pull base content,head:MicrosoftDocs:main,into:wwlpublishsync

wwlpublish · web-flow · commit fcf8998129cb · 2025-01-20T11:00:49.000+08:00
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/1-introduction.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/1-introduction.yml
@@ -4,7 +4,7 @@ title: Introduction
 metadata:
   title: Introduction
   description: "Introduction"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/2-explain-concept-of-just-enough-administration-jea.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/2-explain-concept-of-just-enough-administration-jea.yml
@@ -4,7 +4,7 @@ title: Explain the concept of Just Enough Administration (JEA)
 metadata:
   title: Explain the concept of Just Enough Administration (JEA)
   description: "Explain the concept of Just Enough Administration (JEA)"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/3-define-role-capabilities-for-jea-endpoint.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/3-define-role-capabilities-for-jea-endpoint.yml
@@ -4,7 +4,7 @@ title: Define role capabilities for a JEA endpoint
 metadata:
   title: Define role capabilities for a JEA endpoint
   description: "Define role capabilities for a JEA endpoint"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/4-create-session-configuration-file-to-register-jea-endpoint.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/4-create-session-configuration-file-to-register-jea-endpoint.yml
@@ -4,7 +4,7 @@ title: Create a session configuration file to register a JEA endpoint
 metadata:
   title: Create a session configuration file to register a JEA endpoint
   description: "Create a session configuration file to register a JEA endpoint"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/5-describe-how-jea-endpoints-work-to-limit-access-to-powershell-session.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/5-describe-how-jea-endpoints-work-to-limit-access-to-powershell-session.yml
@@ -4,7 +4,7 @@ title: Describe how JEA endpoints work to limit access to a PowerShell session
 metadata:
   title: Describe how JEA endpoints work to limit access to a PowerShell session
   description: "Describe how JEA endpoints work to limit access to a PowerShell session"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/6-create-connect-to-jea-endpoint.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/6-create-connect-to-jea-endpoint.yml
@@ -4,7 +4,7 @@ title: Create and connect to a JEA endpoint
 metadata:
   title: Create and connect to a JEA endpoint
   description: "Create and connect to a JEA endpoint"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/7-demonstration-connect-to-jea-endpoint.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/7-demonstration-connect-to-jea-endpoint.yml
@@ -4,7 +4,7 @@ title: 'Demonstration: Connect to a JEA endpoint'
 metadata:
   title: 'Demonstration: Connect to a JEA endpoint'
   description: "Demonstration: Connect to a JEA endpoint"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/8-knowledge-check.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/8-knowledge-check.yml
@@ -4,7 +4,7 @@ title: Knowledge check
 metadata:
   title: Knowledge check
   description: "Knowledge check"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
@@ -31,21 +31,21 @@ quiz:
     choices:
     - content: "SessionType"
       isCorrect: false
-      explanation: "Incorrect. The SessionType setting allows you to configure the sessions default settings but does not allow you to assign a special virtual account that has local administrative privileges."
+      explanation: "Incorrect. The SessionType setting allows you to configure the sessions default settings but doesn't allow you to assign a special virtual account that has local administrative privileges."
     - content: "RunAsVirtualAccount"
       isCorrect: true
       explanation: "Correct. The RunAsVirtualAccount setting allows you to have the JEA session use a special virtual account with local administrative privileges."
     - content: "RunAsVirtualAccountGroup"
       isCorrect: false
-      explanation: "Incorrect. The RunAsVirtualAccountGroup allows you to have the JEA session use a special virtual account that is a member of a specified security group, but unless this specified security group has been granted administrative privileges, does not provide any extra privileges to the virtual account."
+      explanation: "Incorrect. The RunAsVirtualAccountGroup allows you to have the JEA session use a special virtual account that is a member of a specified security group, but unless this specified security group has been granted administrative privileges, doesn't provide any extra privileges to the virtual account."
   - content: "In addition to the name of the remote computer being connected to, which of the following must be specified when connecting to a JEA endpoint using remote PowerShell?"
     choices:
     - content: "Endpoint configuration name"
       isCorrect: true
       explanation: "Correct: You must specify both the computername and the endpoint configuration name when making a remote PowerShell connection using JEA."
     - content: "Session configuration file name"
       isCorrect: false
-      explanation: "Incorrect: You need to have a session configuration file to configure a JEA endpoint, but do not need to specify the file name when remotely connecting to that endpoint."
+      explanation: "Incorrect: You need to have a session configuration file to configure a JEA endpoint, but don't need to specify the file name when remotely connecting to that endpoint."
     - content: "Role capability file name"
       isCorrect: false
-      explanation: "Incorrect: You need to have a role capability file to configure a JEA endpoint, but do not need to specify the file name when remotely connecting to that endpoint."
+      explanation: "Incorrect: You need to have a role capability file to configure a JEA endpoint, but don't need to specify the file name when remotely connecting to that endpoint."
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/9-summary-resources.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/9-summary-resources.yml
@@ -4,7 +4,7 @@ title: Summary resources
 metadata:
   title: Summary resources
   description: "Summary resources"
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: unit
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/1-introduction.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/1-introduction.md
@@ -1,30 +1,21 @@
-Just Enough Administration (JEA) is an administrative technology that allows you to apply role-based access control (RBAC) and the least privilege principles to Windows PowerShell remote sessions. Instead of assigning users broad roles that enable them to perform tasks that are not directly related to a specific work requirement, JEA allows you to configure special Windows PowerShell endpoints that provide only the functionality necessary to perform a specific task.
+Just Enough Administration (JEA) is an administrative technology that allows you to apply role-based access control (RBAC) and the least privilege principles to Windows PowerShell remote sessions. Instead of assigning users broad roles that enable them to perform tasks that aren't directly related to a specific work requirement, JEA allows you to configure special Windows PowerShell endpoints that provide only the functionality necessary to perform a specific task.
 
