►
Description
Giving everyone local administrator or domain administrator privileges is a really bad idea. Even the best of admins can make mistakes which can have unexpected consequences. Join James Petty for an introduction to Just Enough Administration and get up to speed on a really powerful method of securing your computing environment.
What is JEA? Just Enough Administration (JEA) is a security technology that enables delegated administration for anything that can be managed with PowerShell. With JEA, you can reduce the number of administrators on your machines by leveraging virtual accounts or group managed service accounts that perform privileged actions on behalf of regular users. JEA allows you to specify EXACTLY which cmdlets, functions, and external commands a user can or cannot run.
Our speaker, James Petty, is a senior server administrator for the Tennessee Power Authority as well as a leader of the PowerShell.org community forum. James has successfully implemented JEA on a large scale and is well versed in what is involved in getting this powerful technology up and running as efficiently as possible. James has a boatload of practical knowledge on best practices and really smart ideas on how to win over colleagues and managers alike when trying to explain the business case for turning on JEA in your corporate environment.
Resources:
Content from presentations can be found at our github:
https://github.com/rtpsug/Meetups
Watch our previous meeting Azure 101:
https://youtu.be/bN59KFnx1Wk
SUBSCRIBE to learn about PowerShell!
https://www.youtube.com/channel/UCiTuB6HZiupE8CJ71vkMFnA/example?sub_confirmation=1
LET'S CONNECT!
-- https://twitter.com/rtpsug
-- https://www.meetup.com/Research-Triangle-PowerShell-Users-Group/
A
A
A
B
A
B
B
A
Alright
somebody
ask
yourself:
why
do
you
want
to
implement
gia
in
your
own
Recology
and
suggest
administration,
the
kind
of
a
mouthful,
but
one
of
the
reasons
that
I
implemented
this
in
my
environment?
So
just
little
bit
of
background,
we
implemented
this
on
2000
plus
servers
over
the
course
of
a
month.
There
are
some
prerequisites
you
have
to
go
through
we'll
go
over
that
in
just
minute,
but
I
got
tired
of
being
woken
up
in
the
middle
of
the
night
by
something
that
a
tier,
1
or
tier
2
helpdesk
support
technician,
get
very
easily
fix.
A
A
Another
another
thing
you
have
is:
we
do
have
some
very
talented,
Tier
one
and
here
to
help
that
support,
who
are
pretty
knowledgeable
in
PowerShell
and
are
more
than
capable
of
learning
this
technology
and
implementing
designs
themselves.
We're
trying
to
empower
our
come,
our
our
lower
lower,
your
tier
1
and
tier
2
admins
to
kind
of
help
from
their
career
as
well.
A
All
right
so
a
couple
things
we're
going
to
talk
about
we're
going
to
go
over
our
configuration
files,
our
capability
files
and
then
finally,
how
to
register
our
endpoints
these
the
first
two
files,
the
configuration
files
is
who
can
do
what
I
think
about
as
the
who
file
and
the
capability
file
is
what
that
person
can
do
now.
One
things
you
need
to
keep
in
mind
when
you're
implementing
Jia
is.
You
are
whitelisting
a
command
commandant
functions
and
executables
that
your
for
your
endpoints.
A
So
if
you,
if
you
don't
explicitly
say
that
someone
can
reset
a
service
they're,
not
even
going
to
be
able
to
see
that
command,
much
much
less
run
it
so
again,
we're
whitelisting
commands
I,
throw
a
few
prerequisites
that
you
need
to
have.
Is
you
need
to
be
on
PowerShell,
5.0
or
higher,
while
you're
there
you
might
as
well
just
go
to
5.1.
A
Your
biggest
challenge
is
probably
with
your
server
2012
and
by
servers.
If
you're
like
me,
in
this,
your
environment,
you
did
not
upgrade
your
service,
your
2012
r2
servers,
they
shipped
with
PowerShell
4
or
it
could
have
been
3
a
tomorrow.
Remember,
I'll
be
finding
update
them,
so
you
need
to
update
that.
That
does
require
a
reboot.
So
that's
why
it
took
us
an
extra
month
to
actually
roll
that
out.
We
had
to
using
to
your
systems
in
the
configuration
manager
red
push
out
the
update
power
shell51.
A
You
absolutely
cannot
do
this
on
to
on
Server
2003.
You
can
do
it
on
2008
r2.
A
couple
of
reasons
you
don't
want
to
do.
It
is
one
that
goes
out
in
the
support
in
January
of
2020
and
2.
It
has
very
limited
function
functionality,
even
if
you
do
get
upgraded
to
5.1.
You
still
gonna
do
a
very
small
handful
commands.
So
if
you
don't
have
2008
or
you
still
have
to
database
in
your
environment,
just
get
rid
of
them.
You
know
how
to
worry
about
it
all
right.
A
B
A
A
So
for
time
for
some
time-saving
I
went
ahead
and
save
some
admin
some
credentials
here
inside
inside
inside
some
variables.
If
you
missed
my
domain
name
is
NCC
1701
and
I
have
two
users
when
you're
using
this
could
be
Ted
and
Marshall
alright.
