Table of Contents

1. Challenge

   Configure Active Directory

   1. Create the two organizational units (OUs), one for privileged user accounts named Privileged Admins and another for non-privileged user accounts named User Accounts.
      1. Move the privileged user account admin_user to the privileged user account OU.
      2. Move the non-privlileged user account helpdesk_user to the non-privileged account OU.
   2. Create a Domain Local Active Directory security group named Helpdesk Staff.
   3. Add the helpdesk_user user to the Helpdesk Staff group.
2. Challenge

   Configure Just Enough Administration (JEA)

   1. Configure Just Enough Administration (JEA) to allow helpdesk staff to unlock accounts and reset passwords for non-privileged user accounts using the Active Directory powershell module:
      1. Create a module.
      2. Define role capabilities.
      3. Create the session configuration.
      4. Register the configuration.

   Please note: You can refer to the following code snippets when creating your role capabilities: Code Snippets

3. Challenge

   Test the Configuration

   1. Log on to BRAWKS1 as our non-privileged domain user account [email protected].
   2. Connect to BRADC1 using PowerShell Remoting and specify the configuration you created.
   3. Test unlocking accounts and resetting user accounts for prilvileged like admin_user and non-prilveged users like helpdesk_user.