Implementing Just Enough Administration (JEA)
Just Enough Administration, also known as JEA, is a security framework that allows you to implement fine-grained administrative delegation. With JEA, you enable a user to have just enough administrative power to do their job, and no more. JEA is a more secure alternative to just adding users to the Domain Administrator or Enterprise Administrator groups.
With JEA, you could, for example, enable a junior administrator the rights to access your domain controllers to administer the DNS service on the DC. JEA allows you to constrain what the user can do on the protected server. For example, you could allow the user to stop and start the DNS service (using Stop-Service and Start-Service) but no other services.
JEA makes use of three objects:
- JEA role capabilities file (.psrc): This file defines a role in terms of its capabilities. You would configure the JEA role
RKDnsAdminsto define a limited set of cmdlets that the role has access to on the...