So
the
first
thing
that
we
need
to
do
is
gia
is
nothing
more
than
a
module
that
resides
on
a
server.
A
So
the
first
thing
we
need
to
do
is
we
need
to
create
a
skeleton
for
module,
so
we
need
to
we're
going
to
make
we're
just
going
to
make
an
empty
directory
our
module,
our
module,
here's
an
occult
demo.
There
are
lots
of
different
ways
to
do
this.
This
is
just
how
I
chose
to
do
this
again.
All
of
these
items
are
going
to
be
empty,
we're
not
putting
anything
in
them.
They
just
have
to
be
there.
A
Otherwise,
it's
not
going
to
work
so
we're
creating
our
directory
called
demo,
we're
creating
a
file
or
another
directory
called
role.
Capabilities
and
then
we're
creating
a
net,
pretending
a
file,
our
PSM
one
file
and
then
our
new
mat
our
manifest
file,
our
PSD
one
so
I'm
using
PowerShell
remoting
to.
A
A
A
And,
of
course,
it
was
taken
at
sweet
time,
so
there
it
goes
all
right,
so
we
can
see
using
PowerShell
remoting.
We
are
now
inside
of
our
server
called
enterprise,
so
we're
just
going
to
make
these
make
these
not
this
little
arguing
all
these
files
are
empty,
we're
not
putting
anything
in
there
and
then
we're
just
going
to
run
a
get
shot
on
them
just
to
make
sure
everything
ran
where
it's
supposed
to,
and
that-
and
it
did
so-
that's
good.
A
So
the
next
thing
we're
going
to
do
is
this
is
going
to
be
our
little
capability
file
again.
This
is
where
we're
going
to
the
hoop.
You
can
put
this
file
anywhere.
You
want
Microsoft
suggests
that
you
put
it
in
the
in
a
program
data
file.
So
that's
exactly
what
we're
going
to
do
so
again,
we're
just
making
a
directory
called
Gaea
configuration.
It
does
have
to
be
called
Gaea
configuration.
You
can't
call
it
something
else
and
as
far
as
these
scripts
are
concerned,
I'll
send
them
to
Mike
and
he
can
put
them
up
somewhere.
A
A
I'm
now
working
for
us,
if
you
started
looking
at
gia
for
a
little
bit,
did
a
little
bit
of
googling.
You
probably
saw
a
lot
of
people
wrote
modules
with
sliding
on
how
to
scrape
these
configuration
files
and
capability
files,
and
then
luckily
Microsoft
gave
us
some
really
nice
modules.
It
will
make
all
the
shells
for
us.
It
will
do
all
the
work,
but
it'll
do
a
lot
of
the
heavy
lifting
for
us
so
for
everything
we
have
here,
I'm,
reusing
splatting,
that
simply
because
for
visibility
sake,
so
there's
all
fits
on
the
screen
good.
A
You
can
definitely
make
this
all
one
ugly
line,
if
you
absolutely
want
to
so
we
have
our
new
PS
configuration
file
for
mainland
and
then
just
a
couple
parameters
that
we're
going
to
throw
in
here,
so
the
session
types
that
we
have
a
restricted,
remote
server.
This
is
the
only
one
you're
ever
going
to
use
why
they
put
other
ones
in
here.
I,
don't
know,
I
just
essentially
said
you're
making
a
restricted,
endpoint
our
transcript
directory.
This
is
going
to
make
your
cybersecurity
people
really
happy
Gia's
outside
the
configuration
to
dump
a
transcript.
A
Once
the
session
is
terminated,
it
will
dump
that
transcript
onto
the
local
server
or
on
to
an
SMB,
share
or
I
believe
I
have
seen
some
people
there
being
able
to
send
it
to
a
some
kind
of
a
thin
server
or
sip
log
server.
I
have
maybe
get
that
work,
so
there's
no
guarantees,
but
at
the
very
least
you
can
save
this
file
out
somewhere.
So
do
you
have
a
transaction
history
of
what
happened?
A
One
of
the
most
important
things
about
gia
is
that
the
admin
or
so
in
this
case
the
help
desk
technician
actually
has
zero,
writes
on
the
server
everything
has
been
running
as
a
virtual
account.
Virtual
account
changes
names
every
time
so
that
the
account
can
never
be
hacked,
because
the
account
only
exists
when
you
need
it
and
when,
as
soon
as
that
session
is
terminated,
the
account
goes
away
now.
You
can
turn
this
to
false,
but
that
can
defeat
the
whole
purpose
of
what
we're
doing.
A
The
royal
definition
is
file
you
simply
this
is
so.
This
is
going
to
be
who
alright,
so
in
this
case,
I
just
have
a
single
user,
but
you
cannot.
This
can
also
be
a
global
group
here
and
then
that
we
also
got
tired.
What
capability
does
it
have
so,
in
this
case,
I
take
values
and
be
called
demo
we'll
get
to
that
in
just
a
minute
just
a
little
bit,
but
this
is
just
the
name
of
the
module
that
we
made
up
at
the
top.
A
In
the
past
is
where
you're
going
to
save
that
again
we're
going
to
save
it.
In
a
program
data
geo
configuration
this
pssc,
let's
pop
STRs
Sara
Charlie
Charlie.
