[Autogenerated] next let's turn our attention to just enough
administration now we have G of course is in the library so I'm not
going to reinvent the wheel by going over step by step,
you can also check the exercise files because I have an excellent tutorial
that I actually based this demo on as a matter of fact,
but here's the high level view,
we're on a system called V M three A and we want to create a
custom session configuration that will allow our support
people to run just a certain command.
We're going to really restrict it.
In fact,
it's kind of a hello world example to create a GEA endpoint that allows you
to work with the spolar service because let's face it,
the prince puller is a pretty safe service to play around with.
Generally when you're learning PowerShell you work a lot with the spolar
service so we can see an active directory users and computers,
I've created an organizational unit called JIA,
in which I have created a global group called Spolar admins.
And in spolar admins, I have my Stacy harmon support user.
So the idea is we're going to create a constrained endpoint on this
server that would allow her to make a PowerShell remoting session
happen where she can restart the spolar service and she also can
run who am I but that's it,
so we can demonstrate it now if we were to do a standard connection,
if we connected to the default session configuration number one,
she wouldn't be allowed to do that anyway,
but our administrators can continue to do standard PowerShell
remoting against the standard session configurations.
So what I've done to set up this server,
let me show you, I've already got it running just to save time.
Let me go to the PowerShell module path on this system and that C program files,
Windows, PowerShell modules.
I've created a folder called Spolar underscore admins.
And in there I've created a session configuration file
called Spolar underscore camp and you need to have a sub
folder called role capabilities.
As you see here and in there, I've got my role capabilities file.
Spolar underscore admins.
So that's the way the scaffold looks.
Let me open up VS Code and let me show you what I've got going on here.
You can create a new session configuration and a new
capability file with PowerShell commands.
We don't need to worry about all of those steps again,
if you're interested, check the exercise files,
but what is important is for you to understand the high level view.
So first let's look in role capabilities and look at the role capability,
script which has the extension P SRC that stands for PowerShell Role capability.
Now we've got some matter and notice that when you create a new role
capability file with the new PS role capability file,
cmdlet it's heavily documented with comments.
It's pretty cool.
And the entire document as you can see online.
One is a hash table,
a key value set and the main things I want you to see here are
let me come down to line 25 visible command,
let's this is again going to be a hash table and array of commands that
will be available in that gs session and at this point,
the way I've set it up,
there's literally just one command available besides there's a
handful of defaults that come along for the ride when you
create a new session configuration,
but the only non default cmdlet I'm saying is going to be restart
service and you can even cut down the parameters that a non or sub
administrator can use when they're connected to your JIA endpoint In
this case we're just doing the name parameter and spolar is the only
valid name value in this case.
So it's a pretty constrained service.
If you look up above, you can work with aliases,
imported modules, all that kind of stuff functions.
The other thing for our exam purposes, I want you to see it, it's online.
32 visible external commands.
So these would be your x-axis that you're allowing and notice
that I'm allowing only who am I dot exe So that's really what
we want to see in the spolar.
Admin's role capability file,
it's defining what specifically is allowed to happen in the session.
Now the session configuration file has an extension,
PS sc for PowerShell session,
configuration and here I want to draw your attention first of all to line 16.
The recommended option here is restricted remote server which
gives you just a handful of commands like I said,
the default ones but you can choose empty and start from scratch,
you can play around with that.
It depends on that counter balance between the higher your security posture.
The lower the net usability tends to be.
So I've got restricted remote server.
Oh,
something I forgot to mention is whenever a user connects to Aguila endpoint
their entire session is recorded in a transcript folder.
So you want to make sure this folder exists on the machine?
I do have a c transcripts folder that I created something else that you should
know about that I didn't mention in the lecture portion is that you can
configure your geo sessions to run with a virtual account.
Now this is so cool.
This means that as long as the session is active there's an account
that's placed in the local administrators group for a workgroup
computer or domain admins if it's a domain controller that exists
only for the duration of that session.
So it's an ephemeral account.
Now you can use a group managed service account instead.
But that virtual account of some really clever engineering.
Now lastly online 28 role definitions.
This is important because it maps your active directory
or local groups to roll capabilities.
In my case I have one group.
Spolar admins and one roll capabilities.
Spolar admins.
So the only people who will be able to connect to this endpoint are
members of that group which there's just the one and they will be
subject to the role capabilities that we've specified in the spolar
admin's role capability.
Nice.
So let me come back to my test file and I'm going to want to
register this session configuration on this machine.
And as you see online six register PS session configuration,
you give it a name and then the path to the session configuration file.
Let me right click this and run the selection.
Now there's a warning that you have to restart the win RM service.
So I have that online nine.
Just as a convenience.
Now it looks like mine bombed out because I already have a spolar
admins session configuration already created on this machine but
we might as well go ahead and test.
Now now I'm signed in as my regular user, my tim user.
If I do who am I let me clear the screen and I'm going to
test by providing online 12 and 13.
My enter PS session syntax.
The VM is actually VM three a dot tim W dot info.
I'm specifying configuration named Spolar admins and my
credential is going to be my Stacy user.
So let me right click and choose.
Run selection that for some reason that line terminator kind of messed me up.
Let me get rid of that line terminator and let me do
this as a single line command.
There we go.
So let me provide Stacy's password here.
I'm having some issues here in my Visual Studio Code PowerShell integrated
console so I flipped over just to another console session and I was able to
connect in as Stacy just fine as you can see here.
So what I want to do is do a get command and we can see just
that handful of commands that are allowed.
Clear host, exit the session, Get command itself, get help measure.
So there's really not much that somebody can do when they connect
to Aguila endpoint other than any commands that you authorize so
Stacy should be able to do a restart.
Service of spolar just fine however get service is not allowed so it's
not even available in the session as you can see here,
remember that we're also allowing use of the who am I external command so
let me try who am I but if we try to do a ping let's say the command
doesn't recognize this is a heavily constrained JIA endpoint so to finish let me do an exit PS session and we're done