Getting started with Just Enough Administration (JEA)
summary
Claim is concrete JEA endpoints cut admin privilege by registering session configuration file plus a role capability file that whitelist cmdlets parameters and allowed values The demo uses PowerShell modules and splatting to build a print operator role that only allows Restart-Service -Name spooler with constrained parameters Uses virtual accounts so virtual account dies when session ends logs every command to transcripts supports break glass and just in time elevation and deploys via simple copy or DSC
AI-written summary · about
chapters (6)
- 0:00Start
- 2:32Requirements for JEA
- 5:19PowerShell Remoting with JEA
- 8:36JEA and Virtual Accounts
- 32:25Deployment with Desired State Configuration
- 37:53Concept: Just In Time (JIT)
related talks
01h 02mAdvanced JEA Configurations
57mJust Enough Admin - Security in a Post-Snowden World
53mSurprising ways to escalate privileges in Entra ID
57mSecuring PowerShell: Hands-On Lab
37mPowerShell Web Access
34mLPEPM - Tricking Microsoft EPM To Do Our Bidding
46mRole Alchemy: Forging Least-Privilege Roles from Cloud Logs...
49mPowerShell for Security Incident Response