It
has
to
hide
this
extension
on
it
if
it
doesn't
hide
that
it's
not
going
to
work
and
you'll
beat
your
head
against
the
wall
for
a
few
hours,
I
would
offer
on
something
fun
that
I
put
in
here.
A
You
don't
have
to
do
this,
but
as
soon
as
we
open
the
file
we'll
see
a
lot
more
options
of
what
we
can
do,
but
this
script
the
process-
this
will
actually
run
a
script
every
time
someone
logs
in
for
the
session,
there's
a
lot
of
other
things.
Other
things
we
do.
This
is
kind
of
something
something
fun
that
I
put
in
here.
So
we're
just
going
to
run
all
this.
A
A
The
author
obviously
comes
so
I'm
running,
underneath
Ted
so
tense,
the
one
that
wrote
it
our
session
type
restricted
directory,
runs
virtual
account,
etc,
and
this
is
the
most
important
part
now,
if
you
want
to
one
of
the
best
things
about
gia,
is
that
you
can
keep
changing
these
things
on
the
fly.
So
just
because
I
made
this
here
now,
I
can
easily
just
come
in
and
change
this
for
something
else
and
push
save
and
then
now
I'm
done
I
don't
have
to
go
through
this
whole
process
again.
A
A
All
right,
everyone
is
our
configuration
file,
so
next
we're
going
to
go
in
here
and
look
at
our
capability
file.
This
is
where
you
actually
whitelist
all
the
commands.
This
is
where
you'll
probably
spend
most
of
your
time
getting
all
this
information
set
up.
This
is
where
you'll
spend
all
of
your
time.
Essentially
do
it
during
your
testing.
A
A
A
Oh
all,
right,
I'll
take
a
look
at
that
real,
quick,
so
yeah
we
are
demo.
This
is
our
modular.
We
created
and
Microsoft
knows
best,
so
we're
just
putting
this
module
and
I
went
to
the
Windows
PowerShell
module
folder
alright.
So
this
is
what
our
capability
file
looks
like
now:
you'll
notice
a
lot
more
options
here
in
this
now
by
default.
A
All
of
this
is
commented
out,
so
you
could
come
in
here
and
start
I
started,
putting
everything
everything
there
if
you
want
to,
if
you
have
an
your
own
custom
module
that
you
would
like
to
run,
you'd
like
to
help
desk
technician
to
have
maybe
you
customized
ad,
the
ad
module
so
that
it
returns
specific
information
or
you
wrote
a
module
to
work
with
SCCM.
You
would
import
this
in
here.
A
Aliases
we'll
talk
about
aliases
a
little
bit,
so
you
cannot
see
aliases
through
a
thorough
geo
configuration
unless
you
explicitly
say
that
they
can
see
an
alias
one
of
the
one
of
the
hotspots
that
week
that
we
came
into
when
we
were
doing
this
is
we
were
used
to
using
CD,
for
you
know,
CD
for
change
directory
as
opposed
to
set
cha
bottom.
So
we
gave
this
to
our
help
desk
and
everyone
was
doing
alright.
A
A
So
most
of
these
are
kind
of
you
do
need
to
know
the
difference
between
the
Commandant
and
a
function
you
can,
so
you
can
run
the
command
git
command,
we'll
see
that
in
a
minute,
so
we
can
see
if
it's
a
function,
orbits
command.
You
can't
put
a
function
up
here.
You
can't
put
commandlets
down
here
this
little
external
command.
This
would
be
something
such
as
ping
or
nslookup.
A
So
some
of
those
other
programs
you
can
run
from
in
from
inside
powershell
visible
providers
by
default.
They
can
only
see
the
file
system
provider.
If
you
want
your
whoever
your
business
forward
to
have
access
to
website
or
registry,
you
would
have
to
build
in
the
registry
provider
scripts
the
process
this
is
so
we
did
put
that
in
in
there
in
ours.
This
is
where
it's
actually
going
to
run.
I
could
custom
strip.
If
you
want
to
do
that,
if
you
wanna
be
able
to
run
aliases,
that's
where
you
put
those
and.
B
A
So
this
would
be
a
little
module.
You
want
to
look
at
it
that
way.
So
this
is
my
capability
file
for
demo.
I
should
say
it
does
have
to
have
this
P
SRC,
and
it
has
to
be
called
the
exact
same
name
that
you
called
your
demo,
that
you
call
your
fabulous
and
it
has
the
good
and
the
research
abilities
file.
B
A
B
B
B
B
A
So
close,
this
are
the
difference
between
the
configuration
files
and
the
capability
files.
This
took
me
a
few
weeks
that
I
actually
be
able
to
wrap
my
head
around
on
how
they
work.
There
is
a
tool
that
you
can
download
from
Microsoft,
but
gia
configuration
tool.
I'll
send
a
link
to
Mike.
It
was
a
GUI
tool.
That's
actually
that's
how
I
learned.
Finally,
how
I
learned
how
all
of
this
work
is?
A
You
can
actually
type
in
all
the
information
and
it
will
build
these
files
for
you,
it's
a
great
place
to
get
started
and
and
to
learn.
It
is
a
terrible
place
to
actually
implement
from
so
it
worked.
