In traditional enterprise IT environments, the biggest security liability is not an unpatched server—it is the helpdesk technician typing a Domain Admin password on an infected end-user workstation to clear a stuck print spooler or restart a service.

The moment a privileged credential touches an untrusted endpoint, memory scraping tools (like Mimikatz) harvest the token, resulting in instant lateral movement and domain escalation.

Here is how we redesigned our internal IT operations to completely eliminate Domain Admin exposure on user endpoints using PowerShell Just Enough Administration (JEA) and structured API automation.

1. The Core Flaw of Interactive Credential Delegation

When an MIS engineer logs in interactively or uses Run As Administrator on a remote laptop:

  1. An interactive logon session (Logon Type 2) is created.
  2. The Local Security Authority Subsystem Service (LSASS) caches the NTLM hash or plaintext Kerberos ticket in memory.
  3. Any local malware with elevated privileges can dump credentials and compromise the root domain.

To prevent this, administration must be non-interactive, strictly scoped, and unprivileged.

2. The Solution: PowerShell JEA (Just Enough Administration)

PowerShell JEA operates on a Role-Based Access Control (RBAC) model over WinRM, restricting endpoints with two key guardrails:

A. Role Capability Definitions (.psrc)

Instead of granting full PowerShell access, we define an explicit whitelist of allowed cmdlets and exact parameters:

@{
    # Visible functions allowed for Level-1 support
    FunctionDefinitions = @(
        @{
            Name = 'Restart-PrintSpoolerService'
            ScriptBlock = { Restart-Service -Name 'Spooler' -Force }
        }
    )
    # Block arbitrary pipeline execution and syntax tricks
    LanguageMode = 'NoLanguage'
}

By enforcing LanguageMode = 'NoLanguage', operators cannot execute loops, declare custom variables, or bypass command whitelists.

B. Session Configuration (.pssc) with Virtual Account

The session runs under a temporary, local virtual administrator account generated on the fly. The calling technician only needs unprivileged Active Directory group membership:

  • No Domain Admin account is ever typed into the console.
  • No credential hash is left in LSASS memory.
  • Every action is permanently recorded in Windows Event Logs.

3. Bridging JEA to an Operations Portal

To make JEA accessible without requiring non-technical staff to touch terminal windows, we wrapped these constrained endpoints inside a lightweight FastAPI microservice:

  1. Strict Pydantic Input Validation: Every request requires a valid workstation hostname and technician employee ID.
  2. Audit Logging in SQLite WAL: Every diagnostic command and service restart is logged with an immutable timestamp.
  3. Fail-Closed RBAC: Requests without verified session tokens fail with an explicit HTTP 403 Forbidden.

Explore our live interactive architecture showcase: 👉 Hybrid IT Operations Portal Case Study: https://hybrid-itops-portal.pages.dev/#story
👉 Full Engineering Portfolio: https://frank-portfolio-8gq.pages.dev