{"id":75251,"date":"2015-12-06T00:01:00","date_gmt":"2015-12-06T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2015\/12\/06\/weekend-scripter-taking-jea-for-a-spinpart-2\/"},"modified":"2019-02-18T09:20:46","modified_gmt":"2019-02-18T16:20:46","slug":"weekend-scripter-taking-jea-for-a-spinpart-2","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-taking-jea-for-a-spinpart-2\/","title":{"rendered":"Weekend Scripter: Taking JEA for a Spin\u2014Part 2"},"content":{"rendered":"<p align=\"left\"><b>Summary<\/b>: Thomas Rayner explores how to restrict Active Directory management with JEA in Windows Server 2016.<\/p>\n<p>Thomas Rayner, Cloud and Datacenter Management MVP, continues his two-part series about an exciting new feature in Windows Server 2016, Just Enough Admin (JEA). Today we&rsquo;ll investigate how JEA can be applied in a situation where a limited user has permissions to run specific Active Directory queries.<\/p>\n<p>Yesterday in <a href=\"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-taking-jea-out-for-a-spin-part-1\/\" target=\"_blank\">Taking JEA for A Spin&mdash;Part 1<\/a>, I tackled code promotion. I showed how to configure JEA so that a connecting user could run only a specially crafted script. Today, the example use case I&rsquo;m using is that I want a limited user to be able to run a few very specific Active Directory-related commands. Maybe these limited users are Help Desk staff who field calls from users with trouble, and I want them to do a little digging before coming to Active Directory admins. Here are my requirements:<\/p>\n<p><b>Users must be able to<\/b>:<b><\/b><\/p>\n<ul>\n<li>Perform a <b>Get&nbsp;<\/b>command on any user, but with limited parameters.<\/li>\n<li>Get the following properties: <b>MemberOf<\/b>, <b>LockedOut<\/b>, <b>Enabled<\/b>, <b>PasswordLastSet<\/b>.<\/li>\n<li>Use the following filter: <b>Office &ndash;like &lsquo;Home*&rsquo;<\/b>.<\/li>\n<\/ul>\n<p><b>Users must NOT be able to<\/b>:<\/p>\n<ul>\n<li>Interact with other files or systems on the server.<\/li>\n<li>Perform any other Active Directory-related actions.<\/li>\n<\/ul>\n<p>Let&rsquo;s get to it! I am going to set up a location for this JEA configuration to live.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5751.1.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5751.1.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>Now, I&rsquo;ve got to set up my PowerShell Session Configuration (PSSC) file like yesterday.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/2352.2.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/2352.2.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>My changes here are very limited. I am changing the session type to <b>RestrictedRemoteServer<\/b> from <b>Default<\/b> (line 16 in the following image)&mdash;otherwise, none of this will work correctly. I&rsquo;m also assigning my <b>Reg Users<\/b> group to the role <b>Help Desk<\/b> (line 31 in the following image). I will define this in a moment. I have a user named Reg Guy in the Reg Users group.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/3113.3.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/3113.3.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>I&rsquo;m now done with the PSSC so I&rsquo;ll save and close it. It&rsquo;s time to set up that Help Desk role. I&rsquo;ll start by creating a <b>RoleCapabilities<\/b> folder in the same location as the PSSC and creating a new PowerShell Role Capabilities (PSRC) file. My PSRC&rsquo;s name must match the <b>RoleCapability<\/b> I assigned to my Reg Users group in the PSSC.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/2275.4.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/2275.4.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>In ISE, I&rsquo;m going to enable the Active Directory functionality I described above. On line 19 of the PSRC, I can include modules to import. I&rsquo;m bringing in the Active Directory module. On line 25, I can enable the specific cmdlets and restrictions I identified previously.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/1616.5.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/1616.5.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>Let&rsquo;s take a closer look at line 25. I&rsquo;ll break it down into its parts:<\/p>\n<ul>\n<li>VisibleCmdlets = @{ }<br \/> The very first part of this line wraps the rest of the content and labels it as cmdlets that I&rsquo;m making visible to my limited user. Next, I have to put something between the curly braces.