It
worked
great
for
like
a
live
environment
with
one
or
two
servers
with
that
other
than
that
you're
trying
to
do
on
a
mass
scale.
A
A
A
So
what
we're
going
to
do
is
now
we're
going
to
ready
for
a
new
one
actually-
and
it's
going
to
look
just
like
this:
let's
try
some
new
comp
demo
and
it's
going
to
be
called
and
we're
going
to
call
it
who
has
access
to
it.
So
we
should
do
this
with
the
register
PS
session
configuration
we
get
rid
of
these,
so
retail.
A
For
the
name
again,
this
has
to
be
the
same
name
as
the
module
that
you
created,
which
has
the
same
name
as
the
capability
file,
and
it
has
the
same
name
as
our
configure
compatibility
file
that
we
made.
So
everything
has
the
same
name,
and
then
we
need
to
tell
it
where
our
capability
file
lives.
That's
what
this
path
right
here
is.
So
this
is
what
this
is
name
your
module.
This
is
the
whom
is
where
that
capability
file
is
now
this.
A
A
A
A
A
So,
but
I
by
default,
these
are
the
commands
that
you
get
by
default.
These
are
called
the
PowerShell
common
parameters,
so
you
can
said
that
G
is
whitelisting.
We
did
not
put
any
commands
any
functions
in
use,
any
visible
environment
variables
or
anything,
but
these
are
the
commands
that
we
get
by
default
now.
This
is
all
that
I
can
do.
At
this
point,
you.
B
B
A
B
A
A
A
So
now
we're
going
to
add
some
commandlets
here
so
again
we're
going
to
tell
it
where
to
save
it.
Now
I'm
just
overriding
I
the
same
file
and
over
and
over
again
we
could
easily
append
to
it
so
now
I'm
going
to
I'm
going
to
get
Marshall
the
write,
the
gift
process
get
service
and
restart
computer.
Oh
that's
a
good
place
to
for
a
level
one
technician
to
start
with,
and
then
this
is
what
that
looks
like
Missile
Command
with
each
one.
You
can
do
single
or
double
quotes,
separated
by
comma.
A
A
Alright,
so
we
can
see
this
came
from
the
Microsoft
PowerShell
utility,
so
we
could
I
get
that
here,
just
a
little
bit,
but
all
right,
please
command
I
got
him
in
the
wrong
spot,
let's
see
if
it
still
works
to
us
anyway,
so
we
added
some
visible
functions
here,
the
disables.
You
know,
let's
say
one
of
the
other
things
that
we
kept
getting
called
with,
where
developers
calling
in
middle
of
night
playing
to
their
schedule,
tasks
that
run
and
executives
reports
not
going
to
work
tomorrow
morning
at
eight
o'clock
when
they
have
their
daily
briefing.
A
A
Change
this
last
minute,
so
we're
good
work
so
we're
just
going
to
hold
our
breath
and
there
we
go
so
right
now
so
now
Marshall
can
do
a
lot
more
than
he
could
do
before
so
before
he
could
just
clear
the
hosts
a
few
other
things.
Now
we
have
the
start.
Scheduled
tasks
stopped
scheduled
tasks.
We
can
get
all
the
processes.
A
Now
something
that
we
didn't
do
in
here,
we
could
get
very
granular
in
this
week
we
could
say
that
Marshall
is
only
allowed
to
restart
or
only
allowed
to
get
the
print
spooler
service.
We
could
add
parameter
binding
to
this.
That
is
something
I
got
over
in
the
powerful
conference
book.
I,
don't
think
I
don't
have
enough
time
to
go
over
this,
nor
that
I
write
any
demos
for
it.
But
that
is
also
something
if
you
can
do
so.
You
can
restrict
the
parameters
that
a
person
can
use
as
well.
A
Something
to
note
inside
of
a
gia
session.
Tab-Completion
does
not
work,
so
you
have
that
they
have
to
know
how
to
write
the
command
out
entire
time.
Now,
if
you
want
to
get
into
it
implicit
remoting,
you
can
make
tab-completion
work.
It's
not
that
difficult.
It
is
kind
of
time-consuming.
So
we
just
told
our
helpdesk
technicians
that
it's
not
going
to
work
in
with
them.
We
just
kind
of
went
on
with
it
from
there
so
again,
tab
completion
does
not
work
inside
of
a
gia
session.
B
A
A
A
variant
I
believe
I
have
probably
seven
or
eight
different
end
points
for
our
helpdesk,
technicians
to
to
use
and
I'll
show
you
why
and
again
something
that
took
us
a
long
time
to
figure
out,
but
hopefully
I
will
save
you
hours
and
a
lot
of
advil
all
right.
So
one
of
you
guys
who
did
the
exact
same
thing
we
had
for
but
I
have
added
so
there's
another
thing:
we're
going
to
talk
about
so
here,
I
put
a
very
explicit
command,
restart
computer,
but
I
can
also
do
the
name
of
the
module.
A
Slash
and
I
can
use
it
and
I
can
use
wildcards
under
that.
So
in
this
case
we're
doing
web
administration.
So
this
is
the
is
module
and
I
can
do
get
star.