 ## Learning objectives
 
 After completing this module, you'll be able to:
 
 - Describe JEA.
-
 - Explain the limitations of JEA.
-
 - Describe role capabilities files and their use in JEA.
-
 - Describe sessions configuration files and their use in JEA.
-
 - Register JEA endpoints.
-
 - Connect to JEA endpoints.
 
 ## Prerequisites
 
 To get the best learning experience from this module, you should have:
 
 - Familiarity with PowerShell commands and syntax
-
 - Experience using PowerShell to administer Windows Server
-
 - Ability to create and edit PowerShell scripts
-
 - Ability to enable remote management and connect to a remote system
-
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/2-explain-concept-of-just-enough-administration-jea.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/2-explain-concept-of-just-enough-administration-jea.md
@@ -5,11 +5,8 @@ When you configure JEA, an authorized user connects to a specially configured en
 When connected to the endpoint, JEA uses a special, privileged, virtual account rather than the user’s account to perform tasks. The advantages of this approach include:
 
 - The user’s credentials are not stored on the remote system. If the remote system is compromised, the user’s credentials are not subject to credential theft and cannot be used to traverse the network and gain access to other hosts.
-
 - The user account that's used to connect to the endpoint doesn't need to be privileged. You simply need to configure the endpoint to allow connections from specified user accounts.
-
 - The virtual account is limited to the system on which it is hosted. The virtual account cannot be used to connect to remote systems. This means that attackers cannot use a compromised virtual account to access other protected servers.
-
 - The virtual account has local administrator privileges but is limited to performing only the activities defined by JEA. You can configure the virtual account with membership of a group other than the local Administrators group to further reduce privileges.
 
 ## JEA limitations
@@ -23,6 +20,6 @@ Also, JEA only works with Windows PowerShell sessions. While you can configure s
 JEA works on the following operating systems directly:
 
 - Windows Server 2016 or later
-
 - Windows 10 or later
 
+JEA will work with Windows Server 2012 R2 if you install Windows Management Framework 5.0.
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/3-define-role-capabilities-for-jea-endpoint.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/3-define-role-capabilities-for-jea-endpoint.md
@@ -5,13 +5,9 @@ You can create a new, blank, role capability file by using the **New-PSRoleCapab
 When you create a role capability file, you can define the following limitations for the Windows PowerShell session:
 
 - VisibleAliases. This setting lists which aliases to make available in the JEA (Just Enough Administration) session.
-
 - VisibleCmdlets. This setting lists which Windows PowerShell cmdlets are available in the session. You can choose either to list cmdlets, allowing all parameters and parameter values to be used, or limit cmdlets to particular parameters and parameter values.
-
 - VisibleFunctions. This setting lists which Windows PowerShell functions are available in the session. Again, you can choose to list functions, allowing all parameters and parameter values to be used, or you can limit functions to particular parameters and parameter values.
-
 - VisibleExternalCommands. This setting allows users who are connected to the session to run external commands. For example, you can use this field to allow access to c:\windows\system32\ whoami.exe so that users connected to the JEA session can identify their security context.
-
 - VisibleProviders. This setting lists Windows PowerShell providers that are visible to the session.
 