<\/li>\n<li>VisibleCmdlets = @{ Name = &#039;Get-ADUser&#039; }<br \/> As it stands now, I&rsquo;ve white-listed the <b>Get-ADUser<\/b> command, without specifying any restrictions on parameters. By default, I&rsquo;ve white-listed every parameter combination possible. Let&rsquo;s fix that now.<\/li>\n<li>VisibleCmdlets = @{ Name = &#039;Get-ADUser&#039;; Parameters = @{ Name = &#039;Identity&#039; } }<br \/> The first parameter I&rsquo;m specifying is <b>Identity<\/b>. I&rsquo;m allowing any account to be retrieved by my limited user, so this particular item isn&rsquo;t very interesting. Without specifying <b>ValidateSet<\/b> or <b>ValidatePattern<\/b> for the <b>Identity<\/b> parameter, I&rsquo;m allowing any value to be specified. I&rsquo;m also restricting the <b>Properties<\/b> and <b>Filter<\/b> parameters, though.<\/li>\n<li>VisibleCmdlets = @{ Name = &#039;Get-ADUser&#039;; Parameters = @{ Name = &#039;Identity&#039; }, @{ Name = &#039;Properties&#039;; ValidateSet = &#039;MemberOf&#039;,&#039;LockedOut&#039;,&#039;Enabled&#039;,&#039;PasswordLastSet&#039; }, @{ Name = &#039;Filter&#039;; ValidateSet = &quot;Office -like &#039;Home*&#039;&quot; } }<\/li>\n<\/ul>\n<p>You can see the <b>Properties<\/b> parameter is being validated against a set of allowed values: <b>MemberOf<\/b>, <b>LockedOut<\/b>, <b>Enabled<\/b>, and <b>PasswordLastSet<\/b>. The <b>Filter<\/b> parameter only has one allowable value in its valid set: <b>Office &ndash;like &lsquo;Home*&rsquo;<\/b>.<\/p>\n<p>Let me now save and apply this JEA configuration to an endpoint.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5468.6.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5468.6.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>There are some scary looking warnings that I can safely ignore in my lab. Let&rsquo;s see what kind of experience Reg Guy gets when he connects to this new JEA constrained session. Reg Guy already has basic rights to create a remote connection to this server.<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5037.7.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/5037.7.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>Everything looks great! Reg Guy is allowed to connect and use <b>Get-ADUser<\/b>&mdash;in this case, for himself. He&rsquo;s allowed to retrieve the <b>LockedOut<\/b> property, which isn&rsquo;t returned by default, but he can&rsquo;t request all the properties. Reg Guy can also run the filter we allowed. In this case, no users have an Office attribute that matches the pattern.<\/p>\n<p>Thanks for joining me on this weekend scripting adventure, proving some use cases for JEA. I hope I&rsquo;ll see you again soon.<\/p>\n<p>~Thomas<\/p>\n<p>I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.<\/p>\n<p><b>Ed Wilson<\/b>, Microsoft Scripting Guy<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: Thomas Rayner explores how to restrict Active Directory management with JEA in Windows Server 2016. Thomas Rayner, Cloud and Datacenter Management MVP, continues his two-part series about an exciting new feature in Windows Server 2016, Just Enough Admin (JEA). Today we&rsquo;ll investigate how JEA can be applied in a situation where a limited user [&hellip;]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[56,652,61,45],"class_list":["post-75251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-guest-blogger","tag-thomas-rayner","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"<p>Summary: Thomas Rayner explores how to restrict Active Directory management with JEA in Windows Server 2016. Thomas Rayner, Cloud and Datacenter Management MVP, continues his two-part series about an exciting new feature in Windows Server 2016, Just Enough Admin (JEA). Today we&rsquo;ll investigate how JEA can be applied in a situation where a limited user [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/75251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=75251"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/75251\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=75251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=75251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=75251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}