So
this
is
how
you
would
give
someone
access
to
everything
that
begins
with
the
word
get
inside
of
the
web
administration
module.
Now
this
is
great,
for
so
we
did
the.
A
A
So
what
I
I
have
done
is
I
have
crook,
so,
instead
of
web
administration,
here
I
simply
have
Microsoft
that
powder
trail
utilities
slash
get
start
because
I
don't
care.
If
my
helpdesk
technicians
can
see
if
they
can
get
everything
that
doesn't,
they
can't
do
anything
with
the
data
they
can't
export
it
out.
A
They
don't
have
rights
to
doing
how
file
and
export
CSV
the
worst
they
can
do
is
take
a
screenshot
of
it,
the
processes
or
that
you
know
they
have
the
hostname
or
to
actually
see
to
see
what
kind
of
objects
something
put
something
pulling
out.
That's
the
decision
we
made
I'm
not
saying
that
the
decision
that's
right
for
every
company
without
a
decision
decision
that
is
right
for
us.
So,
instead
of
writing
each
one
of
these
out,
we
did
it
the
partnership,
our
solar
utility,
ok,
the
compact,
for
example,
so
again
the
web
administration.
B
B
A
So
if
you
try
to
get,
we
were
trying
to
do
one
file
to
rule
them
all
different,
but
one
file
out
there
and
we
thought
if
it
didn't
harvest
it
was
just
kind
of
blow
over
it
and
it
doesn't
thing
to
be
hunky-dory.
Well,
that's
not
how
it
works.
If
you
put
in
a
command
night,
let
me
write:
this
house
is
fine.
A
You
know
it
did
not
care,
it
did
what
I
hope
to
do,
but
I'm
trying
to
enter
this
configure
this
session
called
demo
and
it
has
whitelisted
web
administration
slashing
yet
star,
but
not
there.
So
I
can't
get
into
it.
But
this
is
why
I
have
so
many
I
have
one
for
west
surface
and
some
for
single
servers.
I
have
some
print
servers
and
so
on
so
on
and
so
forth.
A
B
A
Name
as
a
gia
is
an
end
point:
that's
the
microphone,
Microsoft
name
for
it,
but
yeah
I
think
we're
kind
of
saying
that
saying
the
same
thing
I
have
an
end
point
for
my
health
that
stick
I
should
have
three
points
for
health
destination.
One
is
you
know,
Tier
one
sequel,
one
of
tier
one
is
I.
Have
another
end
point
that
I
made
for
my
sequel.
You
know
for
our
sequel
developers,
so
we
don't
want
to
give
them
full
admin
right.
So
a
lot
of
is
boxes
is
team.
A
Has
their
own
end
points
today
they
can
configure,
they
can
get
them
get
to
as
well.
You
know,
and
I
could
also
just
do
star
and
that
will
give
you
be
careful
with
Auto
Parts.
Then
you
get
to
get
what
you
pay
for,
but
this
will
give
everyone
access
to
the
entire
module.
So
that's
kind
of
how
we
did
that
for
the
sequencer
Mathias
and
is
team.
B
A
A
Roxy
function
called
commitments,
behave
differently,
all
right,
all
right,
I'll,
let
y'all
figure
that
out
the
chat
and
I'll
be
back.
I'll
come
back
to
that
in
a
few
all
right,
so
we
did
this
with
web
ministration.
We
saw
that
it
failed.
The
SMB
share
is,
is
one
that
is
built
in
so
again.
This
is
how
we
would
do
an
entire.
A
An
entire
module
and
I
should
have
had
a
session
a
second
session
open,
but
this'll
work
anyways.
It
is
important
to
note
that
you
why
you
can
make
changes
these
capability
files
anytime.
They
want
if,
as
I'm
logged
in
as
a
tier
1,
help
desk
technician
and
use
us
as
admin
make
changes
to
this
I
have
to
close
my
session
and
then
log
back
in
to
see
your
changes.
The
changes
only
will
only
show
up
for
me
once
I
make
a
new
condition
to
the
endpoint.
A
A
B
A
B
B
B
Have
this
layer
of
delegation
where
people
who
don't
have
full
admin
rights
on
the
box
can
now
run
specific
stuff
feel
like
I'm,
a
little
nervous
about
being
in
control
of
whitelisting
the
commands
right,
because,
basically,
if
you
let
them
in
and
then
anything,
but
you
know,
did
a
wild
card
that
is
long
now
they
can
run
whatever
I
bad
min.
So
it's
a
little
biscuit.
B
I
was
doing
some
stuff
with
Windows
updates
kind
of
like
installing
them
kind
of
manually,
and
you
can't
even
if
you're
an
admin,
if
you're
remoting
into
the
box,
you
can't
run
it
cuz
you're,
not
a
local
user.
If
you
go
through
a
dia
endpoint,
then
you're
running
as
a
local
account,
so
you
can
do
the
surgical
stuff.
That
way,
we
say
that
again
walk
through
that
again,
you
can't
install
Windows
updates
remotely,
even
if
you're
an
admin,
because
it
requires
that
you
be
a
local
account.
B
You're
running
as
a
local
virtual
account,
so
you
satisfy
all
those
requirements.