 You can also configure other settings such as which modules to import, which assemblies are loaded, and data types that are available. For a list of all the options when creating a role capabilities file, see [New-PSRoleCapabilityFile](/powershell/module/microsoft.powershell.core/new-psrolecapabilityfile).
@@ -23,13 +19,8 @@ It's important to properly configure your role capability files. If you give use
 Using the following process can help you decide how to configure your role capabilities files:
 
 1. Working with your IT team, survey your current tools and processes to identify which commands are needed.
-
 1. Whenever possible, move away from command-line tools to PowerShell cmdlets.
-
 1. Restrict which cmdlet parameters and values can be used to only those that are necessary to complete specific tasks.
-
 1. Prevent the use of commands that let users elevate their permissions or that allows them to run arbitrary code.
-
 1. Create custom functions with validation logic to replace complex commands.
-
 1. Test and monitor the list of allowed commands over time and modify as needed.
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/4-create-session-configuration-file-to-register-jea-endpoint.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/4-create-session-configuration-file-to-register-jea-endpoint.md
@@ -1,23 +1,17 @@
 Session configuration files are used to register a JEA (Just Enough Administration) endpoint. The session configuration file is responsible for naming the JEA endpoint. It also controls:
 
 - Who can access the JEA endpoint
-
 - What roles the user is assigned
-
 - Which identity is used by JEA's virtual account.
 
 Session configuration files use the .pssc file extension, and you create new session configuration files by using the **New-PSSessionConfigurationFile** cmdlet.
 
 You can also use session configuration files to define which cmdlets and functions are available in a JEA session, just like you can with role capabilities files. In addition, you can configure the following settings unique to session configure files:
 
 - SessionType. This setting allows you to configure the sessions default settings. The SessionType of RestrictedRemoteServer is used for sessions used by JEA for secure management.
-
 - RoleDefinitions. This setting is used to assign role capabilities to specific security groups.
-
 - RunAsVirtualAccount. This setting allows JEA to use the privileged virtual account created just for the JEA session. This account is a member of the local Administrators group and the Domain Admins group on domain controllers.
-
 - TranscriptDirectory. This setting specifies where JEA activity transcripts are stored.
-
 - RunAsVirtualAccountGroup. This setting allows you to specify the groups that the virtual account is a member of, instead of the default Administrators or Domain Admins groups.
 
-For a list of all the options when creating session configuration files, see [New-PSSessionConfigurationFile](/powershell/module/microsoft.powershell.core/new-pssessionconfigurationfile).
+For a list of all the options when creating session configuration files, see [New-PSSessionConfigurationFile](/powershell/module/microsoft.powershell.core/new-pssessionconfigurationfile).
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/5-describe-how-jea-endpoints-work-to-limit-access-to-powershell-session.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/5-describe-how-jea-endpoints-work-to-limit-access-to-powershell-session.md
@@ -8,12 +8,10 @@ With the JEA endpoints, your IT staff doesn't need to have privileged accounts t
 
 On a single computer, you can create JEA endpoints by using the **Register-PSSessionConfiguration** cmdlet. When using this cmdlet, you specify an endpoint name and a session configuration file located on the local machine. However, prior to creating the JEA endpoint you must ensure that the following prerequisites are met:
 
-You must have defined one or more roles, and the role capabilities file (or files)must be placed in the RoleCapabilities folder of a Windows PowerShell module.
+You must have defined one or more roles, and the role capabilities file (or files) must be placed in the RoleCapabilities folder of a Windows PowerShell module.
 
 - You have created a session configuration file.
-
 - The user registering JEA must be an administrator on the machine.
-
 - You have decided on a name for the JEA endpoint
 
 Windows Server ships with some predefined JEA endpoints, which have a name starting with Microsoft. You can find existing JEA endpoints using the following Windows PowerShell command:
@@ -35,27 +33,16 @@ Register-PSSessionConfiguration -Name DNSOps -Path .\DNSOps.pssc
 You can register JEA on multiple machines by using Desired State Configuration (DSC). To use DSC to deploy JEA, the following prerequisites must be met:
 
 - You must have defined one or more roles, and the role capabilities file (or files) must be placed in the RoleCapabilities folder of a Windows PowerShell module.
-
 - The PowerShell module must be stored on a read-only file share accessible by the machines.
-
 - You have determined the session configuration settings. (You don't need to create a session configuration file though.)
-
 - You have account credentials that have administrative access to each machine.
-
 - You have downloaded the JEA DSC resource from [https://github.com/PowerShell/JEA/tree/master/DSC Resource](https://github.com/PowerShell/JEA/tree/master/DSC%20Resource)
-
 - You have decided on a name for the JEA endpoint
 
 You can apply the DSC configuration using the Local Configuration Manager or by updating the pull server configuration.
 
