Understanding JEA

JEA does exactly what its name stands for: it allows you to define which role can execute which command and allows just enough administration rights.

Imagine you have multiple people working on one server system: there might be administrators and supporters who might need to perform certain operations such as restarting a service from time to time (for example, restarting the print spooler service on a print server). This operation would require administrative rights, but for the support person, an admin account would mean too many privileges—privileges that could be abused by an attacker in case the support person’s credentials get stolen.

Using JEA, the system’s administrator can define which commands can be run by a certain role and even restrict the parameters. As such, the support person can log in via PowerShell Remoting (PSRemoting), quickly restart the print spooler service, and return to their daily business. No other commands can...