So
I
think
there's
a
couple
other
things
that
you
have
to
be
sort
of
local
to
do
until
the
gia
allows
that
even
if
you're,
just
if
you're
already
in
a
vanilla
box
connecting
from
idea
and
point
if
you
learn
more
but
also
with
the
GN
point,
you
still
have
you
can
you?
Can
you
have
network
access
correct
for
I,
don't
know,
I
haven't
had
a
need
to
do
that.
This
double
hop
beyond
you
know.
A
A
Like
he
was
saying
one
of
the
things
you
can
do
so
we
up
at
the
very
top.
You
know
we
put
to
run
as
a
virtual
account,
which
is
something
that
we
again.
We
should
always
do,
because
that
count
name
changes
every
time,
but
one
of
the
things
that
you've
heard
you
and
I
don't
think
you're
going
to
summit
I
have
a
section
on
this
and
I'll
write
some
blog
articles
after
the
fact
is,
you
can
set
run
as
accounts.
B
A
A
That
user
can
run
the
command
and
it's
running
under
the
controls
of
that
domain
admin,
that's
all
they
compute
and
as
soon
as
that
session
is
torn
down,
you
protect
your
in
script
outs,
you
know
and,
and
then
users
run
away.
So
that's
a
perfect
example
for
how
to
use
the
run
as
account
you
can
apply,
use
GM
essays
as
part
of
your
right
as
part
of
here
right
up
accounts
as
well.
Oh.
B
Excuse
me,
the
few
more
minutes
just
set
yourself
up,
wait:
I'll
open
a
spill
I
used
here.
What
was
the?
What
was
the
thing
that
got
you
to
start
thinking
about
who's
in
jail?
Was
it
you
being
so
actually
very
smart?
It
was
the
business
form
to
solve
some
problem,
but
you're
like
oh
I
I
read
about
this
is
what
I
had
to
do
it
like?
How
did
you
guys
could
what
made
you
start
with
it?
B
B
B
It
did
you
implement
this
and
enforce
people
in
the
PowerShell,
and
they
accepted
that
or
were
do
you
already.
Did
your
users
already
have
a
concept
of
PowerShell
outwards,
and
then
it
was
just
applying
this
to
more
of
the
former
didn't
have
as
much
power
shell
experience,
but
I
was
kind
of
on
our
rampages
like
have
some
organized
scripts.
To
do
everything
so
we're
getting
this
little
things,
staff
to
learn
so
I
know
how
hard
was
that
for
them.
Then,
like
was.
B
Things
for
them
to
figure
out
and
be
able
to
do
yes,
one
of
my
concerns
with
implementing
something
like
this
is
by
and
large
my
organization
doesn't
space
the
hell
away
from
the
command
prompt,
yeah.
Well,
James
can
also
talk
about
that,
because
I
remember
when
I
saw
this
first
time
around
I
think
James
had
said
they,
they
put
the
business
along
and
sort
of
duplication.
Why
would
you
do
this
and
then
the
biz
subscribe,
Captain
James
I
said
different?
B
A
So
we've
been
pushing
our
pyro
shell
nope
ourselves,
wait
a
few
Tyrion
learned
by
Richelle
sector
sector
we've
been
pushing
that
for
a
few
years
and
and
that
so
that
point
we
were
just
kind
of
we.
You
know
we've
been
helping
you,
we
bought
everyone,
coffee,
the
powershell
de
michael
lunches.
We
ran
through
that
through
through
lunch
lines
with
everyone,
so
everyone
who
had
wanted
to
learn
it
by
that
point
had
and
the
other
ones
who
didn't
you
know
it
took
a
little
bit.
We
probably
ran
it
up,
ran
up
the
flagpole.
A
We
got
enough
by
buying
from
our
senior
management
team
that
this
is
going
to
take
a
whole
bunch
of
load
on
off
of
our
group,
not
only
that
is
going
to
save
money
in
a
long
run,
because
every
time
we
get
called
out,
we
at
the
impact
we
get
paid
overtime
so
operation
center,
which
is
at
24/7
that
they
have.
That
has
the
rights
to
do
it.
A
A
We
can
just
love
doing
just
let
them
do
that
job,
so
it
was.
We've
probably
got
that
that
buy-in
for
my
senior
management,
okay,
this
is
happening.
If
what
we
did
is
we
sat
with
a
very
small
group
of
proficient
powershell
users
and
we
have
developed
the
commands
that
we
thought
that
they
would
want
to
do.
They
would
need
to
use
to
fix
the
fix
these
common
tasks.
So
first
we
started
with
what
common
ties
to
you
know.
Do
you
see
kind
of
alerts?
A
Do
you
see
coming
into
the
scum
we're
or
whatever
your
monitoring
tool
is,
then
we
we
gave
them
a
list
of
commands
like.
We
think
this
is
what
you
need.
Look
at
it
within
work.
Here's
a
test
box,
government
under
play
and
that's
and
to
the
to
empower,
show
savvy,
that's
what
they
did
and
then
they
came
back
with
a
hole
with
the
command
that
they
wanted
added
for
one
reason
or
another
like
where
object.
For
instance,
you
know
select,
select
names,
there
name
like
you,
know,
star
James
Carr.