-For more information about Registering JEA on multiple machines, refer to the GitHub page [JEA/DSC Resource/](/powershell/scripting/learn/remoting/jea/register-jea?view=powershell-7.1&preserve-view=true).
+For more information about Registering JEA on multiple machines, see the GitHub page [JEA/DSC Resource/](/powershell/scripting/learn/remoting/jea/register-jea?view=powershell-7.1&preserve-view=true).
 
 ## Check your knowledge
 
-Choose the best response for each of the questions below. 
-
----
-
-
-
----
+Choose the best response for each of the questions below.
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/6-create-connect-to-jea-endpoint.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/6-create-connect-to-jea-endpoint.md
@@ -5,9 +5,7 @@ You connect to a JEA endpoint by connecting interactively, using implicit remoti
 You can use JEA the same way you would connect with a regular PowerShell remoting session. To use JEA interactively, you need:
 
 - The remote computer name
-
 - The JEA endpoint name
-
 - An account with access to the desired endpoint
 
 For example, if you have access to the JEA endpoint named DNSOps on the local server, you can connect to the JEA endpoint using the following PowerShell command:
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/7-demonstration-connect-to-jea-endpoint.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/7-demonstration-connect-to-jea-endpoint.md
@@ -14,7 +14,5 @@ Watch this video to learn more about how to create a JEA endpoint and connect to
 The video explains how to:
 
 - Create a role capability file around DNS operations
-
 - Create a session configuration file that allows members of a specific Active Directory group to use the privileges granted in the role capability file using a virtual account
-
 - Testing that that JEA functions as expected by connecting using an unprivileged account to the JEA endpoint
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/9-summary-resources.md b/learn-pr/wwl-azure/just-enough-administration-windows-server/includes/9-summary-resources.md
@@ -1,22 +1,16 @@
-Having completed this module, you have the necessary knowledge to implement JEA as an administrative tool in Windows Server environments. You learned how to limit privileged operations to a set of specified PowerShell cmdlets, parameters, and variables, how to limit which users can connect to JEA endpoints and the level of privilege those users have when performing administrative tasks.
-
-Now that you have reviewed this module, you should be able to:
+By completing this module, you should be able to:
 
 - Explain the concept of Just Enough Administration (JEA)
-
+- Limit privileged operations to a set of specified PowerShell cmdlets
+- Limit which users can connect to JEA endpoints
 - Define role group capabilities and session configurations for a JEA session
-
 - Create and connect to a JEA endpoint
 
 ## Resources
 
 Use these resources to discover more.
 
 - [Overview of Just Enough Administration](/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.1&preserve-view=true)
-
 - [Role Capabilities](/powershell/scripting/learn/remoting/jea/role-capabilities?view=powershell-7.1&preserve-view=true)
-
 - [Session Configurations](/powershell/scripting/learn/remoting/jea/session-configurations?view=powershell-7.1&preserve-view=true)
-
 - [Using JEA](/powershell/scripting/learn/remoting/jea/using-jea?view=powershell-7.1&preserve-view=true)
-
diff --git a/learn-pr/wwl-azure/just-enough-administration-windows-server/index.yml b/learn-pr/wwl-azure/just-enough-administration-windows-server/index.yml
@@ -3,15 +3,15 @@ uid: learn.wwl.just-enough-administration-windows-server
 metadata:
   title: Just Enough Administration in Windows Server
   description: "Streamline the administration of your Windows Server environments with Just Enough Administration (JEA). Limit privileged operations to a set of specified PowerShell cmdlets, parameters and variables, and limit which users can connect to JEA endpoints. Constrain the level of privilege those users have when performing administrative tasks."
-  ms.date: 05/05/2023
+  ms.date: 01/15/2025
   author: wwlpublish
   ms.author: tonyj
   ms.topic: module
   ms.service: windows-server
 title: Just Enough Administration in Windows Server
 summary: Streamline administration of Windows Server environments with Just Enough Administration (JEA). Limit privileged operations to a set of specified PowerShell cmdlets, parameters and variables, and limit which users can connect to JEA endpoints.
 abstract: |
-  After completing this module, you will be able to:
+  After completing this module, you'll be able to:
   - Explain the concept of Just Enough Administration (JEA)
   - Define role group capabilities and session configurations for a JEA session
   - Create and connect to a JEA endpoint
