Windows Server 2019 – JEA endpoint registration fails with module path errors – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Just Enough Administration (JEA) endpoint registration fails on Windows Server 2019 with errors about missing role capability files or unreadable module paths, preventing delegated admin endpoints from being usable.

Environment & Reproduction

Reproducible when JEA modules are placed outside `$env:ProgramFilesWindowsPowerShellModules`.

Get-PSSessionConfiguration
Get-Module -ListAvailable -Name JeaModule

Root Cause Analysis

JEA requires role capability files inside a module discoverable via PSModulePath.

Quick Triage

Inspect endpoint and module layout.

Get-PSSessionConfiguration | Select Name,Permission,RunAsUser
Test-Path 'C:Program FilesWindowsPowerShellModulesJeaModuleRoleCapabilitiesHelpDesk.psrc'
$env:PSModulePath -split ';'

Step-by-Step Diagnosis

Validate session configuration file syntax.

Test-PSSessionConfigurationFile -Path 'C:JeaHelpDesk.pssc'
Get-Content 'C:JeaHelpDesk.pssc' | Select-String RoleDefinitions

Solution – Primary Fix

Move module into the correct path and re-register.

Copy-Item -Recurse -Force C:JeaJeaModule 'C:Program FilesWindowsPowerShellModules'
Unregister-PSSessionConfiguration -Name HelpDesk -Force -ErrorAction SilentlyContinue
Register-PSSessionConfiguration -Name HelpDesk -Path C:JeaHelpDesk.pssc

Solution – Alternative Approaches

Use New-PSRoleCapabilityFile and a versioned module for production.

New-PSRoleCapabilityFile -Path 'C:Program FilesWindowsPowerShellModulesJeaModuleRoleCapabilitiesHelpDesk.psrc' -VisibleCmdlets Restart-Service

Verification & Acceptance Criteria

JEA endpoint accepts connections and allows only configured cmdlets.

Enter-PSSession -ComputerName srv01 -ConfigurationName HelpDesk
Get-PSSessionConfiguration HelpDesk

Rollback Plan

Unregister the endpoint to revert to default WinRM behavior.

Unregister-PSSessionConfiguration -Name HelpDesk -Force

Prevention & Hardening

Version JEA modules in source control, sign role capability files, and audit endpoint usage.

Get-PSSessionConfiguration | Export-Clixml C:Tempjea-endpoints.xml

Related Errors & Cross-Refs

Linked with RunAs/JIT admin and admin tier model.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: Just Enough Administration overview.