A
A
B
A
Of
events,
we
help
them
write
your
documentation
on
their
wiki
on
their
SharePoint
and
and
from
that
point
we
rob
when
I
call
us
truck
I'm.
Sorry,
you
have
the
rights
to
do
this.
Let
me
know
if
you
need
help
and
then
after
that,
that's
and
just
kind
of
went
from
there
and
now
the
list.
We
probably
get
a
request
once
a
week
to
add
this
command
or
that
command
to
their
profile.
But
we
did.
A
Another
another
would
have
learned
that
we
got
out
of
this,
that
this
was
an
accident
we
didn't,
we
didn't
think
about
it.
First
is
we
gave
developers
to
write
to
restart
their
own
service
on
their
own?
You
know
on
their
own
application
because
most
of
time,
developers
they're
really
good
at
writing.
Programs
and
not
great
at
writing
services.
So
service
was
stopped
a
lot
for
reasons.
A
So
we
we
would
write
we're
now,
writing
GI
endpoints
for
developers
and
we're
using
those
constrained
parameters
and
allowing
them
to
restart
their
own
service
on
their
own,
and
so,
instead
of
calling
us,
so
they
they're
really
liking
that
because
they
can
go
in
and
fix.
You
know
a
lot
of
times.
We've
got
a
call.
My
widgets
broken
I
need
to
restart
the
service,
so
they
they've
already
done
all
the
work
on
the
investigation.
A
B
Clinic
so
I
have
a
other
question
and
I'm
this
kind
of
scenario
at
work.
We
have
our
team
or
a
few
guys
and
on
my
team,
develops
internal
modules
that
we
then
provide
to
help
desk
right
so
like
an
on
board
awkward
script
or
module.
As
an
example,
in
my
case,
what
I
have
to
load
the
module
or
set
the
module
in
the
configure
I
think
the
configuration
file
and
white
lace
every
single
command
that
that
that
every
private
public
command
has
like
how
how
would
I?
What
would
that
look
like
in
this?
A
So
you
would
have
to
see
here,
I
believe
it
that's
a
capability
file.
So
look
at
this
real,
quick
yeah,
so
you
just
put
the
name
the
module
and
then
you
can
do
sliced
star
if
you
want
to
do
the
whole
module,
but
then
you'd
also
here
modules
to
import
so
you'd
have
to
make
sure
that
module
is
installed
first
on
the
machine,
then
you
would
just
do
you
know
my
company
module
right
here,
make
sure
it's
not
coming
out,
but
just
put
it
in
right
here.
B
B
A
Kind
of
a
kind
of
a
big
difference,
so
if
your,
if
your
your
your
unwitting
process,
if
your
thinking
here
is
a
CSV
with
50
users
in
it,
create
me
50,
you
know.
Let
me,
through
this
module
with
a
for
each
loop,
stood
out
50
users
that
G
is
not
going
to
work
for
that
G
is
not.
Okay
cannot
be
used
for
scripting.
It
can
only
be
used
to
run
command.
So
that's
because
so
you
have
a
way
the
pros
and
cons
with
that
fruit
for
your
environment,
but
you
do
have
to
keep
that
distinction.
B
A
Admin
you
as
the
admin
to
write
a
function
and
then
that
function
could
be
visible.
But
if
that,
let's
just
say
that's
how
you
use
Active
Directory
as
a
for
an
easy
one.
So
they
could
run,
get
ad
use
or
new
ad
user
and
use
all
those
Commandments.
But
even
if
you
gave
them
access
prep
for
each
loop
or
to
the
for
each
command
and
try
to
run
try
to
run
that.
Let
try
to
run
that
through
it
would
I.
A
Guess
theoretically
would
work
but
you're
bypassing
all
the
security
around
it,
because
when
you
do
the
for
each
loop,
this
core-
and
you
do
this.
So
these
brackets
is
called
a
script
block.
And
from
here
you
can't
light
list.
What
goes
on.
What
goes
on
the
script
block,
so
you
put
restart
computer
in
here
and
an
octonaut.
B
B
My
other
might
help
desk
doesn't
have
the
ability
they
don't
have
enough
skills
to
mean
to
do
on-boarding
and
off-boarding
and
enough
enough
knowledge
know
how
to
run
it
line
by
line.
That's
the
benefit
of
publishing
my
module,
there's
five
or
six
published
modules
or
public
functions
that
I
exposed
to
them.
So
my
thought
would
be
okay,
whitelist,
that
module
in
this
in
this
file,
P
SRC
module,
and
then
they
would.
You
know,
invoke
new
puppet,
a
user.
You
know
set
new
company
user
blah
blah.
B
B
A
A
A
Sounds
like
this.
You
can't
do
this
right
this
at
this
point,
this
one
we're
some
we're
starting
we're,
switching
from
writing
for
running
commands
to
writing
scripts.
So
we
can't
from
the
commit
new.
They
can
stop
process
Tomcat
8
and
they
can
get
it
that
they
couldn't
get
the
process
and
pipe
at
the
stop.
That
point
we're
starting
to
write
scripts
and
that's
where
Gio
starts
breaking.
