Understanding JEA Endpoints – 25 Exam Questions & Answers on PowerShell Access Control, DSC & Deployment | Windows Server 2026

This document contains approximately 25 expert-verified exam questions and answers covering Just Enough Administration (JEA) endpoints, PowerShell access control, and deployment strategies in Windows Server environments. The material provides a focused review of JEA architecture, role-based access control, session configuration, and Desired State Configuration (DSC) deployment methods. As shown on page 1, JEA stands for Just Enough Administration and its primary purpose is to limit access to a PowerShell session for specific authenticated users. The guide explains that users connected to a JEA endpoint can only access predefined sets of Windows PowerShell cmdlets, parameters, and values (page 2). It details how multiple JEA endpoints can be configured on a server—each tailored to a specific administrative task—such as a DNSOps endpoint for DNS administration. The document also highlights a major security benefit: IT staff do not require privileged accounts because they operate using privileges assigned to a virtual account. The study guide thoroughly covers endpoint creation and management, including the use of the Register-PSSessionConfiguration cmdlet to create endpoints and the prerequisite requirement that the registering user must be an administrator on the machine. It explains that before creating a JEA endpoint, one or more roles and a session configuration file (.pssc) must be defined. Page 3 outlines commands for discovering existing endpoints (Get-PSSessionConfiguration | Select-Object Name) and demonstrates how to register a DNSOps endpoint. It also explains how JEA can be deployed across multiple machines using Desired State Configuration (DSC), requiring a read-only file share containing the PowerShell module and administrative credentials for deployment. Advanced configuration components are discussed on page 4, including the RoleCapabilities folder (which stores role capability files), the significance of the session configuration file (defining settings and roles), and the role of the Local Configuration Manager (LCM) in applying DSC configurations. The document further clarifies that DSC stands for Desired State Configuration and identifies “Microsoft” as a common starting prefix for predefined JEA endpoints in Windows Server. This resource is especially relevant for Windows Server administrators, PowerShell engineers, DevOps professionals, system engineers, cybersecurity analysts, and IT infrastructure specialists preparing for Microsoft certification exams, enterprise security assessments, or internal access control audits. It is particularly useful for professionals implementing least-privilege administrative models in enterprise environments. The content aligns with Microsoft’s official documentation for Just Enough Administration (JEA) and Desired State Configuration (DSC), commonly referenced in Windows Server security hardening and PowerShell administration coursework. Keywords: JEA endpoints PowerShell 2026, Just Enough Administration definition, Register PSSessionConfiguration cmdlet, Get PSSessionConfiguration command, DNSOps JEA endpoint example, session configuration file pssc, RoleCapabilities folder JEA, virtual account privileges JEA, Desired State Configuration DSC deployment, Local Configuration Manager LCM role, read only file share DSC requirement, PowerShell role based access control, Microsoft predefined JEA endpoints, Windows Server access control security, least privilege administration model