration file
New-PSSessionConfigurationFile `
    -Path 'C:\JEA\HelpDeskEndpoint.pssc' `
    -SessionType RestrictedRemoteServer `
    -RunAsVirtualAccount `
    -RoleDefinitions @{
        'DOMAIN\HelpDesk-Tier1' = @{ RoleCapabilities = 'HelpDesk' }
        'DOMAIN\ServerAdmins' = @{ RoleCapabilities = 'HelpDesk', 'ServerManagement' }
    } `
    -TranscriptDirectory 'C:\JEA\Transcripts' `
    -LanguageMode NoLanguage
    # NoLanguage: blocks arbitrary PowerShell code; only pre-defined commands allowed
    # Use ConstrainedLanguage for slightly more flexibility (allows some PowerShell features)

# Register the JEA endpoint on the target machine
Register-PSSessionConfiguration `
    -Name 'JEA-HelpDesk' `
    -Path 'C:\JEA\HelpDeskEndpoint.pssc' `
    -Force

# Verify registration
Get-PSSessionConfiguration -Name 'JEA-HelpDesk' | Format-List

Set transcript directory permissions:

# Transcripts should be writable by the virtual account, not the connecting user
# Virtual accounts write as NT AUTHORITY\SYSTEM or the machine account
$acl = Get-Acl 'C:\JEA\Transcripts'
# Deny the JEA endpoint users the ability to delete or modify transcript files
# Grant only the security team / SIEM collector read access

For server fleet deployment, use DSC or Group Policy to push the module and session configuration:

# Copy the module to all target servers
$servers = @('server01', 'server02', 'fileserver01')
foreach ($server in $servers) {
    Copy-Item -Path 'C:\Program Files\WindowsPowerShell\Modules\JEA-HelpDesk' `
        -Destination "\\$server\C$\Program Files\WindowsPowerShell\Modules\JEA-HelpDesk" `
        -Recurse -Force
    Invoke-Command -ComputerName $server -ScriptBlock {
        Register-PSSessionConfiguration -Name 'JEA-HelpDesk' -Path 'C:\JEA\HelpDeskEndpoint.pssc' -Force
    }
}

Connect as a help desk user:

# Interactive session
Enter-PSSession -ComputerName 'server01' -ConfigurationName 'JEA-HelpDesk'
# Prompt shows: [server01]: PS>
# User is now in the JEA constrained session

# Try an allowed command
Unlock-ADAccount -Identity 'jsmith'
# Should succeed

# Try a non-allowed command
Get-ADDomain
# Error: The term 'Get-ADDomain' is not recognized as the name of a cmdlet...

# Try to break out of the constrained session
[System.Reflection.Assembly]::LoadWithPartialName('System')
# Error: You cannot call methods on null-valued expressions (NoLanguage mode blocks this)

# Exit the session
Exit-PSSession

Invoke a specific command without an interactive session:

# Run a single JEA command from a script or ticketing system integration
Invoke-Command -ComputerName 'server01' -ConfigurationName 'JEA-HelpDesk' -ScriptBlock {
    Unlock-ADAccount -Identity $using:username
}

Verify what a connecting user can see in the JEA session:

# From within a JEA session:
Get-Command
# Returns only the allowed commands for the connecting user's role

Get-PSSessionCapability -ConfigurationName 'JEA-HelpDesk' -Username 'DOMAIN\helpdesk1'
# From outside: shows what a specific user will be able to do

Help desk account management:

# Allow: unlock account, reset password, read user info
VisibleCmdlets = @(
    @{ Name = 'Unlock-ADAccount'; Parameters = @{ Name = 'Identity' } },
    @{ Name = 'Set-ADAccountPassword'; Parameters = @{ Name = 'Identity'; Name = 'Reset'; Name = 'NewPassword' } },
    'Get-ADUser',
    @{ Name = 'Enable-ADAccount'; Parameters = @{ Name = 'Identity' } },
    @{ Name = 'Disable-ADAccount'; Parameters = @{ Name = 'Identity' } }
)

Service management (on-call team):

# Allow restarting a specific list of services
VisibleCmdlets = @(
    @{ Name = 'Restart-Service'; Parameters = @{ Name = 'Name'; ValidateSet = @('AppPool1', 'W3SVC', 'SQLServerAgent') } },
    @{ Name = 'Start-Service'; Parameters = @{ Name = 'Name'; ValidateSet = @('AppPool1', 'W3SVC') } },
    @{ Name = 'Stop-Service'; Parameters = @{ Name = 'Name'; ValidateSet = @('AppPool1', 'W3SVC') } },
    'Get-Service', 'Get-EventLog'
)

DNS management (network team, not domain admins):

ModulesToImport = @('DnsServer')
VisibleCmdlets = @(
    'Get-DnsServerZone', 'Get-DnsServerResourceRecord',
    @{ Name = 'Add-DnsServerResourceRecord'; Parameters = @{ Name = 'ZoneName'; Name = 'A'; Name = 'Name'; Name = 'IPv4Address' } },
    @{ Name = 'Remove-DnsServerResourceRecord'; Parameters = @{ Name = 'ZoneName'; Name = 'Name'; Name = 'RRType'; Name = 'Force' } }
)

Review transcripts for audit:

# Find all transcripts from a specific user
Get-ChildItem 'C:\JEA\Transcripts' | Where-Object {
    (Get-Content $_.FullName -First 20) -match 'DOMAIN\\helpdesk1'
}

# Parse a transcript for specific commands
Select-String -Path 'C:\JEA\Transcripts\*.txt' -Pattern 'Set-ADAccountPassword'