B
A
B
A
B
A
Right,
yeah,
I,
think
I,
think
I
think
I'm.
Think
I'm.
With
you
day
you
I
hadn't
done
much
with
proxy
functions.
I
dunno,
they
kind
of
gave
us
a
little
bit
little
bit
of
problem.
So
we
just
kind
of
said
it
was
you
don't
need
that
kind
of
we're
not
kind
of
went
on
with
it.
It's
kind
of
how
we
settled
settled
that
one
I
mean
is
that
dude
I
do
remember,
reading
that
the
proxy
functions
do
give
you
some
problems.
B
A
A
A
B
Okay,
I'm
talking
about
specifically
so
the
gia
ones
I've
written,
is
where
you
actually
create
like
a
module,
and
you
put
the
I
guess
it's
what
you're
doing
here
with
the
demo
yeah.
You
know
you
have
the
wrong
capabilities.
Folder,
but
yeah
I
mean
I've,
ran
into
that
and
it
took
me
a
while
to
figure
it
out
and
I
just
put
in
a
fully
qualified
name
for
it
and
everything
starts
working,
but
that
means
you're
no
longer
using
the
proxy
function
internally,
you're
directly,
using
the
select
object
command.
At
that
point,.
B
A
B
Write
my
that,
let's
do
that
before
and
they
just
use
the
scheduled
tasks
just
register
and
unregister
the
same
yeah
so
but
you
just
writing
a
file
right.
Yes,
there's
a
test
that
like
to
put
in
the
file
for
the
evening
the
final
the
configuration
file
just
exist.
You
just
registering
and
unregistering
that
yet
at
endpoint
it
you're
just
turning
on
the
endpoint
turn
off
the
endpoint.
You
only
need
one
you
need
it
yeah.
These
will
go
and
have
them
log
in
to
get
the
new
configuration.
Oh,
what
once
you
on
register
the
day?
A
A
Run
behind
fine,
so
I
guess
I
have
to
make
my
module,
so
we
won't
go
through
all
this.
We've
already
seen
all
this
before.
One
thing
to
take
note
of
is
I'm
now
using
Ted
instead
of
Marshall.
Now
remember
so
Ted.
So
Ted
is
a
domain
admin
so
time
so
I
want
you
to
keep
that
in
mind.
So
we've
done
that
I've
already
installed
the
web
administration
role,
so
we're
going
to
read
going
to
register
our
end
point
I'm
going
to
kick
that
open
RM,
which
is
perfectly
fine.
B
A
A
I
show
you
just
the
last
minute
and
I
have
a
typo
somewhere.
Okay,
what's
going
on
here
all
right!
This
is
exactly
what
was
supposed
to
happen
so
and
so
Ted
is
a
domain
admin
we've
been
using
him
to
do
all
this
work,
but
when
I
try
to
access
the
demo
configuration
he
got,
he
got
he
got
denied
access
access
is
the
night
as
a
done
in
admin.
So
again,
this
is
how
you
can
help
your
cyber
security
folks
kind
of
help
them
get
over
the
hurdle
of
a
trust
of
trusting
Gaea.
A
A
A
So
we
can
see
here
in
demo
why
Ted
was
denied
Ted
does
not
have
permissions
to
it
and,
as
I
never
actually
go,
do
just
a
reverse
for
him
highest.
We
can
see
that
ted
has
access
to
this
now,
why
Ted
would
have
been
logged
in
all
he
could
do
is
what
was
list
is
what
we
want
white
listed
for
him.
Even
though
he's
a
domain
admin
in
this
session
he's
restricted
to
what
our
session
configuration
file
says
says
that
he
can
do.
I
should
also
never
the
Marshall
as
the
domain
admin
as
well.
A
A
Very
a
good
question:
I
did
also
presume
as
far
as
going
to
Linux,
so
gia
works
right
now,
when
our
in
winner
n
does
not
work
on
medics,
so
in
turn
G
of
rewritten
to
work
using
SSH.
It
is
just
a
Windows
only
that
winners-only
it
does
better
compilers,
of
course,
so
we've
been
using
5.1,
it
does
work
in
core,
but
on
only
on
Windows
machines
and
never
something
else.
A
Written
about
this,
and
that's
how
to
to
how
you
hold
us
out
in
your
production
environment,
there
are
lots
of
different
ways
to
do
it.
The
way
that
we
chose
to
do
it
was
using
a
start
using
a
logon
script
for
all
of
our
servers.
All
of
our
servers
and
monthly
have
windows
on
our,
so
we
first
send
them
somebody
once
a
month
when.
B
A
B
A
B
A
B
B
Capability
probably
already
exists
in
linux.
Anyway,
that's
a
lot!
That's
I!
Look
at
this
and
I
compared
it
to
sudo
templates,
that's
kind
of
how
I
refer
switch.
They
kind
of
help
it's
easier
to
work
with.
Maybe
I
didn't
know
that
Susan
templates,
you
can
get
very
granular
as
far
as
like
levels
of
access.
As
far
as
root
access
to
you
don't
have
to
give
a
user
root,
you
can
just
give
them
the
specific
command.
You
want
them
to
run
and
they'll
be
able
to
run
that
one
and
one
only
command
as
pseudo.
So.