JEA Configuration Drift

Compare registered session configuration files (.pssc), role capability files (.psrc), and their file hashes across all systems. This would ensure that each server exposes the same administrative endpoints, permissions, and command sets while helping detect configuration drift.

Use PowerShell Desired State Configuration (DSC) to maintain consistency. DSC can deploy and enforce an identical JEA configuration across all target servers, automatically identifying and correcting any configuration drift to keep endpoints standardized.

You can also use remote PowerShell scripts to compare configuration files. For example, use Invoke-Command to run Get-FileHash on the .pssc and .psrc files stored in locations such as $env:SystemRoot\System32\WindowsPowerShell\v1.0\Modules\, then compare the resulting checksums with those from a known-good reference server. Matching hashes confirm that the same configuration files are deployed.

Inspect the registered JEA endpoints by using Get-PSSessionConfiguration to verify that the expected session configurations exist on each server. Combine this with Get-PSSessionCapability to confirm that the exposed cmdlets, functions, aliases, and role capabilities match the intended configuration.

In addition to verifying endpoint registration, compare session configuration settings such as virtual accounts, group mappings, startup scripts, and role definitions to ensure they are identical across all servers. Validating configuration files with Test-PSSessionConfigurationFile before deployment can help identify syntax or configuration issues.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin