Glossary
Just Enough Administration (JEA)
A PowerShell remoting feature that gives users only specific administrative commands on a server, through temporary virtual accounts.
Just Enough Administration (JEA) is a security technology built on PowerShell remoting. An administrator defines role capability files (.psrc) that list exactly which cmdlets, functions, parameters, parameter values and external programs a role may run, and a session configuration file (.pssc) that maps Active Directory groups to those roles. Users connect to the registered JEA endpoint with Enter-PSSession -ConfigurationName, where the session runs in NoLanguage mode and can only execute the allowed commands. Behind the scenes, commands run under a temporary virtual account or a group managed service account with the privileges needed, so the user never holds administrator rights on the machine.
JEA cuts the number of people who need standing admin rights, which reduces the credentials an attacker can steal and reuse. It can also record transcripts of every session for accountability when the session configuration sets a transcript directory. Design role capabilities carefully, because allowing commands such as Invoke-Expression, unrestricted Start-Process or arbitrary file writes can let a user escape the constraints. Start with a few repetitive tasks, such as restarting services, and expand.
See Just Enough Administration step by step and Hardening WinRM.