🎓 A1Learner
🔍
0 of 46 lessons completed

PowerShell Just Enough Administration Concepts

Just Enough Administration is a Windows feature that gives an admin only the tasks they need, and nothing more. It is taught here as concepts only, because it is a Windows feature and it is not available on this Linux platform.

An allow-list names the approved tasks

A role is an allow-list of task names. The -contains test checks whether one task name sits on that list.

$allowed = @("Get-Status", "Restart-App")
$allowed -contains "Get-Status"

Run only an approved task

A function can run a task only when the task is on the allow-list. Any other task gets a plain blocked message instead.

function Invoke-AllowedTask {
  param([string]$Task)
  $allowed = @("Get-Status", "Restart-App")
  if ($allowed -contains $Task) {
    "Running: " + $Task
  } else {
    "Blocked: " + $Task
  }
}
Invoke-AllowedTask -Task "Get-Status"
Invoke-AllowedTask -Task "Stop-Server"

A limited role returns only a status

A tightly limited role may offer one safe result and nothing else. This function returns a fixed status string and runs no other action.

function Get-LimitedStatus {
  "Status: running"
}
Get-LimitedStatus

Example

$allowed = @("Get-Status", "Restart-App", "Get-Log")
$asked = @("Get-Status", "Stop-Server")
$granted = $asked | Where-Object { $allowed -contains $_ }
($granted | Sort-Object) -join ", "
"Blocked tasks are never run."

Key points

  • Just Enough Administration: a Windows feature that limits an admin to a small set of approved tasks.
  • Role: a named set of tasks that one group of admins is allowed to run.
  • Least privilege: the rule of giving only the smallest access a task truly needs.
  • A task outside the approved set is blocked, even for an admin who holds the role.
  • Just Enough Administration keeps a full admin account out of everyday task work.

In this example, an allow-list first names the three tasks a role may run. Two tasks are then asked for, and only the one on the allow-list survives the filter. The surviving task names are printed in order, and the closing line states that blocked tasks are never run.

Note

No Just Enough Administration demo runs in this lesson. The code below shows the allow-list idea in plain PowerShell, not the Windows feature itself.

Try it Yourself

Edit the code, then press Run.

Running is simulated

Exercise

What is the main idea of Just Enough Administration?