{"id":26356784,"url":"https://github.com/marcobellaccini/jea-admcomm","last_synced_at":"2026-05-22T05:10:12.647Z","repository":{"id":255488634,"uuid":"153321541","full_name":"marcobellaccini/JEA-AdmComm","owner":"marcobellaccini","description":"Let certain users start specific programs with administrative privileges (easy Windows sudo)","archived":false,"fork":false,"pushed_at":"2018-10-19T09:16:22.000Z","size":45,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-09-05T19:07:37.818Z","etag":null,"topics":["administrator-rights","jea","powershell","privileges","sudo","windows"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/marcobellaccini.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-10-16T16:53:26.000Z","updated_at":"2021-11-25T03:55:54.000Z","dependencies_parsed_at":"2024-09-05T19:21:23.951Z","dependency_job_id":null,"html_url":"https://github.com/marcobellaccini/JEA-AdmComm","commit_stats":null,"previous_names":["marcobellaccini/jea-admcomm"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcobellaccini%2FJEA-AdmComm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcobellaccini%2FJEA-AdmComm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcobellaccini%2FJEA-AdmComm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/marcobellaccini%2FJEA-AdmComm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/marcobellaccini","download_url":"https://codeload.github.com/marcobellaccini/JEA-AdmComm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243875232,"owners_count":20361973,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["administrator-rights","jea","powershell","privileges","sudo","windows"],"created_at":"2025-03-16T13:32:02.046Z","updated_at":"2026-05-22T05:10:12.608Z","avatar_url":"https://github.com/marcobellaccini.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# JEA-AdmComm\r\nJEA-AdmComm is a tool that allows certain users to start some specific programs with administrative privileges in Microsoft Windows.\r\n\r\nSelected users will be able to start those programs in privileged mode just by clicking on a link, without entering any password.\r\n\r\nIt's a PowerShell module that leverages [JEA](https://docs.microsoft.com/en-us/powershell/jea/overview) and [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec) to let certain unprivileged users run specific processes with full administrative privileges.\r\n\r\nTechnically, it uses JEA to run PsExec with administrative rights, which in turn runs the specific process with the privileges of the System account.\r\n\r\n## SAQ (Should-Ask Questions)\r\n*Isn't JEA sufficient in itself for this?*\r\n\r\nNot always: for example, at the time of writing, JEA does not handle the GUI of the processes that it runs, while JEA-AdmComm does (through the combined use of JEA and PsExec).\r\n\r\n*Is JEA-AdmComm super-secure?*\r\n\r\nOf course not! It is a \"best-effort tool\" that shares the limitations of all the programs of its kind.\r\n\r\nFor instance, you may think that letting a user run Paint with administrative rights does not represent a security threat...\r\n\r\nBut, in fact, it does!\r\n\r\nFor example, after opening Paint with administrative rights, a user can select File -\u003e Open, opening a File Explorer instance with full system privileges.\r\n\r\n*So, why should I use it?*\r\n\r\nYou should prefer it over other 3rd party solutions for four reasons:\r\n- it is just a PowerShell module, using Microsoft-only software to get the job done\r\n- for the users, it is as easy as clicking on a link (no passwords to type!)\r\n- it does not store any password (neither in plaintext nor encrypted)\r\n- it is free and open source (but, of course, leverages Microsoft components such as PowerShell and PsExec, that come with their own licenses)\r\n\r\n*Who are you?*\r\n\r\nMarco Bellaccini - marco.bellaccini[at!]gmail.com\r\n\r\n## Installation\r\nIn order to install the module, you should first check that your PowerShell version is \u003e= 5.1.\r\n\r\nIf your are running at least Windows Server 2016 or an up-to-date Windows 10 you should be fine, otherwise you should [update PowerShell](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-windows-powershell?view=powershell-6#upgrading-existing-windows-powershell).\r\n\r\nAfter this, you should [download PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec), and extract the archive in some appropriate location (e.g.: C:\\LocalAdministration\\PSTools).\r\n\r\nThen, open a PowerShell **as Administrator**.\r\n\r\nIn order to setup WinRM (used by JEA), you have to type:\r\n\r\n```\r\nSet-Service -Name winrm -StartupType Automatic\r\nSet-Service -Name winrm -Status Running\r\n```\r\n\r\n(this shouldn't be needed on Windows Server since WinRM is enabled by default).\r\n\r\nWhen enabling WinRM, please remember to implement appropriate firewalling (for instance, if you're using WinRM only for JEA, you can configure Windows Firewall to drop WinRM connections from hosts other than localhost).\r\n\r\nThen, to install the module, type:\r\n\r\n```\r\npowershell -ExecutionPolicy Bypass [PATH_TO_INSTALL.ps1] [PATH_TO_PSEXEC64] [DOMAIN\\GROUP] [PATH_TO_TGTEXE1(,PATH_TO_TGTEXE2...)]\r\n```\r\n\r\nwhere:\r\n- PATH_TO_INSTALL.ps1 is the full path of the INSTALL.ps1 script bundled with JEA-AdmComm\r\n- PATH_TO_PSEXEC64 is the full path of the PsExec64 executable (32 bit systems are not supported!)\r\n- DOMAIN\\GROUP is the group of the users that will be granted permission to run the program with administrative privileges (**in the form DOMAIN\\GROUP** - you can use .\\GROUP for local groups)\r\n- PATH_TO_TGTEXE1(,PATH_TO_TGTEXE2...) is a comma-separated list of the full paths of the executables to launch with administrative rights\r\n- *when passing the arguments, if a path contains spaces, it must be enclosed in double (\")* **AND** *single (') quotation marks like this: \"'path with spaces'\"*\r\n\r\nThis will install the PowerShell module, configure JEA in the right way and create some nice links (with name beginning with \"ADM_\") in the *Links* folder (that will be created in the same folder where INSTALL.ps1 is located).\r\n\r\nPlease make sure that permissions on PsExec64 and target programs paths are set to prevent users from writing/modifying files (in order to block executable swapping attacks).\r\n\r\nYou can use the links generated by *INSTALL.ps1* to let users launch the programs with administrative rights (so, you'll probably need to copy the links somewhere - e.g. on target users' desktops).\r\n\r\n## Uninstallation\r\nOpen a command prompt (or a PowerShell) **as Administrator** and run:\r\n\r\n```\r\npowershell -ExecutionPolicy Bypass [PATH_TO_INSTALL.ps1] [PATH_TO_PSEXEC64] [DOMAIN\\GROUP] [PATH_TO_TGTEXE1(,PATH_TO_TGTEXE2...)] -uninstall\r\n```\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcobellaccini%2Fjea-admcomm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmarcobellaccini%2Fjea-admcomm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmarcobellaccini%2Fjea-admcomm/lists"}